Edit tour

Windows Analysis Report
l4.exe

Overview

General Information

Sample name:	l4.exe
Analysis ID:	1577336
MD5:	d68f79c459ee4ae03b76fa5ba151a41f
SHA1:	bfa641085d59d58993ba98ac9ee376f898ee5f7b
SHA256:	aa50c900e210abb6be7d2420d9d5ae34c66818e0491aabd141421d175211fed6
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

l4.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\l4.exe" MD5: D68F79C459EE4AE03B76FA5BA151A41F)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

l4.exe (PID: 6608 cmdline: C:\Users\user\Desktop\l4.exe MD5: 63C4E3F9C7383D039AB4AF449372C17F)

l4.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe" MD5: D68F79C459EE4AE03B76FA5BA151A41F)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

l4.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe" MD5: 63C4E3F9C7383D039AB4AF449372C17F)

cleanup

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe, ProcessId: 6608, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: l4.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: l4.exe

Joe Sandbox ML: detected

Source: l4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: l4.exe, 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: l4.exe, 00000000.00000003.1942716174.0000021E947E5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: l4.exe, 00000000.00000003.1942716174.0000021E9474D000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E947E5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: l4.exe, 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 194.59.30.220:1336

Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220
Source: unknown	TCP traffic detected without corresponding DNS query: 194.59.30.220

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

Code function: 2_2_00007FFE133862B4 recv,

2_2_00007FFE133862B4

Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: l4.exe	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E94896000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3775759228.00000187AFC1C000.00000004.00001000.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2149238002.000001F40255C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: l4.exe	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: l4.exe	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: l4.exe	String found in binary or memory: https://json.org
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000000.1953252069.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000002.00000002.3777464571.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.html
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000000.1953252069.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000002.00000002.3777464571.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.htmlfor
Source: l4.exe	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: l4.exe, l4.exe, 00000006.00000002.2149635646.000001F402880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.ibm.com/
Source: l4.exe, 00000000.00000003.1942716174.0000021E94886000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779053332.00007FFDFB308000.00000008.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151469981.00007FFDFAC59000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.python.org/psf/license/)

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D12B0	2_2_00007FFE126D12B0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126DFA88	2_2_00007FFE126DFA88
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D4650	2_2_00007FFE126D4650
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D5F00	2_2_00007FFE126D5F00
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D23B0	2_2_00007FFE126D23B0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D2F80	2_2_00007FFE126D2F80
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D8F40	2_2_00007FFE126D8F40
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D73F8	2_2_00007FFE126D73F8
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D1920	2_2_00007FFE126D1920
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D1A00	2_2_00007FFE126D1A00
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126D55D0	2_2_00007FFE126D55D0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13216080	2_2_00007FFE13216080
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE132177F8	2_2_00007FFE132177F8
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13212DC0	2_2_00007FFE13212DC0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13213DC0	2_2_00007FFE13213DC0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13213B20	2_2_00007FFE13213B20
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13211000	2_2_00007FFE13211000
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE133810C0	2_2_00007FFE133810C0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13383B20	2_2_00007FFE13383B20
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE14637CA0	2_2_00007FFE14637CA0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13308F40	6_2_00007FFE13308F40
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133023B0	6_2_00007FFE133023B0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13302F80	6_2_00007FFE13302F80
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133073F8	6_2_00007FFE133073F8
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1330FA88	6_2_00007FFE1330FA88
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13304650	6_2_00007FFE13304650
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133012B0	6_2_00007FFE133012B0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13305F00	6_2_00007FFE13305F00
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133055D0	6_2_00007FFE133055D0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13301A00	6_2_00007FFE13301A00
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13301920	6_2_00007FFE13301920
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13336080	6_2_00007FFE13336080
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13331000	6_2_00007FFE13331000
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13333B20	6_2_00007FFE13333B20
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13332DC0	6_2_00007FFE13332DC0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13333DC0	6_2_00007FFE13333DC0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133377F8	6_2_00007FFE133377F8
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D10C0	6_2_00007FFE1A4D10C0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D3B20	6_2_00007FFE1A4D3B20
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4F7CA0	6_2_00007FFE1A4F7CA0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe AA50C900E210ABB6BE7D2420D9D5AE34C66818E0491AABD141421D175211FED6
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs l4.exe
Source: l4.exe, 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000000.00000003.1942716174.0000021E94886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs l4.exe
Source: l4.exe	Binary or memory string: OriginalFilename vs l4.exe
Source: l4.exe, 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe
Source: l4.exe, 00000002.00000002.3779642753.00007FFDFB431000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs l4.exe
Source: l4.exe, 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47D7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs l4.exe
Source: l4.exe, 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs l4.exe
Source: l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs l4.exe
Source: l4.exe	Binary or memory string: OriginalFilename vs l4.exe
Source: l4.exe, 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs l4.exe
Source: l4.exe, 00000006.00000002.2151708830.00007FFDFAD81000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs l4.exe
Source: l4.exe, 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs l4.exe

Source: classification engine

Classification label: mal72.adwa.winEXE@8/28@0/1

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03

Source: C:\Users\user\Desktop\l4.exe

File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851

Jump to behavior

Source: l4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\l4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: l4.exe

Binary or memory string: Insert thousands separators into a digit string. spec is a dictionary whose keys should include 'thousands_sep' and 'grouping'; typically it's the result of parsing the format specifier using _parse_format_specifier. The min_width keyword arg

Source: l4.exe

ReversingLabs: Detection: 63%

Source: l4.exe	String found in binary or memory: address_list = (address ("," address)) / obs-addr-list obs-addr-list = ([CFWS] ",") address *("," [address / CFWS]) We depart from the formal grammar here by continuing to parse until the end of the input, assuming the input to be entirely
Source: l4.exe	String found in binary or memory: --helpr
Source: l4.exe	String found in binary or memory: --helpr
Source: l4.exe	String found in binary or memory: helpz#use -h/--help for command line helprJ
Source: l4.exe	String found in binary or memory: helpz#use -h/--help for command line helprJ
Source: l4.exe	String found in binary or memory: - conflict_handler -- String indicating how to handle conflicts - add_help -- Add a -h/-help option - allow_abbrev -- Allow long options to be abbreviated unambiguously - exit_on_error -- Determines whether or not ArgumentParser exi
Source: l4.exe	String found in binary or memory: angle-addr-startr
Source: l4.exe	String found in binary or memory: angle-addr-startr
Source: l4.exe	String found in binary or memory: for more digits precision -u/--unit: set the output time unit (nsec, usec, msec, or sec) -h/--help: print this usage message and exit --: separate options from statement, use when statement starts with - statement: statement to be timed (default 'pass
Source: l4.exe	String found in binary or memory: for more digits precision -u/--unit: set the output time unit (nsec, usec, msec, or sec) -h/--help: print this usage message and exit --: separate options from statement, use when statement starts with - statement: statement to be timed (default 'pass
Source: l4.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: l4.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: l4.exe	String found in binary or memory: ``True`` if the address is defined as globally reachable by iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_ (for IPv6) with the following exception: For IPv4-mapped IPv6-addresses the ``is_private`` value is deter
Source: l4.exe	String found in binary or memory: .rte. AIX ABI compatibility is described as guaranteed at: https://www.ibm.com/ support/knowledgecenter/en/ssw_aix_72/install/binary_compatability.html For pep425 purposes the AIX platform tag becomes: "aix-{:1x}{:1d}{:02d}-{:04d}-{}".format(v
Source: l4.exe	String found in binary or memory: * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the semantics of the underlying IPv4 addresses and the following condition holds (see :attr:`IPv6Address.ipv4_mapped`):: address.is_private == a
Source: l4.exe	String found in binary or memory: Fused multiply-add. Returns selfother+third with no rounding of the intermediate product selfother. self and other are multiplied together, with no rounding of the result. The third operand is then added to the result,
Source: l4.exe	String found in binary or memory: The name of the reverse DNS pointer for the IP address, e.g.: >>> ipaddress.ip_address("127.0.0.1").reverse_pointer '1.0.0.127.in-addr.arpa' >>> ipaddress.ip_address("2001:db8::1").reverse_pointer '1.0.0.0.0.0.0.
Source: l4.exe	String found in binary or memory: zcUsage: %s [-n \| -t \| -h] url -n: open new window -t: open new tab -h, --help: show helpr"
Source: l4.exe	String found in binary or memory: zcUsage: %s [-n \| -t \| -h] url -n: open new window -t: open new tab -h, --help: show helpr"
Source: l4.exe	String found in binary or memory: msg-id-startr
Source: l4.exe	String found in binary or memory: no-fold-literal-startr
Source: l4.exe	String found in binary or memory: no-fold-literal-startr
Source: l4.exe	String found in binary or memory: msg-id-startr
Source: l4.exe	String found in binary or memory: zcUsage: %s [-n \| -t \| -h] url -n: open new window -t: open new tab -h, --help: show helpr"
Source: l4.exe	String found in binary or memory: zcUsage: %s [-n \| -t \| -h] url -n: open new window -t: open new tab -h, --help: show helpr"
Source: l4.exe	String found in binary or memory: The name of the reverse DNS pointer for the IP address, e.g.: >>> ipaddress.ip_address("127.0.0.1").reverse_pointer '1.0.0.127.in-addr.arpa' >>> ipaddress.ip_address("2001:db8::1").reverse_pointer '1.0.0.0.0.0.0.
Source: l4.exe	String found in binary or memory: Fused multiply-add. Returns selfother+third with no rounding of the intermediate product selfother. self and other are multiplied together, with no rounding of the result. The third operand is then added to the result,
Source: l4.exe	String found in binary or memory: * For IPv4-mapped IPv6-addresses the ``is_private`` value is determined by the semantics of the underlying IPv4 addresses and the following condition holds (see :attr:`IPv6Address.ipv4_mapped`):: address.is_private == a
Source: l4.exe	String found in binary or memory: .rte. AIX ABI compatibility is described as guaranteed at: https://www.ibm.com/ support/knowledgecenter/en/ssw_aix_72/install/binary_compatability.html For pep425 purposes the AIX platform tag becomes: "aix-{:1x}{:1d}{:02d}-{:04d}-{}".format(v
Source: l4.exe	String found in binary or memory: angle-addr-startr
Source: l4.exe	String found in binary or memory: angle-addr-startr
Source: l4.exe	String found in binary or memory: ``True`` if the address is defined as globally reachable by iana-ipv4-special-registry_ (for IPv4) or iana-ipv6-special-registry_ (for IPv6) with the following exception: For IPv4-mapped IPv6-addresses the ``is_private`` value is deter
Source: l4.exe	String found in binary or memory: for more digits precision -u/--unit: set the output time unit (nsec, usec, msec, or sec) -h/--help: print this usage message and exit --: separate options from statement, use when statement starts with - statement: statement to be timed (default 'pass
Source: l4.exe	String found in binary or memory: for more digits precision -u/--unit: set the output time unit (nsec, usec, msec, or sec) -h/--help: print this usage message and exit --: separate options from statement, use when statement starts with - statement: statement to be timed (default 'pass
Source: l4.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: l4.exe	String found in binary or memory: Usage: mimetypes.py [options] type Options: --help / -h -- print this message and exit --lenient / -l -- additionally search of some common, but non-standard types. --extension / -e -- guess extension instead of
Source: l4.exe	String found in binary or memory: --helpr
Source: l4.exe	String found in binary or memory: --helpr
Source: l4.exe	String found in binary or memory: helpz#use -h/--help for command line helprJ
Source: l4.exe	String found in binary or memory: helpz#use -h/--help for command line helprJ
Source: l4.exe	String found in binary or memory: - conflict_handler -- String indicating how to handle conflicts - add_help -- Add a -h/-help option - allow_abbrev -- Allow long options to be abbreviated unambiguously - exit_on_error -- Determines whether or not ArgumentParser exi
Source: l4.exe	String found in binary or memory: address_list = (address ("," address)) / obs-addr-list obs-addr-list = ([CFWS] ",") address *("," [address / CFWS]) We depart from the formal grammar here by continuing to parse until the end of the input, assuming the input to be entirely

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

File read: C:\Users\user\Desktop\l4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\l4.exe "C:\Users\user\Desktop\l4.exe"
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe C:\Users\user\Desktop\l4.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"
Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe C:\Users\user\Desktop\l4.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\l4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Section loaded: python312.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: python312.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: l4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: l4.exe

Static file information: File size 6174208 > 1048576

Source: l4.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x5b3000

Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: l4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: l4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: l4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: l4.exe, 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94F1B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4840F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: l4.exe, 00000000.00000003.1942716174.0000021E947E5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: l4.exe, 00000000.00000003.1942716174.0000021E9474D000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47C41000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E947E5000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47CD9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: l4.exe, 00000000.00000003.1942716174.0000021E94372000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47866000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: l4.exe, 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmp, l4.exe, 00000000.00000003.1942716174.0000021E9504B000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000000.00000003.1953805371.0000021E92468000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4853F000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2095754277.000001FA45958000.00000004.00000020.00020000.00000000.sdmp

Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: l4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: vcruntime140_1.dll.0.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: l4.exe	Static PE information: section name: _RDATA
Source: vcruntime140.dll.0.dr	Static PE information: section name: fothk
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: l4.exe.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: l4.exe.2.dr	Static PE information: section name: _RDATA
Source: l4.exe0.2.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.4.dr	Static PE information: section name: .00cfg
Source: python312.dll.4.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.4.dr	Static PE information: section name: fothk
Source: vcruntime140.dll.4.dr	Static PE information: section name: _RDATA
Source: l4.exe.4.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13219B0C push 82000085h; retn 0000h		2_2_00007FFE13219B11
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13339B0C push 82000085h; retn 0000h		6_2_00007FFE13339B11

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

API coverage: 2.2 %

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe TID: 6980	Thread sleep count: 141 > 30			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe TID: 6980	Thread sleep time: -141000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: l4.exe, 00000004.00000002.2155771797.000001FA45948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: l4.exe, 00000002.00000002.3776421990.00000187AFFA4000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000003.2144450033.000001F4025EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2149393855.000001F402600000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000003.2143519244.000001F4025EB000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000003.2144562846.000001F4025F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

Code function: 2_2_00007FFE126E3E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00007FFE126E3E60

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126E3E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFE126E3E60
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE126E38A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE126E38A0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE1321AA7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFE1321AA7C
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE1321A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE1321A050
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13382D70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE13382D70
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE13383328 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFE13383328
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE14640AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE14640AA8
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE148B14E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFE148B14E0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE148B1AA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFE148B1AA0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE13313E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE13313E60
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE133138A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE133138A0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1333A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE1333A050
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1333AA7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE1333AA7C
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4C1AA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE1A4C1AA0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4C14E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE1A4C14E0
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D2D70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE1A4D2D70
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D3328 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE1A4D3328
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A500AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE1A500AA8

Source: C:\Users\user\Desktop\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe C:\Users\user\Desktop\l4.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Queries volume information: C:\Users\user\Desktop\l4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390 VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\l4.exe

Code function: 0_2_00007FF6CBA2C0F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6CBA2C0F0

Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE133850C0 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,	2_2_00007FFE133850C0
Source: C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	Code function: 2_2_00007FFE133860CC _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,	2_2_00007FFE133860CC
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D60CC _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,	6_2_00007FFE1A4D60CC
Source: C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	Code function: 6_2_00007FFE1A4D50C0 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,	6_2_00007FFE1A4D50C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	12 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
l4.exe	63%	ReversingLabs	Win64.Trojan.Amadey
l4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	63%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe	63%	ReversingLabs	Win64.Trojan.Amadey

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://nuitka.net/info/segfault.html	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000000.1953252069.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000002.00000002.3777464571.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	false	high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	l4.exe	false	high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	l4.exe	false	high
https://www.ibm.com/	l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://github.com/python/cpython/issues/86361.	l4.exe	false	high
https://www.openssl.org/H	l4.exe, 00000000.00000003.1942716174.0000021E94886000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47D7A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://json.org	l4.exe	false	high
http://www.iana.org/time-zones/repository/tz-link.html	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://packaging.python.org/specifications/entry-points/	l4.exe	false	high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://peps.python.org/pep-0205/	l4.exe, l4.exe, 00000006.00000002.2149635646.000001F402880000.00000004.00001000.00020000.00000000.sdmp	false	high
http://speleotrove.com/decimal/decarith.html	l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://docs.python.org/3/howto/mro.html.	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3775759228.00000187AFC1C000.00000004.00001000.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2149238002.000001F40255C000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/)	l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp	false	high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	l4.exe, l4.exe, 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmp	false	high
https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	false	high
https://nuitka.net/info/segfault.htmlfor	l4.exe, 00000000.00000003.1942716174.0000021E93D13000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000000.1953252069.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000002.00000002.3777464571.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA47207000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0263/	l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmp	false	high
https://www.python.org/psf/license/	l4.exe, 00000000.00000003.1942716174.0000021E94C8A000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000002.00000002.3779053332.00007FFDFB308000.00000008.00000001.01000000.00000005.sdmp, l4.exe, 00000004.00000003.2088356423.000001FA4817E000.00000004.00000020.00020000.00000000.sdmp, l4.exe, 00000006.00000002.2151469981.00007FFDFAC59000.00000008.00000001.01000000.0000000E.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.59.30.220	unknown	Germany		30823	COMBAHTONcombahtonGmbHDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577336
Start date and time:	2024-12-18 12:15:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l4.exe
Detection:	MAL
Classification:	mal72.adwa.winEXE@8/28@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target l4.exe, PID 6672 because there are no executed function
Execution Graph export aborted for target l4.exe, PID 7148 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: l4.exe

Simulations

Behavior and APIs

Time	Type	Description
11:16:53	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.59.30.220	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220:5000/download
194.59.30.220	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220:5000/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	client.exe	Get hash	malicious	Unknown	Browse	194.59.30.220
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	194.59.30.164
	Support.ClientSetup.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.27
	Counseling_Services_Overview.docm	Get hash	malicious	Unknown	Browse	45.147.231.195
	Nowe zam#U00f3wienie - 0072291855.pdf (243KB).com.exe	Get hash	malicious	Quasar	Browse	194.59.31.75
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	194.59.31.199

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd	client.exe	Get hash	malicious	Unknown	Browse
	client.exe	Get hash	malicious	Unknown	Browse
	fWAr4zGUkY.exe	Get hash	malicious	Remcos, Amadey, Stealc	Browse
	fbc5UlsRXq.exe	Get hash	malicious	Unknown	Browse
	5SkF9LFhB3.exe	Get hash	malicious	Unknown	Browse
	WUD0WG3OdV.exe	Get hash	malicious	Unknown	Browse
	98Y05R2rTb.exe	Get hash	malicious	Unknown	Browse
	aLsxeH29P2.exe	Get hash	malicious	Unknown	Browse
	c9a6BV0eQO.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe	fWAr4zGUkY.exe	Get hash	malicious	Remcos, Amadey, Stealc	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6174208
Entropy (8bit):	7.990978110457585
Encrypted:	true
SSDEEP:	98304:copJ0ndCADji3dh8iemrdbYOssb5+7wFADy/+sXBuVoDtnOPyz70fhhQAHHDRWfU:cc0cWjigIbCs+ZivuVoDFOKn0fPyqEvo
MD5:	D68F79C459EE4AE03B76FA5BA151A41F
SHA1:	BFA641085D59D58993BA98AC9EE376F898EE5F7B
SHA-256:	AA50C900E210ABB6BE7D2420D9D5AE34C66818E0491AABD141421D175211FED6
SHA-512:	BD4EF3E3708DF81D53B2E9050447032E8DCDCC776CF0353077310F208A30DAB8F31D6EC6769D47FB6C05C642BDD7A58FB4F93D9D28E2DE0EFC01312FBC5E391E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: fWAr4zGUkY.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........jO..jO..jO..!7..lO..!7...O..!7..`O..jO..kO..l...hO..l...BO..l...zO..l...{O..!7..oO..jO...O......kO......kO..RichjO..................PE..d...O.Xg.........."....&.....,\................@..............................`...........`.....................................................<....p..X/[..@..T.............`.....`............................... ...@............ ...............................text...P........................... ..`.rdata....... ......................@..@.data...pN..........................@....pdata..T....@......................@..@_RDATA.......`......................@..@.rsrc...X/[..p...0[.................@..@.reloc........`.......^.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591841805043941
Encrypted:	false
SSDEEP:	1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5:	30F396F8411274F15AC85B14B7B3CD3D
SHA1:	D3921F39E193D89AA93C2677CBFB47BC1EDE949C
SHA-256:	CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
SHA-512:	7D997EF18E2CBC5BCA20A4730129F69A6D19ABDDA0261B06AD28AD8A2BDDCDECB12E126DF9969539216F4F51467C0FE954E4776D842E7B373FE93A8246A5CA3F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: client.exe, Detection: malicious, Browse Filename: client.exe, Detection: malicious, Browse Filename: fWAr4zGUkY.exe, Detection: malicious, Browse Filename: fbc5UlsRXq.exe, Detection: malicious, Browse Filename: 5SkF9LFhB3.exe, Detection: malicious, Browse Filename: WUD0WG3OdV.exe, Detection: malicious, Browse Filename: 98Y05R2rTb.exe, Detection: malicious, Browse Filename: aLsxeH29P2.exe, Detection: malicious, Browse Filename: c9a6BV0eQO.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565831509727426
Encrypted:	false
SSDEEP:	6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5:	7AE94F5A66986CBC1A2B3C65A8D617F3
SHA1:	28ABEFB1DF38514B9FFE562F82F8C77129CA3F7D
SHA-256:	DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
SHA-512:	FBB599270066C43B5D3A4E965FB2203B085686479AF157CD0BB0D29ED73248B6F6371C5158799F6D58B1F1199B82C01ABE418E609EA98C71C37BB40F3226D8C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.....<.......................................................4....`..........................................c..P....c...................&......./......T.......T...............................@............................................text...v........................... ..`.rdata..............................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227186392528159
Encrypted:	false
SSDEEP:	1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5:	A25BC2B21B555293554D7F611EAA75EA
SHA1:	A0DFD4FCFAE5B94D4471357F60569B0C18B30C17
SHA-256:	43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
SHA-512:	B39767C2757C65500FC4F4289CB3825333D43CB659E3B95AF4347BD2A277A7F25D18359CEDBDDE9A020C7AB57B736548C739909867CE9DE1DBD3F638F4737DC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.V.......... @....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85410280956396
Encrypted:	false
SSDEEP:	3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5:	9E94FAC072A14CA9ED3F20292169E5B2
SHA1:	1EEAC19715EA32A65641D82A380B9FA624E3CF0D
SHA-256:	A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
SHA-512:	B7B3D0F737DD3B88794F75A8A6614C6FB6B1A64398C6330A52A2680CAF7E558038470F6F3FC024CE691F6F51A852C05F7F431AC2687F4525683FF09132A0DECB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(.f..........`8..............................................C.....`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.3186936632343205
Encrypted:	false
SSDEEP:	1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5:	69801D1A0809C52DB984602CA2653541
SHA1:	0F6E77086F049A7C12880829DE051DCBE3D66764
SHA-256:	67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
SHA-512:	5FCE77DD567C046FEB5A13BAF55FDD8112798818D852DFECC752DAC87680CE0B89EDFBFBDAB32404CF471B70453A33F33488D3104CD82F4E0B94290E83EAE7BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.x..........0-.......................................`............`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.340152202881265
Encrypted:	false
SSDEEP:	768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
MD5:	827615EEE937880862E2F26548B91E83
SHA1:	186346B816A9DE1BA69E51042FAF36F47D768B6C
SHA-256:	73B7EE3156EF63D6EB7DF9900EF3D200A276DF61A70D08BD96F5906C39A3AC32
SHA-512:	45114CAF2B4A7678E6B1E64D84B118FB3437232B4C0ADD345DDB6FBDA87CEBD7B5ADAD11899BDCD95DDFE83FDC3944A93674CA3D1B5F643A2963FBE709E44FB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.L...L...L...E..J.......H.......H.......D...Y...N.......Q.......K...L...........M...Y...M...Y...M...Y...M...Y...M...RichL...........PE..d...db.f.........." ...(....<.......(...................................................`..........................................V..H...HV..................x....d.../......t...dG..T............................C..@............@.......S..@....................text...n(......................... ..`.rdata..4 ...@..."..................@..@.data........p.......P..............@....pdata..x............T..............@..@.rsrc................X..............@..@.reloc..t............b..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6162432
Entropy (8bit):	5.64790582887791
Encrypted:	false
SSDEEP:	98304:OSoY112XQr2fqDVS1K17UpJwIX4OzWObPPumo0:doq1QQSfqDVgX
MD5:	63C4E3F9C7383D039AB4AF449372C17F
SHA1:	F52FF760A098A006C41269FF73ABB633B811F18E
SHA-256:	151524F6C1D1AEAC530CFD69DE15C3336043DC8EB3F5AEAA31513E24BFD7ACDD
SHA-512:	DCFB4804C5569AD13E752270D13320F8769601B7092544741E35BC62A22AF363B7A5EA7C5A65132C9575540A3E689A6946110502BD0F046385B8739E81761FBF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|..Q\|..Q\|..Q7..Pw..Q7..P...Q7..Pq..Q\|..Q}..Qzz.Q~..Qzz.PU..Qzz.Pl..Qzz.Pm..Qi..P~..Q7..Py..Q\|..Q...Q.z.Pz..Q.z.P}..QRich\|..Q................PE..d...K.Xg.........."....&.....VY................@..............................^...........`.................................................\|...<....`..P.W......4...........p^.....................................p...@............................................text............................... ..`.rdata..t...........................@..@.data...8....`...n...D..............@....pdata...4.......6..................@..@_RDATA.......P......................@..@.rsrc...P.W..`....W.................@..@.reloc.......p^.......].............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\python312.dll

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765552513907485
Encrypted:	false
SSDEEP:	49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5:	166CC2F997CBA5FC011820E6B46E8EA7
SHA1:	D6179213AFEA084F02566EA190202C752286CA1F
SHA-256:	C045B57348C21F5F810BAE60654AE39490846B487378E917595F1F95438F9546
SHA-512:	49D9D4DF3D7EF5737E947A56E48505A2212E05FDBCD7B83D689639728639B7FD3BE39506D7CFCB7563576EBEE879FD305370FDB203909ED9B522B894DD87AACB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..(..4B..... .........................................j......[j...`..........................................cN.d...$1O.......i......._.xI....i../... i.([....2.T.....................H.(...p.2.@............ (..............................text.....(.......(................. ..`.rdata...6'.. (..8'...(.............@..@.data....I...`O......HO.............@....pdata..xI...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc..([... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\select.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.556986708902353
Encrypted:	false
SSDEEP:	384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5:	7C14C7BC02E47D5C8158383CB7E14124
SHA1:	5EE9E5968E7B5CE9E4C53A303DAC9FC8FAF98DF3
SHA-256:	00BD8BB6DEC8C291EC14C8DDFB2209D85F96DB02C7A3C39903803384FF3A65E5
SHA-512:	AF70CBDD882B923013CB47545633B1147CE45C547B8202D7555043CFA77C1DEEE8A51A2BC5F93DB4E3B9CBF7818F625CA8E3B367BFFC534E26D35F475351A77C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.....2.......................................................o....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4620027688967845
Encrypted:	false
SSDEEP:	12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5:	A8ED52A66731E78B89D3C6C6889C485D
SHA1:	781E5275695ACE4A5C3AD4F2874B5E375B521638
SHA-256:	BF669344D1B1C607D10304BE47D2A2FB572E043109181E2C5C1038485AF0C3D7
SHA-512:	1C131911F120A4287EBF596C52DE047309E3BE6D99BC18555BD309A27E057CC895A018376AA134DF1DC13569F47C97C1A6E8872ACEDFA06930BBF2B175AF9017
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.@..........0.......................................p.......)....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140_1.dll

Download File

Process:	C:\Users\user\Desktop\l4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591841805043941
Encrypted:	false
SSDEEP:	1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
MD5:	30F396F8411274F15AC85B14B7B3CD3D
SHA1:	D3921F39E193D89AA93C2677CBFB47BC1EDE949C
SHA-256:	CB15D6CC7268D3A0BD17D9D9CEC330A7C1768B1C911553045C73BC6920DE987F
SHA-512:	7D997EF18E2CBC5BCA20A4730129F69A6D19ABDDA0261B06AD28AD8A2BDDCDECB12E126DF9969539216F4F51467C0FE954E4776D842E7B373FE93A8246A5CA3F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565831509727426
Encrypted:	false
SSDEEP:	6144:/CxJS14bteS9B+ApcG0Qos0KR29py9qWM53pLW1AZHVHMhhhKoDStGwL0zsWD:/aeS9B+HQosbY9FfHVHXfEsWD
MD5:	7AE94F5A66986CBC1A2B3C65A8D617F3
SHA1:	28ABEFB1DF38514B9FFE562F82F8C77129CA3F7D
SHA-256:	DA8BB3D54BBBA20D8FA6C2FD0A4389AEC80AB6BD490B0ABEF5BD65097CBC0DA4
SHA-512:	FBB599270066C43B5D3A4E965FB2203B085686479AF157CD0BB0D29ED73248B6F6371C5158799F6D58B1F1199B82C01ABE418E609EA98C71C37BB40F3226D8C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.....<.......................................................4....`..........................................c..P....c...................&......./......T.......T...............................@............................................text...v........................... ..`.rdata..............................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227186392528159
Encrypted:	false
SSDEEP:	1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
MD5:	A25BC2B21B555293554D7F611EAA75EA
SHA1:	A0DFD4FCFAE5B94D4471357F60569B0C18B30C17
SHA-256:	43ACECDC00DD5F9A19B48FF251106C63C975C732B9A2A7B91714642F76BE074D
SHA-512:	B39767C2757C65500FC4F4289CB3825333D43CB659E3B95AF4347BD2A277A7F25D18359CEDBDDE9A020C7AB57B736548C739909867CE9DE1DBD3F638F4737DC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.V.......... @....................................................`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85410280956396
Encrypted:	false
SSDEEP:	3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
MD5:	9E94FAC072A14CA9ED3F20292169E5B2
SHA1:	1EEAC19715EA32A65641D82A380B9FA624E3CF0D
SHA-256:	A46189C5BD0302029847FED934F481835CB8D06470EA3D6B97ADA7D325218A9F
SHA-512:	B7B3D0F737DD3B88794F75A8A6614C6FB6B1A64398C6330A52A2680CAF7E558038470F6F3FC024CE691F6F51A852C05F7F431AC2687F4525683FF09132A0DECB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(.f..........`8..............................................C.....`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.3186936632343205
Encrypted:	false
SSDEEP:	1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
MD5:	69801D1A0809C52DB984602CA2653541
SHA1:	0F6E77086F049A7C12880829DE051DCBE3D66764
SHA-256:	67ACA001D36F2FCE6D88DBF46863F60C0B291395B6777C22B642198F98184BA3
SHA-512:	5FCE77DD567C046FEB5A13BAF55FDD8112798818D852DFECC752DAC87680CE0B89EDFBFBDAB32404CF471B70453A33F33488D3104CD82F4E0B94290E83EAE7BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.x..........0-.......................................`............`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.340152202881265
Encrypted:	false
SSDEEP:	768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
MD5:	827615EEE937880862E2F26548B91E83
SHA1:	186346B816A9DE1BA69E51042FAF36F47D768B6C
SHA-256:	73B7EE3156EF63D6EB7DF9900EF3D200A276DF61A70D08BD96F5906C39A3AC32
SHA-512:	45114CAF2B4A7678E6B1E64D84B118FB3437232B4C0ADD345DDB6FBDA87CEBD7B5ADAD11899BDCD95DDFE83FDC3944A93674CA3D1B5F643A2963FBE709E44FB8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.L...L...L...E..J.......H.......H.......D...Y...N.......Q.......K...L...........M...Y...M...Y...M...Y...M...Y...M...RichL...........PE..d...db.f.........." ...(....<.......(...................................................`..........................................V..H...HV..................x....d.../......t...dG..T............................C..@............@.......S..@....................text...n(......................... ..`.rdata..4 ...@..."..................@..@.data........p.......P..............@....pdata..x............T..............@..@.rsrc................X..............@..@.reloc..t............b..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6162432
Entropy (8bit):	5.64790582887791
Encrypted:	false
SSDEEP:	98304:OSoY112XQr2fqDVS1K17UpJwIX4OzWObPPumo0:doq1QQSfqDVgX
MD5:	63C4E3F9C7383D039AB4AF449372C17F
SHA1:	F52FF760A098A006C41269FF73ABB633B811F18E
SHA-256:	151524F6C1D1AEAC530CFD69DE15C3336043DC8EB3F5AEAA31513E24BFD7ACDD
SHA-512:	DCFB4804C5569AD13E752270D13320F8769601B7092544741E35BC62A22AF363B7A5EA7C5A65132C9575540A3E689A6946110502BD0F046385B8739E81761FBF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|..Q\|..Q\|..Q7..Pw..Q7..P...Q7..Pq..Q\|..Q}..Qzz.Q~..Qzz.PU..Qzz.Pl..Qzz.Pm..Qi..P~..Q7..Py..Q\|..Q...Q.z.Pz..Q.z.P}..QRich\|..Q................PE..d...K.Xg.........."....&.....VY................@..............................^...........`.................................................\|...<....`..P.W......4...........p^.....................................p...@............................................text............................... ..`.rdata..t...........................@..@.data...8....`...n...D..............@....pdata...4.......6..................@..@_RDATA.......P......................@..@.rsrc...P.W..`....W.................@..@.reloc.......p^.......].............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\python312.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765552513907485
Encrypted:	false
SSDEEP:	49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
MD5:	166CC2F997CBA5FC011820E6B46E8EA7
SHA1:	D6179213AFEA084F02566EA190202C752286CA1F
SHA-256:	C045B57348C21F5F810BAE60654AE39490846B487378E917595F1F95438F9546
SHA-512:	49D9D4DF3D7EF5737E947A56E48505A2212E05FDBCD7B83D689639728639B7FD3BE39506D7CFCB7563576EBEE879FD305370FDB203909ED9B522B894DD87AACB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..(..4B..... .........................................j......[j...`..........................................cN.d...$1O.......i......._.xI....i../... i.([....2.T.....................H.(...p.2.@............ (..............................text.....(.......(................. ..`.rdata...6'.. (..8'...(.............@..@.data....I...`O......HO.............@....pdata..xI...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc..([... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.556986708902353
Encrypted:	false
SSDEEP:	384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
MD5:	7C14C7BC02E47D5C8158383CB7E14124
SHA1:	5EE9E5968E7B5CE9E4C53A303DAC9FC8FAF98DF3
SHA-256:	00BD8BB6DEC8C291EC14C8DDFB2209D85F96DB02C7A3C39903803384FF3A65E5
SHA-512:	AF70CBDD882B923013CB47545633B1147CE45C547B8202D7555043CFA77C1DEEE8A51A2BC5F93DB4E3B9CBF7818F625CA8E3B367BFFC534E26D35F475351A77C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.....2.......................................................o....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.4620027688967845
Encrypted:	false
SSDEEP:	12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
MD5:	A8ED52A66731E78B89D3C6C6889C485D
SHA1:	781E5275695ACE4A5C3AD4F2874B5E375B521638
SHA-256:	BF669344D1B1C607D10304BE47D2A2FB572E043109181E2C5C1038485AF0C3D7
SHA-512:	1C131911F120A4287EBF596C52DE047309E3BE6D99BC18555BD309A27E057CC895A018376AA134DF1DC13569F47C97C1A6E8872ACEDFA06930BBF2B175AF9017
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.@..........0.......................................p.......)....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6174208
Entropy (8bit):	7.990978110457585
Encrypted:	true
SSDEEP:	98304:copJ0ndCADji3dh8iemrdbYOssb5+7wFADy/+sXBuVoDtnOPyz70fhhQAHHDRWfU:cc0cWjigIbCs+ZivuVoDFOKn0fPyqEvo
MD5:	D68F79C459EE4AE03B76FA5BA151A41F
SHA1:	BFA641085D59D58993BA98AC9EE376F898EE5F7B
SHA-256:	AA50C900E210ABB6BE7D2420D9D5AE34C66818E0491AABD141421D175211FED6
SHA-512:	BD4EF3E3708DF81D53B2E9050447032E8DCDCC776CF0353077310F208A30DAB8F31D6EC6769D47FB6C05C642BDD7A58FB4F93D9D28E2DE0EFC01312FBC5E391E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........jO..jO..jO..!7..lO..!7...O..!7..`O..jO..kO..l...hO..l...BO..l...zO..l...{O..!7..oO..jO...O......kO......kO..RichjO..................PE..d...O.Xg.........."....&.....,\................@..............................`...........`.....................................................<....p..X/[..@..T.............`.....`............................... ...@............ ...............................text...P........................... ..`.rdata....... ......................@..@.data...pN..........................@....pdata..T....@......................@..@_RDATA.......`......................@..@.rsrc...X/[..p...0[.................@..@.reloc........`.......^.............@..B................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.990978110457585
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	l4.exe
File size:	6'174'208 bytes
MD5:	d68f79c459ee4ae03b76fa5ba151a41f
SHA1:	bfa641085d59d58993ba98ac9ee376f898ee5f7b
SHA256:	aa50c900e210abb6be7d2420d9d5ae34c66818e0491aabd141421d175211fed6
SHA512:	bd4ef3e3708df81d53b2e9050447032e8dcdcc776cf0353077310f208a30dab8f31d6ec6769d47fb6c05c642bdd7a58fb4f93d9d28e2de0efc01312fbc5e391e
SSDEEP:	98304:copJ0ndCADji3dh8iemrdbYOssb5+7wFADy/+sXBuVoDtnOPyz70fhhQAHHDRWfU:cc0cWjigIbCs+ZivuVoDFOKn0fPyqEvo
TLSH:	8E56335AF26140FCE71B62B49CAA0363F9B7785913019BDF52707A669F337C11A2A331
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........jO..jO..jO..!7..lO..!7...O..!7..`O..jO..kO..l...hO..l...BO..l...zO..l...{O..!7..oO..jO...O......kO......kO..RichjO.........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14000be9c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6758824F [Tue Dec 10 18:02:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8e3dad4d4ea6736338bcc4aca7b446c9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6074D777B0h
dec eax
add esp, 28h
jmp 00007F6074D773D7h
int3
int3
dec eax
sub esp, 28h
call 00007F6074D77CF0h
test eax, eax
je 00007F6074D77583h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F6074D77567h
dec eax
cmp ecx, eax
je 00007F6074D77576h
xor eax, eax
dec eax
cmpxchg dword ptr [0002419Ch], ecx
jne 00007F6074D77550h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F6074D77559h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F6074D77569h
mov byte ptr [00024185h], 00000001h
call 00007F6074D77AFDh
call 00007F6074D77F40h
test al, al
jne 00007F6074D77566h
xor al, al
jmp 00007F6074D77576h
call 00007F6074D7FE1Bh
test al, al
jne 00007F6074D7756Bh
xor ecx, ecx
call 00007F6074D77F50h
jmp 00007F6074D7754Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0002414Ch], 00000000h
mov ebx, ecx
jne 00007F6074D775C9h
cmp ecx, 01h
jnbe 00007F6074D775CCh
call 00007F6074D77C66h
test eax, eax
je 00007F6074D7758Ah
test ebx, ebx
jne 00007F6074D77586h
dec eax
lea ecx, dword ptr [00024136h]
call 00007F6074D7FC3Ah
test eax, eax
jne 00007F6074D77572h
dec eax
lea ecx, dword ptr [0002413Eh]
call 00007F6074D7762Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e0fc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x5b2f58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x54000	0x1854	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60a000	0x688	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2bf60	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2be20	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x2e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20450	0x20600	d5881c799223a7c43227753af4dfb945	False	0.5567084942084942	data	6.520018060774394	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0xcab0	0xcc00	0e51738cb3a1352b016ad756319571fc	False	0.47909007352941174	PGP symmetric key encrypted data - Plaintext or unencrypted data	5.144088628907143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x24e70	0xc00	6d8f02b8aab3664e63abe84f259bc1c7	False	0.13802083333333334	data	1.9439948621662484	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x54000	0x1854	0x1a00	2939e1273090608fed331aea22bcb0fd	False	0.45703125	PEX Binary Archive	5.057262605805601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x56000	0x1f4	0x200	3bbe165281ec2be875b71c5ef5761cf3	False	0.525390625	data	3.671095801963117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x57000	0x5b2f58	0x5b3000	d805cd73a079d91d788f02c118c10a48	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60a000	0x688	0x800	fd808e45828696952605c6bce78bb2f4	False	0.5126953125	data	4.934942496146745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x570a0	0x5b2ac0	data			0.9976177215576172
RT_MANIFEST	0x609b60	0x3f8	ASCII text, with very long lines (1016), with no line terminators			0.4655511811023622

Imports

DLL

Import

SHELL32.dll

SHFileOperationW, SHGetFolderPathW, CommandLineToArgvW

KERNEL32.dll

SetLastError, WriteConsoleW, HeapReAlloc, CreateDirectoryW, SizeofResource, SetConsoleCtrlHandler, GetCommandLineW, GetStdHandle, WriteFile, TerminateProcess, GetModuleFileNameW, SetEnvironmentVariableW, GetTempPathW, FindResourceA, WaitForSingleObject, CreateFileW, GetFileAttributesW, Sleep, GetLastError, LockResource, CloseHandle, LoadResource, GetProcAddress, GetCurrentProcessId, CreateProcessW, WideCharToMultiByte, GetSystemTimeAsFileTime, FormatMessageA, GetExitCodeProcess, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RtlUnwindEx, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, EncodePointer, RaiseException, RtlPcToFileHeader, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapAlloc, MultiByteToWideChar, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:16:51.672221899 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:51.791986942 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:51.792228937 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:51.792483091 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:51.912645102 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:52.949664116 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:52.996274948 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:53.194237947 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:53.246397018 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:54.032933950 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:54.074923038 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:54.223797083 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:54.278122902 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:54.950719118 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:55.070492983 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:55.344978094 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:55.387985945 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:55.954701900 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:56.074470997 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:59.769996881 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:16:59.770178080 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:16:59.889772892 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:05.236048937 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:05.236329079 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:05.355813980 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:05.474544048 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:05.594008923 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:05.594152927 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:05.594286919 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:05.714472055 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:06.752315998 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:06.797878981 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:06.985215902 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:07.032301903 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:07.835633039 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:07.881480932 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:08.026549101 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:08.069014072 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:08.757177114 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:08.876719952 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:09.148925066 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:09.194574118 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:09.758310080 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:09.877927065 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:10.153251886 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:10.153336048 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:10.153426886 CET	49738	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:10.272939920 CET	1336	49738	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:10.745728970 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:10.745929003 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:10.865438938 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:16.224775076 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:16.225146055 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:16.346191883 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:21.711512089 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:21.711874962 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:21.831535101 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:27.206455946 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:27.206664085 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:27.326353073 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:32.718496084 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:32.718821049 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:32.838556051 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:38.198170900 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:38.198643923 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:38.320244074 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:43.772552013 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:43.772769928 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:43.892374039 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:49.258513927 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:49.258766890 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:49.378454924 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:54.749619961 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:17:54.749880075 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:17:54.869647026 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:00.223273039 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:00.223470926 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:00.343194008 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:05.726129055 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:05.726313114 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:05.846010923 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:11.228756905 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:11.228979111 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:11.348622084 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:16.739295006 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:16.739556074 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:16.859100103 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:22.215440989 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:22.218697071 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:22.340392113 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:27.719666958 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:27.719898939 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:27.839534044 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:33.238096952 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:33.238344908 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:33.357974052 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:38.741867065 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:38.742122889 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:38.862051010 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:44.226605892 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:44.226835012 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:44.347466946 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:49.711858988 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:49.712069988 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:49.832752943 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:55.196633101 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:18:55.196847916 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:18:55.316471100 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:00.690519094 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:00.690864086 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:00.810383081 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:09.141727924 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:09.141932011 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:09.261632919 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:14.650578022 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:14.650760889 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:14.770251036 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:20.086085081 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:20.086296082 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:20.205874920 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:25.565502882 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:25.565860033 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:25.685421944 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:31.023541927 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:31.040535927 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:31.160294056 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:36.484811068 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:36.485816956 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:36.605432987 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:41.937901020 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:41.938232899 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:42.061851978 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:47.413461924 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:47.413774967 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:47.533518076 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:52.862473011 CET	1336	49736	194.59.30.220	192.168.2.4
Dec 18, 2024 12:19:52.862641096 CET	49736	1336	192.168.2.4	194.59.30.220
Dec 18, 2024 12:19:52.983546972 CET	1336	49736	194.59.30.220	192.168.2.4

Target ID:	0
Start time:	06:16:47
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\l4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\l4.exe"
Imagebase:	0x7ff6cba20000
File size:	6'174'208 bytes
MD5 hash:	D68F79C459EE4AE03B76FA5BA151A41F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:16:48
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:16:50
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\l4.exe
Imagebase:	0x7ff63d540000
File size:	6'162'432 bytes
MD5 hash:	63C4E3F9C7383D039AB4AF449372C17F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:17:02
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"
Imagebase:	0x7ff7e4370000
File size:	6'174'208 bytes
MD5 hash:	D68F79C459EE4AE03B76FA5BA151A41F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:17:02
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:17:04
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l4.exe"
Imagebase:	0x7ff747070000
File size:	6'162'432 bytes
MD5 hash:	63C4E3F9C7383D039AB4AF449372C17F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FF6CBA2C0F0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6CBA2C11C
GetCurrentThreadId.KERNEL32 ref: 00007FF6CBA2C12A
GetCurrentProcessId.KERNEL32 ref: 00007FF6CBA2C136
QueryPerformanceCounter.KERNEL32 ref: 00007FF6CBA2C146

Memory Dump Source

Source File: 00000000.00000002.3775552060.00007FF6CBA21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6CBA20000, based on PE: true

Associated: 00000000.00000002.3775525440.00007FF6CBA20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3775645372.00007FF6CBA42000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3775677365.00007FF6CBA4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3775677365.00007FF6CBA61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3775677365.00007FF6CBA6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3775771952.00007FF6CBA74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6cba20000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e5452eedf9582e092569b7414b2f17c91349fbc22d9af30a0b797327307e927a
Instruction ID: 867643fe84231fcb2597af532abe68339d5482b14dd33be42813efca33b4562f
Opcode Fuzzy Hash: e5452eedf9582e092569b7414b2f17c91349fbc22d9af30a0b797327307e927a
Instruction Fuzzy Hash: D8115E22B14F119AEB00CFA0E8442B833A4FB5D759F042E31EAAD837A4EF38D1548740

Analysis Process: l4.exePID: 6608, Parent PID: 6672COMMON

Executed Functions

Function 00007FFE133810C0 Relevance: 694.3, APIs: 203, Strings: 193, Instructions: 1313networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFE133810F8
Py_AtExit.PYTHON312 ref: 00007FFE1338110D
PyErr_NewException.PYTHON312 ref: 00007FFE13381133
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13381153
PyErr_NewException.PYTHON312 ref: 00007FFE13381175
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13381195
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE133811B7
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE133811D9
PyType_FromMetaclass.PYTHON312 ref: 00007FFE133811F6
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13381215
PyModule_AddType.PYTHON312 ref: 00007FFE13381229
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE13381248
PyMem_Malloc.PYTHON312 ref: 00007FFE1338125B
PyCapsule_New.PYTHON312 ref: 00007FFE133812BF
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE133812DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338130A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381328
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381346
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381364
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381382
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133813A0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133813BE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133813DC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133813FA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381418
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381436
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381454
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381472
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381490
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133814AE
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE133814CD
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE133814EC
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1338150B
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1338152A
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE13381549
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE13381568
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381586
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133815A4
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE133815C3
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE133815E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381600
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338161E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338163C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338165A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381678
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381696
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133816B4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133816D2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133816F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338170E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338172C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338174A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381786
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133817A4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133817C2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133817E0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133817FE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338181C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338183A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381858
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381876
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381894
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133818B2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133818D0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133818EE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338190C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338192A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381948
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381966
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381984
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133819A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133819C0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133819DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133819FC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381A1A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381A38
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381A53
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381A6E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381A8C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381AAA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381AC8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381AE6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B04
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B22
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B40
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B5E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B7C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381B9A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381BB8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381BD6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381BF4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381C12
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381C30
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381C4E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381C6C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381C8A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381CA8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381CC6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381CE4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D02
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D20
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D3E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D5C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D7A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381D98
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381DB6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381DD4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381DF2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381E10
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381E2E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381E49
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381E67
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381E85
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381EA3
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381EC1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381EDF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381EFD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381F1B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381F39
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381F57
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381F75
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381F93
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381FB1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381FCF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13381FED
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338200B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382029
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382047
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382065
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382083
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133820A1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133820BF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133820DD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133820FB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382119
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382137
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382155
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382173
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382191
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133821AF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133821CD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133821EB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382209
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382227
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382245
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382263
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382281
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338229F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133822BD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133822DB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133822F9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382317
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382335
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382353
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382371
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338238F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133823AD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133823CB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133823E9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382407
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382425
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382443
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382461
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338247F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338249D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133824BB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133824D9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133824F7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382515
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382533
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382551
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338256F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338258D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133825AB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133825C9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE133825E7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382605
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382623
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338263E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338265C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338267A
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE133826D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE133826F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338272C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1338274A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13382786
PyModule_GetDict.PYTHON312 ref: 00007FFE13382797
memset.VCRUNTIME140 ref: 00007FFE133827B6
VerSetConditionMask.KERNEL32 ref: 00007FFE133827D6
VerSetConditionMask.KERNEL32 ref: 00007FFE133827E7
VerSetConditionMask.KERNEL32 ref: 00007FFE133827F8
VerifyVersionInfoA.KERNEL32 ref: 00007FFE1338281F
PyUnicode_FromString.PYTHON312 ref: 00007FFE1338283B
_PyDict_Pop.PYTHON312 ref: 00007FFE13382856
_Py_Dealloc.PYTHON312 ref: 00007FFE1338286D
PyErr_Format.PYTHON312 ref: 00007FFE133839DC
PyErr_NoMemory.PYTHON312 ref: 00007FFE13383A0E
_Py_Dealloc.PYTHON312 ref: 00007FFE13383A48

Strings

HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFE13381486
SO_ERROR, xrefs: 00007FFE1338186C
IPV6_HOPOPTS, xrefs: 00007FFE1338221D
IPPROTO_IGMP, xrefs: 00007FFE13381AA0
SO_SNDLOWAT, xrefs: 00007FFE133817F4
HV_GUID_PARENT, xrefs: 00007FFE13381561
SO_USELOOPBACK, xrefs: 00007FFE1338175E
IP_MULTICAST_IF, xrefs: 00007FFE13381FC5
IPPROTO_ICLFXBM, xrefs: 00007FFE13381D16
IPV6_V6ONLY, xrefs: 00007FFE133821A5
IPPROTO_ND, xrefs: 00007FFE13381BAE
timeout, xrefs: 00007FFE133811CC
IPPROTO_FRAGMENT, xrefs: 00007FFE13381BEA
SO_DONTROUTE, xrefs: 00007FFE13381722
HV_GUID_CHILDREN, xrefs: 00007FFE13381523
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFE13381468
EAI_BADFLAGS, xrefs: 00007FFE133823A3
EAI_AGAIN, xrefs: 00007FFE13382385
EAI_FAMILY, xrefs: 00007FFE133823DF
SIO_RCVALL, xrefs: 00007FFE13382688
IPPROTO_IDP, xrefs: 00007FFE13381B90
TCP_KEEPIDLE, xrefs: 00007FFE1338230D
IPPORT_USERRESERVED, xrefs: 00007FFE13381E24
SOMAXCONN, xrefs: 00007FFE133818A8
MSG_BCAST, xrefs: 00007FFE13381998
CAPI, xrefs: 00007FFE133812D4
00:00:00:FF:FF:FF, xrefs: 00007FFE133815D1
00:00:00:00:00:00, xrefs: 00007FFE133815B2
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFE13381EB7
IPV6_RTHDR, xrefs: 00007FFE13382295
IPPROTO_AH, xrefs: 00007FFE13381C26
TCP_KEEPINTVL, xrefs: 00007FFE1338232B
RCVALL_MAX, xrefs: 00007FFE1338277C
IPPROTO_PIM, xrefs: 00007FFE13381C9E
NI_NUMERICHOST, xrefs: 00007FFE133825BF
MSG_DONTROUTE, xrefs: 00007FFE13381902
IP_TOS, xrefs: 00007FFE13381F4D
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFE133816E6
HV_PROTOCOL_RAW, xrefs: 00007FFE1338142C
IP_OPTIONS, xrefs: 00007FFE13381F11
SO_REUSEADDR, xrefs: 00007FFE133816C8
IPPROTO_MAX, xrefs: 00007FFE13381CF8
IPPROTO_ST, xrefs: 00007FFE13381D34
AF_HYPERV, xrefs: 00007FFE1338140E
TCP_KEEPCNT, xrefs: 00007FFE13382349
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFE133814FA
IPV6_DONTFRAG, xrefs: 00007FFE133821E1
SO_BROADCAST, xrefs: 00007FFE13381740
IPPROTO_IPV4, xrefs: 00007FFE13381ADC
error, xrefs: 00007FFE133811AA
MSG_PEEK, xrefs: 00007FFE133818E4
IPPROTO_RAW, xrefs: 00007FFE13381CDA
IPPROTO_ESP, xrefs: 00007FFE13381C08
IPV6_UNICAST_HOPS, xrefs: 00007FFE13382187
SOCK_SEQPACKET, xrefs: 00007FFE13381650
IPPROTO_PGM, xrefs: 00007FFE13381DAC
AF_INET, xrefs: 00007FFE1338131E
IP_UNBLOCK_SOURCE, xrefs: 00007FFE13382079
IP_MULTICAST_TTL, xrefs: 00007FFE13381FE3
AI_CANONNAME, xrefs: 00007FFE133824B1
HV_GUID_LOOPBACK, xrefs: 00007FFE13381542
SO_RCVLOWAT, xrefs: 00007FFE13381812
IP_HDRINCL, xrefs: 00007FFE13381F2F
INADDR_NONE, xrefs: 00007FFE13381EF3
IPPROTO_TCP, xrefs: 00007FFE13381B18
HV_GUID_BROADCAST, xrefs: 00007FFE13381504
IPPROTO_DSTOPTS, xrefs: 00007FFE13381C80
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFE13381557
SHUT_WR, xrefs: 00007FFE13382652
SOL_SOCKET, xrefs: 00007FFE133819D4
IPPROTO_IP, xrefs: 00007FFE13381A49
SOCK_STREAM, xrefs: 00007FFE133815F6
SO_KEEPALIVE, xrefs: 00007FFE13381704
WSAStartup failed: network not ready, xrefs: 00007FFE133839E8
IPPROTO_ROUTING, xrefs: 00007FFE13381BCC
AF_DECnet, xrefs: 00007FFE13381396
IP_BLOCK_SOURCE, xrefs: 00007FFE13382097
SO_RCVBUF, xrefs: 00007FFE133817D6
SOL_UDP, xrefs: 00007FFE13381A2E
RCVALL_OFF, xrefs: 00007FFE13382722
MSG_TRUNC, xrefs: 00007FFE13381920
SIO_KEEPALIVE_VALS, xrefs: 00007FFE133826A1
IP_ADD_MEMBERSHIP, xrefs: 00007FFE1338201F
TCP_MAXSEG, xrefs: 00007FFE133822EF
AF_BLUETOOTH, xrefs: 00007FFE1338157C
SocketType, xrefs: 00007FFE1338120B
TCP_FASTOPEN, xrefs: 00007FFE13382367
IPPROTO_RDP, xrefs: 00007FFE13381D8E
IPPROTO_ICMP, xrefs: 00007FFE13381A82
EAI_SERVICE, xrefs: 00007FFE13382457
SO_TYPE, xrefs: 00007FFE1338188A
AI_ADDRCONFIG, xrefs: 00007FFE13382529
INADDR_UNSPEC_GROUP, xrefs: 00007FFE13381E99
IPV6_LEAVE_GROUP, xrefs: 00007FFE1338210F
AF_IRDA, xrefs: 00007FFE133813F0
IPV6_RECVTCLASS, xrefs: 00007FFE13382277
IPPORT_RESERVED, xrefs: 00007FFE13381E06
socket.gaierror, xrefs: 00007FFE13381168
EAI_MEMORY, xrefs: 00007FFE133823FD
IPPROTO_SCTP, xrefs: 00007FFE13381CBC, 00007FFE13381DE8
IP_DROP_MEMBERSHIP, xrefs: 00007FFE1338203D
MSG_OOB, xrefs: 00007FFE133818C6
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFE133814A4
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFE133820D3
MSG_CTRUNC, xrefs: 00007FFE1338193E
MSG_WAITALL, xrefs: 00007FFE1338195C
gaierror, xrefs: 00007FFE1338118B
SHUT_RD, xrefs: 00007FFE13382634
AI_V4MAPPED, xrefs: 00007FFE13382547
EAI_FAIL, xrefs: 00007FFE133823C1
INADDR_BROADCAST, xrefs: 00007FFE13381E5D
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFE13381538
NI_NAMEREQD, xrefs: 00007FFE133825DD
BTPROTO_RFCOMM, xrefs: 00007FFE1338159A
AI_NUMERICSERV, xrefs: 00007FFE133824ED
IPPROTO_GGP, xrefs: 00007FFE13381ABE
IPPROTO_UDP, xrefs: 00007FFE13381B72
IPV6_CHECKSUM, xrefs: 00007FFE133821C3
IPPROTO_IPV6, xrefs: 00007FFE13381AFA
SOCK_RDM, xrefs: 00007FFE1338166E
RCVALL_ON, xrefs: 00007FFE13382740
TCP_NODELAY, xrefs: 00007FFE133822D1
NI_NUMERICSERV, xrefs: 00007FFE133825FB
HV_GUID_WILDCARD, xrefs: 00007FFE133814E5
INADDR_ANY, xrefs: 00007FFE13381E3F
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFE13381ED5
IP_RECVTOS, xrefs: 00007FFE13381F89
IP_PKTINFO, xrefs: 00007FFE1338205B
SOL_IP, xrefs: 00007FFE133819F2
SO_LINGER, xrefs: 00007FFE1338177C
AF_INET6, xrefs: 00007FFE13381378
IPPROTO_L2TP, xrefs: 00007FFE13381DCA
AF_IPX, xrefs: 00007FFE1338133C
AI_NUMERICHOST, xrefs: 00007FFE133824CF
SOL_TCP, xrefs: 00007FFE13381A10
SO_SNDBUF, xrefs: 00007FFE133817B8
INADDR_LOOPBACK, xrefs: 00007FFE13381E7B
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFE13381519
BDADDR_ANY, xrefs: 00007FFE133815BC
has_ipv6, xrefs: 00007FFE1338123E
IPV6_TCLASS, xrefs: 00007FFE133822B3
AI_PASSIVE, xrefs: 00007FFE13382493
SO_DEBUG, xrefs: 00007FFE1338168C
AI_ALL, xrefs: 00007FFE1338250B
AF_LINK, xrefs: 00007FFE133813B4
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFE1338275E
SOCK_DGRAM, xrefs: 00007FFE13381614
IP_MULTICAST_LOOP, xrefs: 00007FFE13382001
IPPROTO_IGP, xrefs: 00007FFE13381D70
IPPROTO_NONE, xrefs: 00007FFE13381C62
IPPROTO_HOPOPTS, xrefs: 00007FFE13381A64
MSG_MCAST, xrefs: 00007FFE133819B6
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFE133826BA
IPPROTO_PUP, xrefs: 00007FFE13381B54
NI_DGRAM, xrefs: 00007FFE13382619
EAI_NONAME, xrefs: 00007FFE13382439
AF_APPLETALK, xrefs: 00007FFE1338135A
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFE1338144A
SO_ACCEPTCONN, xrefs: 00007FFE133816AA
EAI_NODATA, xrefs: 00007FFE1338241B
SO_SNDTIMEO, xrefs: 00007FFE13381830
IPV6_RECVRTHDR, xrefs: 00007FFE13382259
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFE133820B5
AF_UNSPEC, xrefs: 00007FFE13381300
00000000-0000-0000-0000-000000000000, xrefs: 00007FFE133814BC, 00007FFE133814DB
IP_RECVDSTADDR, xrefs: 00007FFE13381FA7
IPV6_JOIN_GROUP, xrefs: 00007FFE133820F1
SOCK_RAW, xrefs: 00007FFE13381632
BDADDR_LOCAL, xrefs: 00007FFE133815DB
NI_MAXSERV, xrefs: 00007FFE13382583
AF_SNA, xrefs: 00007FFE133813D2
herror, xrefs: 00007FFE13381149
NI_NOFQDN, xrefs: 00007FFE133825A1
MSG_ERRQUEUE, xrefs: 00007FFE1338197A
SO_OOBINLINE, xrefs: 00007FFE1338179A
WSAStartup failed: error code %d, xrefs: 00007FFE133839CF
socket.herror, xrefs: 00007FFE13381117
NI_MAXHOST, xrefs: 00007FFE13382565
HV_GUID_ZERO, xrefs: 00007FFE133814C6
SHUT_RDWR, xrefs: 00007FFE13382670
IPV6_MULTICAST_LOOP, xrefs: 00007FFE13382169
IPPROTO_ICMPV6, xrefs: 00007FFE13381C44
IPV6_PKTINFO, xrefs: 00007FFE1338223B
IPPROTO_EGP, xrefs: 00007FFE13381B36
EAI_SOCKTYPE, xrefs: 00007FFE13382475
IPPROTO_CBT, xrefs: 00007FFE13381D52
_socket.CAPI, xrefs: 00007FFE133812B8
IP_TTL, xrefs: 00007FFE13381F6B
IPV6_HOPLIMIT, xrefs: 00007FFE133821FF
IPV6_MULTICAST_IF, xrefs: 00007FFE1338214B
WSAStartup failed: requested version not supported, xrefs: 00007FFE133839F1
SO_RCVTIMEO, xrefs: 00007FFE1338184E
IPV6_MULTICAST_HOPS, xrefs: 00007FFE1338212D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Module_$Constant$String$Object$Err_$ConditionFromMask$DeallocException$Capsule_DictDict_ExitFormatInfoLongLong_MallocMem_MemoryMetaclassStartupTypeType_Unicode_UnsignedVerifyVersionmemset
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 1196102948-1188461360
Opcode ID: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction ID: 7c242d5149c34758ba6680376f24d2334e20d1b52a678b3ab8ebd234e91332be
Opcode Fuzzy Hash: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction Fuzzy Hash: C5D2CB60F08E135AFB108B27AC5026816547F65BE1F8056F9C93FA6E74EF6DE285C348

Function 00007FFE133862B4 Relevance: 1.5, APIs: 1, Instructions: 19
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FFE133862E3

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction ID: ed37d0bd6d4ad7d2ad93581b080bdc0e5da90ff5991ca2953f2217c4ecbd76ea
Opcode Fuzzy Hash: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction Fuzzy Hash: D8E04FF2A10A4982D7145B56E0402687360F719FB4F245761CA3C1B7E0DE38D4E1C740

Function 00007FFE13385AFC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE13385B40
PySys_Audit.PYTHON312 ref: 00007FFE13385B78
PyErr_Format.PYTHON312 ref: 00007FFE13385BD0
PySys_Audit.PYTHON312 ref: 00007FFE13385CCE
PyEval_SaveThread.PYTHON312 ref: 00007FFE13385CDC
WSASocketW.WS2_32 ref: 00007FFE13385D08
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385D14
SetHandleInformation.KERNEL32 ref: 00007FFE13385D32
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13385D3E
closesocket.WS2_32 ref: 00007FFE13385D47
PyLong_AsLongLong.PYTHON312 ref: 00007FFE13385D71
PyErr_Occurred.PYTHON312 ref: 00007FFE13385D80
PyErr_SetString.PYTHON312 ref: 00007FFE13385DA0
memset.VCRUNTIME140 ref: 00007FFE13385DC0
getsockname.WS2_32 ref: 00007FFE13385DD2
WSAGetLastError.WS2_32 ref: 00007FFE13385DF1
getsockopt.WS2_32 ref: 00007FFE13385E2E
PyEval_SaveThread.PYTHON312 ref: 00007FFE13385E6F
WSASocketW.WS2_32 ref: 00007FFE13385E90
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385E9C

Strings

Oiii, xrefs: 00007FFE13385B5F, 00007FFE13385CA9
socket.__new__, xrefs: 00007FFE13385B71, 00007FFE13385C69
negative file descriptor, xrefs: 00007FFE13385D96
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFE13385BC0

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 3363282672-2881308447
Opcode ID: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction ID: 3bf32595cf3be18fe177f490ea6c67b0aba13e4fb4b3570e4e9d6e801dfb3c2c
Opcode Fuzzy Hash: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction Fuzzy Hash: D1B15362A08E8586F6108F2AD4042BD6360FBA5BB4F1453B5DE6D63AF5DF3CE5C48704

Function 00007FFE13385190 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyDeadline_Get.PYTHON312 ref: 00007FFE133851E4
_PyDeadline_Init.PYTHON312 ref: 00007FFE1338520C
WSAGetLastError.WS2_32 ref: 00007FFE13385237
WSAGetLastError.WS2_32 ref: 00007FFE1338523F
PyErr_CheckSignals.PYTHON312 ref: 00007FFE13385250
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338527B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385295
WSAGetLastError.WS2_32 ref: 00007FFE133852A4
WSAGetLastError.WS2_32 ref: 00007FFE133852AC
PyErr_CheckSignals.PYTHON312 ref: 00007FFE133852B9

Part of subcall function 00007FFE13384594: _PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE133845E9
Part of subcall function 00007FFE13384594: PyEval_SaveThread.PYTHON312 ref: 00007FFE13384628
Part of subcall function 00007FFE13384594: select.WS2_32 ref: 00007FFE1338465C
Part of subcall function 00007FFE13384594: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13384667

WSAGetLastError.WS2_32 ref: 00007FFE133852CC
WSAGetLastError.WS2_32 ref: 00007FFE133852E1
PyErr_SetString.PYTHON312 ref: 00007FFE1338531D

Strings

timed out, xrefs: 00007FFE13385313

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
String ID: timed out
API String ID: 497267021-3163636755
Opcode ID: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction ID: 48cb3709f351d9dfd4edb89643f6b09cad85ea6c693fbe93d0354d5237c8858f
Opcode Fuzzy Hash: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction Fuzzy Hash: 71414B21E09E42CEFA615B67A44437D6290AF64B75F1443F0CD6E62EF8DF7CA8C58608

Function 00007FFE13386C9C Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386CCC
setsockopt.WS2_32 ref: 00007FFE13386CF6
PyErr_Clear.PYTHON312 ref: 00007FFE13386D03
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386D47
PyErr_Clear.PYTHON312 ref: 00007FFE13386D5E
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386D88
PyBuffer_Release.PYTHON312 ref: 00007FFE13386DA4
PyErr_Format.PYTHON312 ref: 00007FFE13386DC1
setsockopt.WS2_32 ref: 00007FFE13386DE7
PyBuffer_Release.PYTHON312 ref: 00007FFE13386DF4

Strings

iiO!I:setsockopt, xrefs: 00007FFE13386D20
iiy*:setsockopt, xrefs: 00007FFE13386D81
iii:setsockopt, xrefs: 00007FFE13386CC5
socket option is larger than %i bytes, xrefs: 00007FFE13386DB1

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction ID: 291bac0d470fd77d1fdc1625816bf06f360a707bd18431fb0775cf4b84713b98
Opcode Fuzzy Hash: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction Fuzzy Hash: 7541CC31608E869AEB208F16E4446AD7360FB98BA4F5002B1DA6D53B74DF7CD589C748

Function 00007FFE13384484 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE133844A2
connect.WS2_32 ref: 00007FFE133844B5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE133844C0
WSAGetLastError.WS2_32 ref: 00007FFE133844CE
WSAGetLastError.WS2_32 ref: 00007FFE133844DA
PyErr_CheckSignals.PYTHON312 ref: 00007FFE133844E7
WSASetLastError.WS2_32 ref: 00007FFE13384501

Strings

3', xrefs: 00007FFE1338451A

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
String ID: 3'
API String ID: 4284410693-280543908
Opcode ID: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction ID: 38b870e79be53713e39a28f7d37d99c95035d1f2d1070e6497b928704db0a7ce
Opcode Fuzzy Hash: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction Fuzzy Hash: 2B310121B09F428AE7605F67A54457D6690AF64BA4F0403F9EA6E73FB5DF3CE4C08608

Function 00007FFE13386198 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE133861C0
PyErr_SetString.PYTHON312 ref: 00007FFE133861E5
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133861F5
_Py_Dealloc.PYTHON312 ref: 00007FFE13386230
_PyBytes_Resize.PYTHON312 ref: 00007FFE13386247

Strings

n|i:recv, xrefs: 00007FFE133861B9
negative buffersize in recv, xrefs: 00007FFE133861DB

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Bytes_SizeString$Arg_DeallocErr_FromParseResizeTuple_
String ID: negative buffersize in recv$n|i:recv
API String ID: 1342606314-3647384195
Opcode ID: 29fb8dffb30c6af5d72d23fc4fc4b8e2e26d01538630a85b1ae85e9e50577ef5
Instruction ID: 8fbc1f0cec45afd6f3e7fe18afbe4573494669f23eec432afb1bcafca86b5e0f
Opcode Fuzzy Hash: 29fb8dffb30c6af5d72d23fc4fc4b8e2e26d01538630a85b1ae85e9e50577ef5
Instruction Fuzzy Hash: E0115E71B08E428AEE118B66E44417DA361FFA4BB4F4002F2DA9D66BB5DF7CE184D704

Function 00007FFE1338599C Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE13385A2C
_PyLong_AsInt.PYTHON312 ref: 00007FFE13385A4B
PyErr_Occurred.PYTHON312 ref: 00007FFE13385A58
_PyLong_AsInt.PYTHON312 ref: 00007FFE13385A72
PyErr_Occurred.PYTHON312 ref: 00007FFE13385A7F
_PyLong_AsInt.PYTHON312 ref: 00007FFE13385A99
PyErr_Occurred.PYTHON312 ref: 00007FFE13385AA7

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction ID: 289951218b588f809d02b93e6d2ad28f5bd3746ec9a0c47f2863025c6d2c65f3
Opcode Fuzzy Hash: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction Fuzzy Hash: DD417461A19E418AFE529B23A4843BC2290BF24BB4F1447B5DD6E63FE4DF3CE4C58244

Function 00007FFE133867E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338680B

Part of subcall function 00007FFE13385190: WSAGetLastError.WS2_32 ref: 00007FFE13385237
Part of subcall function 00007FFE13385190: WSAGetLastError.WS2_32 ref: 00007FFE1338523F
Part of subcall function 00007FFE13385190: PyErr_CheckSignals.PYTHON312 ref: 00007FFE13385250

PyBuffer_Release.PYTHON312 ref: 00007FFE13386870
PyBuffer_Release.PYTHON312 ref: 00007FFE1338687A
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE13386885

Strings

y*|i:send, xrefs: 00007FFE13386804

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_ErrorLastRelease$Arg_CheckErr_FromLong_ParseSignalsSizeSsize_tTuple_
String ID: y*|i:send
API String ID: 3302300731-3140140677
Opcode ID: 95aff07904a5713212a361be42d32b99a9b670a8c5ed14225624f7d16d8b4274
Instruction ID: ad35c5fca2bf9e547c16f89abaf54bc35e7c767185dea367f4e49a85fdf4d8ea
Opcode Fuzzy Hash: 95aff07904a5713212a361be42d32b99a9b670a8c5ed14225624f7d16d8b4274
Instruction Fuzzy Hash: 3E114C71608F458AE710CF66E4443AE73A0FB98BA4F5002B2DA9D93B64DF3DD584CB54

Function 00007FFE133853A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE13383DD0: PyErr_Format.PYTHON312 ref: 00007FFE13384154

PySys_Audit.PYTHON312 ref: 00007FFE133853FC

Part of subcall function 00007FFE13384484: PyEval_SaveThread.PYTHON312 ref: 00007FFE133844A2
Part of subcall function 00007FFE13384484: connect.WS2_32 ref: 00007FFE133844B5
Part of subcall function 00007FFE13384484: PyEval_RestoreThread.PYTHON312 ref: 00007FFE133844C0
Part of subcall function 00007FFE13384484: WSAGetLastError.WS2_32 ref: 00007FFE133844CE
Part of subcall function 00007FFE13384484: WSAGetLastError.WS2_32 ref: 00007FFE133844DA
Part of subcall function 00007FFE13384484: PyErr_CheckSignals.PYTHON312 ref: 00007FFE133844E7
Part of subcall function 00007FFE13384484: WSASetLastError.WS2_32 ref: 00007FFE13384501

Strings

socket.connect, xrefs: 00007FFE133853F5
connect, xrefs: 00007FFE133853C3

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction ID: 19f6647489cee3043191d1df0bdc88b2053e1fe86a5c55d746ef3bf01281220c
Opcode Fuzzy Hash: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction Fuzzy Hash: 81113C21708E82C9F7209B23F4407AA6360BF647A4F4012B2DA6D67F69DE2DE185C704

Function 00007FFE13386894 Relevance: 1.5, APIs: 1, Instructions: 19
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 00007FFE133868C3

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction ID: 0e24fcf9ddc0637d839c5c3a9703ff150ee0b936d50e69c30d76812901407daa
Opcode Fuzzy Hash: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction Fuzzy Hash: 39E04FF2E14A4586DB145B56E0442687360F719FB4F645765CA3C1B7E0DE38D5E1C740

Non-executed Functions

Function 00007FFE14637CA0 Relevance: 85.0, APIs: 33, Strings: 15, Instructions: 1002COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE14637D43
DName::operator+.LIBVCRUNTIME ref: 00007FFE14637DFE
DName::operator+.LIBVCRUNTIME ref: 00007FFE14637E6C
DName::operator+.LIBVCRUNTIME ref: 00007FFE14637E8D
DName::operator+.LIBVCRUNTIME ref: 00007FFE14637EE0
DName::operator+.LIBVCRUNTIME ref: 00007FFE14637F0E

Strings

}' , xrefs: 00007FFE14637EE5, 00007FFE14638611
private: , xrefs: 00007FFE1463816C
`vtordisp{, xrefs: 00007FFE14638587
`vtordispex{, xrefs: 00007FFE146384F3
protected: , xrefs: 00007FFE14638AD1
extern "C" , xrefs: 00007FFE14638BEC
`local static destructor helper', xrefs: 00007FFE14638964
static , xrefs: 00007FFE1463804E
`template static data member constructor helper', xrefs: 00007FFE146389A5
`adjustor{, xrefs: 00007FFE146385E6
virtual , xrefs: 00007FFE146380DB
public: , xrefs: 00007FFE14638AFE
[thunk]:, xrefs: 00007FFE14638B94
`template static data member destructor helper', xrefs: 00007FFE146389EB
/, xrefs: 00007FFE146389F2

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: /$[thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 2943138195-2884338863
Opcode ID: 56dc94c5f41340d16c6edc1287401ab50ded08e4b4e6c94f8377b7fc15cbe44a
Instruction ID: 4a9d08d47207fa2c23d52f0a3a30a32c7a3970db8a4d2be349f97dfe915778c3
Opcode Fuzzy Hash: 56dc94c5f41340d16c6edc1287401ab50ded08e4b4e6c94f8377b7fc15cbe44a
Instruction Fuzzy Hash: 8EA2A572A18FC686EB408B15E4C01EE77A0FB86368F545175EA8D43BA9DF7CD548CB80

Function 00007FFE13213DC0 Relevance: 36.9, APIs: 12, Strings: 8, Instructions: 1907COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE13213E35
memset.VCRUNTIME140 ref: 00007FFE13214025
memset.VCRUNTIME140 ref: 00007FFE13214049
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321BDB5

Strings

%d in block, %d after MTF & 1-2 coding, %d+2 syms in use, xrefs: 00007FFE1321BDC2
codes %d, xrefs: 00007FFE1321BF99
code lengths %d, , xrefs: 00007FFE1321BF5A
initial group %d, [%d .. %d], has %d syms (%4.1f%%), xrefs: 00007FFE1321BE1F
selectors %d, , xrefs: 00007FFE1321BF33
pass %d: size is %d, grp uses are , xrefs: 00007FFE1321BE87
bytes: mapping %d, , xrefs: 00007FFE1321BF0A
%d , xrefs: 00007FFE1321BEA9

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: memset$__acrt_iob_func
String ID: %d in block, %d after MTF & 1-2 coding, %d+2 syms in use$ bytes: mapping %d, $ initial group %d, [%d .. %d], has %d syms (%4.1f%%)$ pass %d: size is %d, grp uses are $%d $code lengths %d, $codes %d$selectors %d,
API String ID: 2663462942-2674272606
Opcode ID: fddf6da674a9559637942c02094f43c67222fa0e889a8864347ceb34b5a778ed
Instruction ID: 5101cc29640349fa47a8cec74a43e016f9240d937e63eaa18375a0bb4bad41f1
Opcode Fuzzy Hash: fddf6da674a9559637942c02094f43c67222fa0e889a8864347ceb34b5a778ed
Instruction Fuzzy Hash: 7E23D072A256E18ADB20CF2AD548BEC3774FB58B5CF010266DF4D177A6DB38A494CB10

Function 00007FFE13383B20 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 181networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FFE13383B4A

Part of subcall function 00007FFE13384B14: _Py_BuildValue_SizeT.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B2F
Part of subcall function 00007FFE13384B14: PyErr_SetObject.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B44
Part of subcall function 00007FFE13384B14: _Py_Dealloc.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B58

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13383B6E
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE13383B84

Strings

surrogatepass, xrefs: 00007FFE13383D2E
unsupported address family, xrefs: 00007FFE13383D62
NOO, xrefs: 00007FFE13383D43

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_$BuildDeallocErrnoErrorFromLastObjectSizeValue__errno
String ID: NOO$surrogatepass$unsupported address family
API String ID: 316901363-472101058
Opcode ID: b91f96f39c30ed59f8962875126381abc059683d57aa2602eb85b04b624b84c7
Instruction ID: 140329170c124b43353679f3d47e6fd336553e67c265832eb0be6fa0155d05e5
Opcode Fuzzy Hash: b91f96f39c30ed59f8962875126381abc059683d57aa2602eb85b04b624b84c7
Instruction Fuzzy Hash: 2B818125A09E4689EA518B26A44427D63A0FF65BB4F1443F5DA6E23FB4EF3CE4C5C304

Function 00007FFE13211000 Relevance: 19.9, APIs: 6, Strings: 5, Instructions: 669COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE132111A6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321B13D

Strings

%d work, %d block, ratio %5.2f, xrefs: 00007FFE1321B210
depth %6d has , xrefs: 00007FFE1321B166
%6d unresolved strings, xrefs: 00007FFE1321B18C
bucket sorting ..., xrefs: 00007FFE1321B146
reconstructing block ..., xrefs: 00007FFE1321B1B2

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_funcmemset
String ID: bucket sorting ...$ depth %6d has $ reconstructing block ...$ %d work, %d block, ratio %5.2f$%6d unresolved strings
API String ID: 3274466043-3557197531
Opcode ID: 3fcda9e2fd7ac071b7b70a866bceb4482f728b7e61e8db2759de8a03a3a667f4
Instruction ID: 0ce20c8a2d7f22ded53159b7c18a38121ef2cab71c6f48ac0ab7516b2b74dd32
Opcode Fuzzy Hash: 3fcda9e2fd7ac071b7b70a866bceb4482f728b7e61e8db2759de8a03a3a667f4
Instruction Fuzzy Hash: 2852BF73A35A448BDB05CF0DC984AAC33A4F7A9740F969239D70E9B396EB39E554C700

Function 00007FFE13216080 Relevance: 16.4, APIs: 4, Strings: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321BFB3
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321BFD7
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321BFFE

Strings

qsort [0x%x, 0x%x] done %d this %d, xrefs: 00007FFE1321C009
main sort initialise ..., xrefs: 00007FFE1321BFBC
VUUU, xrefs: 00007FFE132165A0
bucket sorting ..., xrefs: 00007FFE1321BFE0
%d pointers, %d sorted, %d scanned, xrefs: 00007FFE1321C086

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d pointers, %d sorted, %d scanned$ bucket sorting ...$ main sort initialise ...$ qsort [0x%x, 0x%x] done %d this %d$VUUU
API String ID: 711238415-771725242
Opcode ID: 6f13b787d251c16a07ca401ee5e08a3a53f96260666b07c687ed5de27d5da20e
Instruction ID: 1cca56cc4196a70a71de4e6b6bc48bffb795e209083194d7e60b303caee98e46
Opcode Fuzzy Hash: 6f13b787d251c16a07ca401ee5e08a3a53f96260666b07c687ed5de27d5da20e
Instruction Fuzzy Hash: E5527633A086D08ED315CF2AD118A7D7BB0FBA5B54F164276DB9A537A6CA3CE501CB10

Function 00007FFE132177F8 Relevance: 14.8, APIs: 2, Strings: 5, Instructions: 2584COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321C197

Strings

@, xrefs: 00007FFE132191EE
1, xrefs: 00007FFE13218884
2, xrefs: 00007FFE13219742
[%d: huff+mtf , xrefs: 00007FFE1321C1A0
rt+rld, xrefs: 00007FFE1321C39D

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: [%d: huff+mtf $1$2$@$rt+rld
API String ID: 711238415-2511902606
Opcode ID: 619850e11dacf86815c574bd646255232747cdcace6cf06140f5c0d03bc097ac
Instruction ID: 8468ca9b08904377aa9a613b2f5c572f66b80bda4bcc416650677bf3167bc85d
Opcode Fuzzy Hash: 619850e11dacf86815c574bd646255232747cdcace6cf06140f5c0d03bc097ac
Instruction Fuzzy Hash: 4343AD73618A91CFD7648F2AC1806AC7BB0F399B58F25817ADB4D573A9CB78D845CB00

Function 00007FFE13383328 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13383344
memset.VCRUNTIME140 ref: 00007FFE13383368
RtlCaptureContext.KERNEL32 ref: 00007FFE13383371
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1338338B
RtlVirtualUnwind.KERNEL32 ref: 00007FFE133833CC
memset.VCRUNTIME140 ref: 00007FFE133833FF
IsDebuggerPresent.KERNEL32 ref: 00007FFE13383420
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1338343D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13383448

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 5130b0c2a8b4ddc3ad2379c44f9e6e14e4431d38d65cb8e8484721bef110eafb
Instruction ID: c652f40464f122d3cf280a607c036529f15af9943fbe1878bbe878cbea045de5
Opcode Fuzzy Hash: 5130b0c2a8b4ddc3ad2379c44f9e6e14e4431d38d65cb8e8484721bef110eafb
Instruction Fuzzy Hash: 87316E76608F818AEB608F61E8403ED3360FB94764F4441BADA5E57BA8DF7CD188C704

Function 00007FFE126E3E60 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE126E3E7C
memset.VCRUNTIME140 ref: 00007FFE126E3EA0
RtlCaptureContext.KERNEL32 ref: 00007FFE126E3EA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE126E3EC3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE126E3F04
memset.VCRUNTIME140 ref: 00007FFE126E3F37
IsDebuggerPresent.KERNEL32 ref: 00007FFE126E3F58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE126E3F75
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE126E3F80

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction ID: 37a7617b5500c6be479a09a3081510fa77541e5cbe0a17ff9d2400eba6c13cc6
Opcode Fuzzy Hash: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction Fuzzy Hash: AB313972608F818AEB60DF61E8403FD7360FB84754F44413ADA4E57BA4DF78D6488710

Function 00007FFE148B1AA0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE148B1ABC
memset.VCRUNTIME140 ref: 00007FFE148B1AE0
RtlCaptureContext.KERNEL32 ref: 00007FFE148B1AE9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE148B1B03
RtlVirtualUnwind.KERNEL32 ref: 00007FFE148B1B44
memset.VCRUNTIME140 ref: 00007FFE148B1B77
IsDebuggerPresent.KERNEL32 ref: 00007FFE148B1B98
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE148B1BB5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE148B1BC0

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction ID: 629e92b17895fa98ff0bd6791920aa750763341b8a0506228db787f2261ac011
Opcode Fuzzy Hash: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction Fuzzy Hash: 2F313272609F8189EB609F61E8803ED7364FB85754F444479EA4E47BA4EF38D64DC710

Function 00007FFE1321AA7C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1321AA98
memset.VCRUNTIME140 ref: 00007FFE1321AABC
RtlCaptureContext.KERNEL32 ref: 00007FFE1321AAC5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1321AADF
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1321AB20
memset.VCRUNTIME140 ref: 00007FFE1321AB53
IsDebuggerPresent.KERNEL32 ref: 00007FFE1321AB74
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1321AB91
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1321AB9C

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction ID: d2acd8e0e28b0783016dbef0b8771efaa319279fcdb065de5301fb34e25a6cb6
Opcode Fuzzy Hash: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction Fuzzy Hash: 94315E72609F818AEB609F61E9403EE73A0FB94754F04447ADA4E67BA6DF3CD648C710

Function 00007FFE133850C0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47threadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13383DD0: PyErr_Format.PYTHON312 ref: 00007FFE13384154

PySys_Audit.PYTHON312 ref: 00007FFE13385118
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338512A
bind.WS2_32 ref: 00007FFE13385141
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1338514C

Strings

socket.bind, xrefs: 00007FFE13385111
bind, xrefs: 00007FFE133850DF

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$AuditErr_FormatRestoreSaveSys_bind
String ID: bind$socket.bind
API String ID: 1695574521-187351271
Opcode ID: c772f091d13961e78706c3e49babb2eae7ea45e540c7b9e2188f6b33e05915ab
Instruction ID: 4c825a27e090fdf9d33ac566fb1d753a6b830d09665cb18f32d1a53c19f81fbf
Opcode Fuzzy Hash: c772f091d13961e78706c3e49babb2eae7ea45e540c7b9e2188f6b33e05915ab
Instruction Fuzzy Hash: 6D11E225609F82C5EA209B52E4443AE7364FF64BA4F0402B1DA5D57F64DF2CD585C704

Function 00007FFE133860CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE133860EF
PyEval_SaveThread.PYTHON312 ref: 00007FFE13386107
listen.WS2_32 ref: 00007FFE13386122
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1338612D

Strings

|i:listen, xrefs: 00007FFE133860E8

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveSizeTuple_listen
String ID: |i:listen
API String ID: 3610171639-1087349693
Opcode ID: e8d47ebe0e10a6c5cc8300ffc03bcd4294c79b16c36a614c1882deaffce03895
Instruction ID: a4c79871277fb93f4cceecd8f1a9159875ba0d81fdf4530fb6c5eeb6dc30dbf1
Opcode Fuzzy Hash: e8d47ebe0e10a6c5cc8300ffc03bcd4294c79b16c36a614c1882deaffce03895
Instruction Fuzzy Hash: 2E012D21A18E4187EA448B17E88406E6371FFA4BA0F1442F1DB6E53F69DF3CE5958708

Function 00007FFE13212DC0 Relevance: 3.4, APIs: 2, Instructions: 371COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE13212F20

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5f9966c6679bf272717b46166595d2fc079e24c6c6c4c3c0b50c94340c7423a6
Instruction ID: 56574324a8b22103d79ee9561a4c69c47b64046e47ca1609a39f9044531085ed
Opcode Fuzzy Hash: 5f9966c6679bf272717b46166595d2fc079e24c6c6c4c3c0b50c94340c7423a6
Instruction Fuzzy Hash: 57F16872A14F818AD7229F2E95413B97320FBA5799F144335EB4873BA6DB3EE541C700

Function 00007FFE126D2F80 Relevance: 2.2, APIs: 1, Instructions: 929COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072305e070298a51cecf7c3dfedc14e7780c6f34b0edf022235a4c406b6013ef
Instruction ID: 031e295163441e4c49fd9ffd053d7d58c0a5a1cd9fda671fc9aa1d7d9f198c27
Opcode Fuzzy Hash: 072305e070298a51cecf7c3dfedc14e7780c6f34b0edf022235a4c406b6013ef
Instruction Fuzzy Hash: AB92D4B2A189DA8BE728CF16D444BBD77A1F784758F144139DA8A47794DBBCE4A0CF00

Function 00007FFE126D1A00 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ca22d0dbc449adbb87d0aa6a0a769a9cf856f7ab0432f1125b30fdcbd30f34
Instruction ID: c5ff3a4a947d26ab054a8b5a925a1e18a820cdff17d32e3fccf607ba22d8f961
Opcode Fuzzy Hash: 14ca22d0dbc449adbb87d0aa6a0a769a9cf856f7ab0432f1125b30fdcbd30f34
Instruction Fuzzy Hash: B842E572A18A9DCBE720CB16D8447AD77A0F784794F214175DA8A43BA4DFFDE891CB00

Function 00007FFE126D23B0 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136be1069941644f31c35eface127805653643002cb49cf4de681b5645ddfc60
Instruction ID: 510fa20977d30ff243d9164fdbb0614f0f26ba09d8f8bc8badbaf2d1e72d11af
Opcode Fuzzy Hash: 136be1069941644f31c35eface127805653643002cb49cf4de681b5645ddfc60
Instruction Fuzzy Hash: 7922B272A04A4987D718CF2AD8446AC37A0F758BA8F104235DF5E477E9DFB8E4A5C780

Function 00007FFE13213B20 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8d24cf098aadaf33039588b135da2843f570b6115a25eeafe42063b0bf3ebc
Instruction ID: 5b10e1e06901b57cc28838b055e93e42c7ed10d2712aafb9cc9e2b87522715fc
Opcode Fuzzy Hash: ed8d24cf098aadaf33039588b135da2843f570b6115a25eeafe42063b0bf3ebc
Instruction Fuzzy Hash: 96F11FB3A18AA68BD754DF06D18497D3BB9F7A4B54F128176DF0A63761CB38E801CB40

Function 00007FFE126D4650 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9064fa8def9f026256d4307e664ade0a86c3c60bc22c5b50eaaae86724981c5
Instruction ID: 4c3951df14f30cb4f4f363f2f7f62318d77899cfbda9b4f076801e3d656ef3be
Opcode Fuzzy Hash: d9064fa8def9f026256d4307e664ade0a86c3c60bc22c5b50eaaae86724981c5
Instruction Fuzzy Hash: 6C917BB6A24E4486DB09CF2DC4823AC3360F768B58F544236DB5E477A8DF79D9A1C780

Function 00007FFE126D73F8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e78c201ee0cfc2472355db5d9f72e5c9455fbf09f8a716b15a6a5636c83be8f
Instruction ID: 1e509a68a15b7aa92f4ffb3bdf95381d074bf7990b2f0b639692bdaf15824197
Opcode Fuzzy Hash: 7e78c201ee0cfc2472355db5d9f72e5c9455fbf09f8a716b15a6a5636c83be8f
Instruction Fuzzy Hash: 72616F36A08A5A87EB69CF2AD84077837A0FB54768F104175DA4E83BE4DFBCE851C741

Function 00007FFE126D12B0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33751e61f2b7b5fe1996d7a8c53cb228b6bf20b976da0d5b6149ed53632f6689
Instruction ID: 9bf9aa9c7ca613e8a89d008e6315a4729758cc15a4adad0e2aed862e14dd26de
Opcode Fuzzy Hash: 33751e61f2b7b5fe1996d7a8c53cb228b6bf20b976da0d5b6149ed53632f6689
Instruction Fuzzy Hash: 0C512573B10A958BD708CF19D8947A937A5F348358F444135FB9A93B80D7B9E862C740

Function 00007FFE126D55D0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d982d7e8518b31d5d4474f62551c79313faf909feeb906e74a03da9efe16c
Instruction ID: a931969a599dca0117cbeb0db1106153e0549d534522ab3368d9b19786893d06
Opcode Fuzzy Hash: 348d982d7e8518b31d5d4474f62551c79313faf909feeb906e74a03da9efe16c
Instruction Fuzzy Hash: EB41E473B14A9987E710CF1AF81076DBAA2F784B58F654031DB8A43FA5DA38E452CB00

Function 00007FFE126DFA88 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cab0718fb76dbd80151505856c6246546e40df07e307d1c7108c1a4205e22fe
Instruction ID: d65b87cc35f0156bb5a8a9d47d26a6192302261e1853a6a77dc34c4c057dbe16
Opcode Fuzzy Hash: 0cab0718fb76dbd80151505856c6246546e40df07e307d1c7108c1a4205e22fe
Instruction Fuzzy Hash: 5C314CA3B28A9943EF08CA12AC156B96A91F7547E4F090175DE4F47BE4CEBCE542C300

Function 00007FFE126D1920 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc13c40859c25b318db05a36badccf42958693ca925bfe9472852b065e0655c7
Instruction ID: dbe91594e190704ad70bc86fadbc547942620754ba3e293c70d6228b00b86ad6
Opcode Fuzzy Hash: fc13c40859c25b318db05a36badccf42958693ca925bfe9472852b065e0655c7
Instruction Fuzzy Hash: 232135B3F288A483FB18C716DC20BB82651FBD8398F54A175E68A83F94D9BCD501CB00

Function 00007FFE126D5F00 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b839b2501dd28b3a3b56fb3566757ce33f8decf06953666a60a87e30fd53947f
Instruction ID: 9b9b22d243d20c7383d4ca7503759219e92b32084c3e47f7ca66a45471497cd8
Opcode Fuzzy Hash: b839b2501dd28b3a3b56fb3566757ce33f8decf06953666a60a87e30fd53947f
Instruction Fuzzy Hash: E421F87261C6A447E65A8B26AD102BA7350F7157D9F841225EFEE036D5C63CFA008710

Function 00007FFE126D8F40 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbee525038b59c0e5412c11d3d178d0e50ffaf15df1e324a29bcb92bdfde56f
Instruction ID: 7b54768e26fabd1a0e06406a418f92ac5fb914ea49cf1bf01bc0cee8399fd6ec
Opcode Fuzzy Hash: 7cbee525038b59c0e5412c11d3d178d0e50ffaf15df1e324a29bcb92bdfde56f
Instruction Fuzzy Hash: 02215B62B14AAD43EA11CB2368241FA62A1E745BF1F951236EFED073D4DA7CE9408300

Function 00007FFE126E27C0 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE126E27D7
PyTuple_New.PYTHON312 ref: 00007FFE126E27E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE126E2804
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE126E2820
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE126E283C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE126E2858

Part of subcall function 00007FFE126E2BA4: PyLong_FromLongLong.PYTHON312(?,?,?,00007FFE126E2878), ref: 00007FFE126E2BBC
Part of subcall function 00007FFE126E2BA4: PyModule_AddObject.PYTHON312(?,?,?,00007FFE126E2878), ref: 00007FFE126E2BD3

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE126E2B09
PyModule_AddType.PYTHON312 ref: 00007FFE126E2B22
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE126E2B39
PyModule_AddType.PYTHON312 ref: 00007FFE126E2B4D
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE126E2B64
PyModule_AddType.PYTHON312 ref: 00007FFE126E2B79

Strings

FORMAT_AUTO, xrefs: 00007FFE126E27FA
FORMAT_ALONE, xrefs: 00007FFE126E2835
CHECK_NONE, xrefs: 00007FFE126E2869
MF_BT3, xrefs: 00007FFE126E2A58
CHECK_UNKNOWN, xrefs: 00007FFE126E28F5
FILTER_POWERPC, xrefs: 00007FFE126E29ED
MF_BT2, xrefs: 00007FFE126E2A3D
FORMAT_RAW, xrefs: 00007FFE126E2851
FILTER_DELTA, xrefs: 00007FFE126E294C
MF_HC4, xrefs: 00007FFE126E2A1F
PRESET_EXTREME, xrefs: 00007FFE126E2ADE
MODE_FAST, xrefs: 00007FFE126E2A8E
CHECK_CRC64, xrefs: 00007FFE126E28A4
MF_BT4, xrefs: 00007FFE126E2A73
FORMAT_XZ, xrefs: 00007FFE126E2819
MF_HC3, xrefs: 00007FFE126E2A08
CHECK_ID_MAX, xrefs: 00007FFE126E28DA
PRESET_DEFAULT, xrefs: 00007FFE126E2AC4
CHECK_SHA256, xrefs: 00007FFE126E28BF
FILTER_LZMA1, xrefs: 00007FFE126E2913
FILTER_X86, xrefs: 00007FFE126E2963
FILTER_SPARC, xrefs: 00007FFE126E29D2
Call to liblzma failed., xrefs: 00007FFE126E2AF8
MODE_NORMAL, xrefs: 00007FFE126E2AA9
_lzma.LZMAError, xrefs: 00007FFE126E2B02
FILTER_LZMA2, xrefs: 00007FFE126E2931
FILTER_ARMTHUMB, xrefs: 00007FFE126E29B7
FILTER_ARM, xrefs: 00007FFE126E299C
CHECK_CRC32, xrefs: 00007FFE126E2887
FILTER_IA64, xrefs: 00007FFE126E2981

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction ID: 3c4a8cbbe69f7f9c526a209e7efc7e6de25667a51b8b724cebd42ae6e47cd9a5
Opcode Fuzzy Hash: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction Fuzzy Hash: 0EA1DA61B18E225AEB14DF37EE502B56766AF48BA8F4040B0CD0D8A6F5EEEDF514C710

Function 00007FFE146394B8 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE14639A29
DName::operator+.LIBVCRUNTIME ref: 00007FFE14639A5E
DName::operator+.LIBVCRUNTIME ref: 00007FFE14639A97

Strings

char, xrefs: 00007FFE14639588
__int64, xrefs: 00007FFE1463975F
unsigned , xrefs: 00007FFE146399E6
long , xrefs: 00007FFE146395C7
long, xrefs: 00007FFE14639552
auto, xrefs: 00007FFE146397EB
char16_t, xrefs: 00007FFE146397B8
<unknown>, xrefs: 00007FFE146397CA
bool, xrefs: 00007FFE14639780
char8_t, xrefs: 00007FFE146397D9
short, xrefs: 00007FFE14639576
signed , xrefs: 00007FFE146399F6
this , xrefs: 00007FFE14639971
__int16, xrefs: 00007FFE146396C0
__int32, xrefs: 00007FFE1463976E
__int8, xrefs: 00007FFE146396D2
UNKNOWN, xrefs: 00007FFE1463992C
int, xrefs: 00007FFE14639564
__w64 , xrefs: 00007FFE146396FC
volatile, xrefs: 00007FFE146398A2
const, xrefs: 00007FFE14639887
double, xrefs: 00007FFE146395DE
wchar_t, xrefs: 00007FFE1463994A
decltype(auto), xrefs: 00007FFE14639900
char32_t, xrefs: 00007FFE146399AB
void, xrefs: 00007FFE1463961C
__int128, xrefs: 00007FFE14639750
volatile, xrefs: 00007FFE146398CF
float, xrefs: 00007FFE1463960A

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction ID: 8ec8c3483f50930985658e47070ea4d9862cf89e4e9741e9dec55a85db83b19e
Opcode Fuzzy Hash: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction Fuzzy Hash: 3F024072E18E9688FB149B66D8D51BC26B0BB0736CF5441B5CA4D16BB8DF3CA54CCB80

Function 00007FFE13383DD0 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 244
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Format.PYTHON312 ref: 00007FFE13383E4C
PyErr_Format.PYTHON312 ref: 00007FFE13384154
_Py_Dealloc.PYTHON312 ref: 00007FFE133841B2
htons.WS2_32 ref: 00007FFE133841CF

Strings

%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FFE13383FFA
%s(): AF_HYPERV address service_id is not a valid UUID string, xrefs: 00007FFE13383F2C
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FFE1338411A
%s(): unsupported AF_HYPERV protocol: %d, xrefs: 00007FFE13383E3E
%s(): bad family, xrefs: 00007FFE13383E21
%s(): flowinfo must be 0-1048575., xrefs: 00007FFE133840A3
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FFE133840F7
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FFE1338402A
%s(): unknown Bluetooth protocol, xrefs: 00007FFE13383F72
%s(): port must be 0-65535., xrefs: 00007FFE1338413F
%s(): wrong format, xrefs: 00007FFE13383FA7
%s(): AF_HYPERV address must be tuple, not %.500s, xrefs: 00007FFE13383E8A
%s(): AF_HYPERV address vm_id is not a valid UUID string, xrefs: 00007FFE13383EE9
UU;AF_HYPERV address must be a str tuple (vm_id, service_id), xrefs: 00007FFE13383EB9

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_Format$Deallochtons
String ID: %s(): AF_HYPERV address must be tuple, not %.500s$%s(): AF_HYPERV address service_id is not a valid UUID string$%s(): AF_HYPERV address vm_id is not a valid UUID string$%s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): unsupported AF_HYPERV protocol: %d$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$UU;AF_HYPERV address must be a str tuple (vm_id, service_id)
API String ID: 2819711985-3631354148
Opcode ID: 2a7c56321471c2d82b95262e8f982d4fde5c20bb87aa390549c57e4e666f4892
Instruction ID: e9d53219094ecd793cad796496a4bffae8a702bbd595a928c38a730d5a4ccbc2
Opcode Fuzzy Hash: 2a7c56321471c2d82b95262e8f982d4fde5c20bb87aa390549c57e4e666f4892
Instruction Fuzzy Hash: 1AC11B72A08F4699EB108F67D8441BD23A0BB64BA4F5042F6DA6D63E74DF7CE585C308

Function 00007FFE1338718C Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 260
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13387228
PyUnicode_AsEncodedString.PYTHON312 ref: 00007FFE13387262
PyObject_Str.PYTHON312 ref: 00007FFE133872A5
PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE133872CB
PySys_Audit.PYTHON312 ref: 00007FFE13387329
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338735F
getaddrinfo.WS2_32 ref: 00007FFE13387376
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387382
PyList_New.PYTHON312 ref: 00007FFE133873A4
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1338740F
_Py_Dealloc.PYTHON312 ref: 00007FFE13387429
PyList_Append.PYTHON312 ref: 00007FFE1338743E
_Py_Dealloc.PYTHON312 ref: 00007FFE13387457
_Py_Dealloc.PYTHON312 ref: 00007FFE1338747D
_Py_Dealloc.PYTHON312 ref: 00007FFE13387496
freeaddrinfo.WS2_32 ref: 00007FFE133874A5
_Py_Dealloc.PYTHON312 ref: 00007FFE133874C0
_Py_Dealloc.PYTHON312 ref: 00007FFE133874D5
PyErr_SetString.PYTHON312 ref: 00007FFE133874EE
_Py_Dealloc.PYTHON312 ref: 00007FFE13387507
_Py_Dealloc.PYTHON312 ref: 00007FFE13387520
freeaddrinfo.WS2_32 ref: 00007FFE1338752F
PyErr_SetString.PYTHON312 ref: 00007FFE13387548

Strings

Int or String expected, xrefs: 00007FFE133874E4
getaddrinfo() argument 1 must be string or None, xrefs: 00007FFE1338753E
iiisO, xrefs: 00007FFE13387404
socket.getaddrinfo, xrefs: 00007FFE13387317
OOiii, xrefs: 00007FFE13387306
idna, xrefs: 00007FFE1338725B
OO|iiii:getaddrinfo, xrefs: 00007FFE133871DC

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Dealloc$String$Err_Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_Object_ParseRestoreSaveSys_TupleValue_getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 3469260611-1074899869
Opcode ID: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction ID: c0f7d3254bf15cc271fd99f5e1ea2d87dce32d9f10da15aa40ad7b9ba069a34c
Opcode Fuzzy Hash: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction Fuzzy Hash: E4C14B32A09E028AEB15CF62D4445BC37A1BB68BA4F0042F5DD6E63E64DF3CE594C308

Function 00007FFE133878C8 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 162threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338791F
PyErr_SetString.PYTHON312 ref: 00007FFE1338794F
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387997
PySys_Audit.PYTHON312 ref: 00007FFE133879CE
PyOS_snprintf.PYTHON312 ref: 00007FFE13387A01
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387A2F
getaddrinfo.WS2_32 ref: 00007FFE13387A4B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387A56
PyErr_SetString.PYTHON312 ref: 00007FFE13387A91
htonl.WS2_32 ref: 00007FFE13387AB1
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387AC1
getnameinfo.WS2_32 ref: 00007FFE13387AF9
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387B04
PyUnicode_DecodeMBCS.PYTHON312 ref: 00007FFE13387B52
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE13387B6B
freeaddrinfo.WS2_32 ref: 00007FFE13387B8E

Strings

Oi:getnameinfo, xrefs: 00007FFE13387914
getnameinfo() argument 1 must be a tuple, xrefs: 00007FFE13387945
sockaddr resolved to multiple addresses, xrefs: 00007FFE13387A80
surrogatepass, xrefs: 00007FFE13387B47
socket.getnameinfo, xrefs: 00007FFE133879C7
, xrefs: 00007FFE13387ADF
getnameinfo(): flowinfo must be 0-1048575., xrefs: 00007FFE133879B2
si|II;getnameinfo(): illegal sockaddr argument, xrefs: 00007FFE13387990
IPv4 sockaddr must be 2 tuple, xrefs: 00007FFE13387B27
(O), xrefs: 00007FFE133879C0

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Size$Arg_Err_ParseRestoreSaveStringTuple_$AuditBuildDecodeS_snprintfSys_Unicode_Value_freeaddrinfogetaddrinfogetnameinfohtonl
String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo$surrogatepass
API String ID: 2526741257-243639936
Opcode ID: 04604c1635eafd80c084e70278c0c195183a3ebb5ddeaecdd157658cd547c5cb
Instruction ID: 5af93eb47d1511eaefb144811096e066cbdd13bc5efed84be5a3508279deb231
Opcode Fuzzy Hash: 04604c1635eafd80c084e70278c0c195183a3ebb5ddeaecdd157658cd547c5cb
Instruction Fuzzy Hash: 82816E72A08F428AEB11CF66E4401AD73A1FB94BA4F1002B6DA6D63B74DF7CE585C744

Function 00007FFE13384C58 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 170threadstringCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE13384CBD
getaddrinfo.WS2_32 ref: 00007FFE13384CD9
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13384CE5
freeaddrinfo.WS2_32 ref: 00007FFE13384D09
PyErr_SetString.PYTHON312 ref: 00007FFE13384D20
freeaddrinfo.WS2_32 ref: 00007FFE13384D46
memcpy.VCRUNTIME140 ref: 00007FFE13384D68
freeaddrinfo.WS2_32 ref: 00007FFE13384D70
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13384D87
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13384D9E
inet_pton.WS2_32 ref: 00007FFE13384DCA
strchr.VCRUNTIME140 ref: 00007FFE13384DEF
inet_pton.WS2_32 ref: 00007FFE13384E15
PyEval_SaveThread.PYTHON312 ref: 00007FFE13384E43
getaddrinfo.WS2_32 ref: 00007FFE13384E5B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13384E67
memcpy.VCRUNTIME140 ref: 00007FFE13384EA1
freeaddrinfo.WS2_32 ref: 00007FFE13384EA9

Strings

unknown address family, xrefs: 00007FFE13384EC2
<broadcast>, xrefs: 00007FFE13384D94
address family mismatched, xrefs: 00007FFE13384EDB
wildcard resolved to multiple address, xrefs: 00007FFE13384D4C
unsupported address family, xrefs: 00007FFE13384D0F
255.255.255.255, xrefs: 00007FFE13384D7D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Threadfreeaddrinfo$RestoreSavegetaddrinfoinet_ptonmemcpystrcmp$Err_Stringstrchr
String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
API String ID: 535957624-1715193308
Opcode ID: 84e0856cd869813e583fc43c899fd160c3153486a779d11b04d7bc0fb41145c4
Instruction ID: 3da7f1645077a126004e1cf1449a3267d3403340ef1aed304635ba7c3a8b146b
Opcode Fuzzy Hash: 84e0856cd869813e583fc43c899fd160c3153486a779d11b04d7bc0fb41145c4
Instruction Fuzzy Hash: 6A718121A08E428AE7608F26940427D6360FFA4BA4F5443F5DA6E73EB5DF3CE5D58708

Function 00007FFE148B22F8 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 206timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2356
PyErr_ExceptionMatches.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B236A
PyErr_SetString.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B23B6

Part of subcall function 00007FFE148B266C: PySequence_Fast.PYTHON312(00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2694

_PyDeadline_Init.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2471
PyEval_SaveThread.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24AB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24B4
select.WS2_32(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24CD
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24D9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24DF
PyErr_CheckSignals.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B24EE
_PyDeadline_Get.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B250B
_PyTime_AsTimeval_clamp.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2529
PyErr_Occurred.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2584
PyTuple_Pack.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B259D
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B25BA
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B25D3
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B25EC
WSAGetLastError.WS2_32(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2652
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2664

Part of subcall function 00007FFE148B266C: PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B2709
Part of subcall function 00007FFE148B266C: PyErr_SetString.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B278F
Part of subcall function 00007FFE148B266C: _Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B27A3
Part of subcall function 00007FFE148B266C: _Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B27B7

Part of subcall function 00007FFE148B266C: _Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B27D2

Strings

timeout must be a float or None, xrefs: 00007FFE148B237B
timeout must be non-negative, xrefs: 00007FFE148B23AC

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction ID: 77fd73e97389f2a49ef4caaa9f762bd07663fc906105f8187c1ecc02cb4d8eeb
Opcode Fuzzy Hash: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction Fuzzy Hash: A9913E61A08E8399EB219F26D8981B963A4FF46BA4F404175FE4E467B8DF3CE54DC700

Function 00007FFE13384864 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE133848C0

Strings

iy#, xrefs: 00007FFE133848B9
OiII, xrefs: 00007FFE13384A1B
Unknown Bluetooth protocol, xrefs: 00007FFE1338498A

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: BuildSizeValue_
String ID: OiII$Unknown Bluetooth protocol$iy#
API String ID: 1740464280-1931379703
Opcode ID: 902a55de1e61e57d9b75f782d95346036916bf3d28d7f19c3b677d66217b6a38
Instruction ID: 5959e89c47a7d3bee518556051f59b1cb0b8cf15435569784cb9a7710dd484a4
Opcode Fuzzy Hash: 902a55de1e61e57d9b75f782d95346036916bf3d28d7f19c3b677d66217b6a38
Instruction Fuzzy Hash: 63511F21A0CE429AEA249B12E54407D6360BF65BB1F5442F5CA6E77EB4EF2CE5C5C308

Function 00007FFE1463CDBC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE4D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE86
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CF5A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CF6B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CFCE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CFDE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D02A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D03C
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D1B1

Part of subcall function 00007FFE1463ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1463EDEE

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D233
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D242

Strings

`anonymous namespace', xrefs: 00007FFE1463D10E

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction ID: 1d9d9f024394d9d57b789b35babf66efd1d038749a227d369ed20661f7a268ae
Opcode Fuzzy Hash: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction Fuzzy Hash: BEE17C72A08FC699EB10DF26D8C01AC77A0FB46758F448175EA4D17BA9DF38D519C740

Function 00007FFE126D71F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE126D7217
PyThread_allocate_lock.PYTHON312 ref: 00007FFE126D728A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE126D72CA
_Py_Dealloc.PYTHON312 ref: 00007FFE126D736B
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE126D7389
PyErr_Occurred.PYTHON312 ref: 00007FFE126D7392
PyErr_SetString.PYTHON312 ref: 00007FFE126D73E0
_Py_Dealloc.PYTHON312 ref: 00007FFE126E4B1D
_Py_Dealloc.PYTHON312 ref: 00007FFE126E4B4E

Strings

Invalid container format: %d, xrefs: 00007FFE126E4B61
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFE126D73ED
Must specify filters for FORMAT_RAW, xrefs: 00007FFE126E4B04
Unable to allocate lock, xrefs: 00007FFE126E4B2A
Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFE126D73CF

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction ID: 63260d0079a8d6949ac3967804eb410fbe85a77ce693d106680d08cba26e0b1e
Opcode Fuzzy Hash: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction Fuzzy Hash: E0615C21A08E8A86EB69CF27AC5427933A1FF44BB4F4941B5DD4D466F4DFBCE8448341

Function 00007FFE126E0CAC Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON312 ref: 00007FFE126E0CD5
PyMem_Calloc.PYTHON312 ref: 00007FFE126E0D2C
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE126E0E12
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE126E0E3C
PyErr_Clear.PYTHON312 ref: 00007FFE126E0E46

Part of subcall function 00007FFE126E1E7C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE126E0CFC), ref: 00007FFE126E1E89
Part of subcall function 00007FFE126E1E7C: PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE126E0CFC), ref: 00007FFE126E1E92

PyErr_SetString.PYTHON312 ref: 00007FFE126E0E62
PyMem_Free.PYTHON312 ref: 00007FFE126E0E6B
_Py_Dealloc.PYTHON312 ref: 00007FFE126E5D46

Strings

|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFE126E0DBF
preset, xrefs: 00007FFE126E0CC8
Invalid filter specifier for LZMA filter, xrefs: 00007FFE126E0E58
Invalid compression preset: %u, xrefs: 00007FFE126E5D6B

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1879153319-1461672608
Opcode ID: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction ID: 97f771931302a8b3bd826a60288ec142d0189a0c4900a8b68a1dc0631fd366a3
Opcode Fuzzy Hash: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction Fuzzy Hash: 7A51EA35A08F42C5EA20DF16F8442A973A4FB88BA4F5441B5CA8D53BB9DFBCE459C740

Function 00007FFE13388270 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338829D
PyErr_SetString.PYTHON312 ref: 00007FFE133882C9
PyBuffer_Release.PYTHON312 ref: 00007FFE133882D4
PyErr_SetString.PYTHON312 ref: 00007FFE13388303
PyBuffer_Release.PYTHON312 ref: 00007FFE1338830E
inet_ntop.WS2_32 ref: 00007FFE13388335
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE1338834D
PyBuffer_Release.PYTHON312 ref: 00007FFE13388358
PyBuffer_Release.PYTHON312 ref: 00007FFE13388385
PyUnicode_FromString.PYTHON312 ref: 00007FFE1338838E
PyErr_Format.PYTHON312 ref: 00007FFE133883AA
PyBuffer_Release.PYTHON312 ref: 00007FFE133883B5

Strings

iy*:inet_ntop, xrefs: 00007FFE13388291
invalid length of packed IP address string, xrefs: 00007FFE133882BF, 00007FFE133882F9
unknown address family %d, xrefs: 00007FFE1338839D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_Release$Err_$String$From$Arg_ErrnoFormatParseSizeTuple_Unicode_inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 1507301079-2822559286
Opcode ID: 53b98e0b39da5fdef2c7c0ee4bcb4f09635da776308b6f8e1f3f5746954ec4bc
Instruction ID: 9b33448eab4121c85e2778a8ff82523823dbb49b8a92c357a20a26c322a2c9a4
Opcode Fuzzy Hash: 53b98e0b39da5fdef2c7c0ee4bcb4f09635da776308b6f8e1f3f5746954ec4bc
Instruction Fuzzy Hash: E7314125A18E4789EA60CB16E8506BD23A0FFA8B64F4006F1D55FA7A74DF3CE5C8C714

Function 00007FFE13382950 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1338296C
GetComputerNameExW.KERNEL32 ref: 00007FFE1338298D
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE133829A4
GetLastError.KERNEL32 ref: 00007FFE13383A6E
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13383A7D

Strings

socket.gethostname, xrefs: 00007FFE13382965

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
String ID: socket.gethostname
API String ID: 1075394898-2650736202
Opcode ID: 25ae612990bab75232c8daec9245eaa7fbb0b38a1306ba03551d9cdaf76ece37
Instruction ID: 74767f9e48d159cfb60733d7d929d8fdf0ea723ad319783cee2945a3bd93c402
Opcode Fuzzy Hash: 25ae612990bab75232c8daec9245eaa7fbb0b38a1306ba03551d9cdaf76ece37
Instruction Fuzzy Hash: E9316725A0CF428AE7208B23A81427D63A1FFA9BB4F5402F5D95F93F74DE3CE0858604

Function 00007FFE13387F30 Relevance: 24.1, APIs: 16, Instructions: 106COMMON

Download Yara Rule

APIs

PyList_New.PYTHON312 ref: 00007FFE13387F4D
GetIfTable2Ex.IPHLPAPI ref: 00007FFE13387F71
_Py_Dealloc.PYTHON312 ref: 00007FFE13387F8B
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13387F93
memcpy.VCRUNTIME140 ref: 00007FFE13387FD1
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FFE13387FE9
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1338800C
PyList_Append.PYTHON312 ref: 00007FFE13388020
_Py_Dealloc.PYTHON312 ref: 00007FFE1338803A
FreeMibTable.IPHLPAPI ref: 00007FFE13388053
_Py_Dealloc.PYTHON312 ref: 00007FFE13388092
_Py_Dealloc.PYTHON312 ref: 00007FFE133880A6
FreeMibTable.IPHLPAPI ref: 00007FFE133880B1
_Py_Dealloc.PYTHON312 ref: 00007FFE133880C9
FreeMibTable.IPHLPAPI ref: 00007FFE133880D4
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE133880DC

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Dealloc$FreeTable$Err_FromList_Windows$AppendBuildConvertInterfaceLuidNameSizeTable2Value_memcpy
String ID:
API String ID: 1684791173-0
Opcode ID: 6e5f08eccdd5b29cfe341dff8070fb2ed0092c75082b83863e899f864d342429
Instruction ID: 16bb8311ce2f61695694d3e72de098114366baec85570c83db82698d027d6997
Opcode Fuzzy Hash: 6e5f08eccdd5b29cfe341dff8070fb2ed0092c75082b83863e899f864d342429
Instruction Fuzzy Hash: C8415171A08F4289EB644B22E85437D73A1EFA4B65F0402F5C96E66AB4DF2CE485C709

Function 00007FFE1463DC24 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE146390F4), ref: 00007FFE1463E08A
DName::DName.LIBVCRUNTIME ref: 00007FFE1463E0C9
swprintf_s.PGOCR ref: 00007FFE1463E0E9
DName::DName.LIBVCRUNTIME ref: 00007FFE1463E0F9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463E149

Strings

nullptr, xrefs: 00007FFE1463DE0D
lambda, xrefs: 00007FFE1463DFE8
NULL, xrefs: 00007FFE1463DCF1
`generic-class-parameter-, xrefs: 00007FFE1463E15A
`generic-method-parameter-, xrefs: 00007FFE1463E116
`template-type-parameter-, xrefs: 00007FFE1463E16A

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction ID: 522c499576eed4ea1d11116c5bbe249964d06a3d7c1f3c5b546b6c5665516406
Opcode Fuzzy Hash: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction Fuzzy Hash: D3F18D32E08E8684FB149B66D9D41FC27A1AF6776CF4400B6D90D26BB5DF3CA91D8390

Function 00007FFE126D81F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE126D8245
PyObject_GetBuffer.PYTHON312 ref: 00007FFE126D8279
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE126D828A
PyBuffer_Release.PYTHON312 ref: 00007FFE126D82BD
_PyNumber_Index.PYTHON312 ref: 00007FFE126D82EF
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE126D8300
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE126D835B
PyErr_Occurred.PYTHON312 ref: 00007FFE126D837B
_PyArg_BadArgument.PYTHON312 ref: 00007FFE126E4D3E

Strings

contiguous buffer, xrefs: 00007FFE126E4D29
argument 'data', xrefs: 00007FFE126E4D30
decompress, xrefs: 00007FFE126E4D37

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction ID: 67055c1ee07280b9c61e2d233ddf4e1334c2bbf045694fc8f0e5bb6bf5b3e439
Opcode Fuzzy Hash: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction Fuzzy Hash: 4A415C21A08F4A83EA10CB13AC882B963A0FB45BA0F454171DA9D177F4DFBCE806C740

Function 00007FFE13213548 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE1321359F
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE132135E8
PyObject_GetBuffer.PYTHON312 ref: 00007FFE13213605
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE13213616
_PyNumber_Index.PYTHON312 ref: 00007FFE13213630
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE13213645
PyBuffer_Release.PYTHON312 ref: 00007FFE13213688

Strings

decompress, xrefs: 00007FFE1321B85B
contiguous buffer, xrefs: 00007FFE1321B84D
argument 'data', xrefs: 00007FFE1321B854

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction ID: 8f612bf06eecd3500f1b15192478bd542462fdc6e31fbfa01d8b5f9bc7e6cf33
Opcode Fuzzy Hash: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction Fuzzy Hash: B6416062A18F4299EA50AF13DA4466863A1FBA8FA4F444171DE5D237AADF3CE505C700

Function 00007FFE13385EDC Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13385F1E
PyErr_Format.PYTHON312 ref: 00007FFE13385F60
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13385F9B
WSAIoctl.WS2_32 ref: 00007FFE13385FD4
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386008
WSAIoctl.WS2_32 ref: 00007FFE13386045
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE13386053
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386077
WSAIoctl.WS2_32 ref: 00007FFE133860B4

Strings

invalid ioctl command %lu, xrefs: 00007FFE13385F56
kO:ioctl, xrefs: 00007FFE13385F17
k(kkk):ioctl, xrefs: 00007FFE13386001
kI:ioctl, xrefs: 00007FFE13385F94, 00007FFE13386070

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Ioctl$Err_FormatFromLongLong_Unsigned
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 1148432870-4238462244
Opcode ID: 3f76204c42d358388be91a2e0fa01af582f79ca479d8e6d2f391cea6ebf1b823
Instruction ID: 3e002a41c6377da00e9c8b0ee49a2da0dc0f588d58e54b0c7617c60f0fb744a1
Opcode Fuzzy Hash: 3f76204c42d358388be91a2e0fa01af582f79ca479d8e6d2f391cea6ebf1b823
Instruction Fuzzy Hash: 52515071A18E02C9E750CB66E8445ED33B0FB58768F5402B6EA5EA3EA8DF3CD194C744

Function 00007FFE13384284 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON312 ref: 00007FFE133842C5
PyBytes_Size.PYTHON312 ref: 00007FFE133842D2
PyErr_SetString.PYTHON312 ref: 00007FFE13384374
_Py_Dealloc.PYTHON312 ref: 00007FFE133843FB

Strings

host name must not contain null character, xrefs: 00007FFE13384401
encoding of hostname failed, xrefs: 00007FFE13384363
str, bytes or bytearray expected, not %s, xrefs: 00007FFE13384399
idna, xrefs: 00007FFE1338434B

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Bytes_String$DeallocErr_Size
String ID: encoding of hostname failed$host name must not contain null character$idna$str, bytes or bytearray expected, not %s
API String ID: 2522550923-2120988924
Opcode ID: 4bff7bdefa987b91148ee3b18d677af03c6520adca83e4b60bb055ec74d24b36
Instruction ID: 41ef854f638df5dfc693172c7ccd92854c5b4d875e855ba5be1ed1272b468b65
Opcode Fuzzy Hash: 4bff7bdefa987b91148ee3b18d677af03c6520adca83e4b60bb055ec74d24b36
Instruction Fuzzy Hash: 99412E61A09F0689EB548B17E45437C2360EB64BA4F5452F5DA3E67FA0DF6CE4E18308

Function 00007FFE13386A44 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON312 ref: 00007FFE13386A7A
PyErr_Format.PYTHON312 ref: 00007FFE13386AA3
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386ACB
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386AEE
PySys_Audit.PYTHON312 ref: 00007FFE13386B3C
PyBuffer_Release.PYTHON312 ref: 00007FFE13386BB0
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE13386BBB
PyBuffer_Release.PYTHON312 ref: 00007FFE13386BC7

Strings

y*iO:sendto, xrefs: 00007FFE13386AC4
sendto, xrefs: 00007FFE13386B01
socket.sendto, xrefs: 00007FFE13386B35
sendto() takes 2 or 3 arguments (%zd given), xrefs: 00007FFE13386A96
y*O:sendto, xrefs: 00007FFE13386AE7

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: SizeTuple_$Arg_Buffer_ParseRelease$AuditErr_FormatFromLong_Ssize_tSys_
String ID: sendto$sendto() takes 2 or 3 arguments (%zd given)$socket.sendto$y*O:sendto$y*iO:sendto
API String ID: 3528750861-2448770124
Opcode ID: 0194c0e6244d6a72a08d98085803f7896a3b58e6dc587eada0c3a2fa3e416755
Instruction ID: d79e0a73191c66bfdaef60d228d1afb503b74152fe1e61a22481a2842b7550a0
Opcode Fuzzy Hash: 0194c0e6244d6a72a08d98085803f7896a3b58e6dc587eada0c3a2fa3e416755
Instruction Fuzzy Hash: 5B412E31608E4689EB10CF66E8402AD73A4FB947A8F4002B2DA5D63B74DF7CD584C744

Function 00007FFE13387CE8 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 50threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387D09
PySys_Audit.PYTHON312 ref: 00007FFE13387D3C
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387D54
htons.WS2_32 ref: 00007FFE13387D62
getservbyport.WS2_32 ref: 00007FFE13387D70
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387D7C
PyErr_SetString.PYTHON312 ref: 00007FFE13387D9D
PyUnicode_FromString.PYTHON312 ref: 00007FFE13387DB2
PyErr_SetString.PYTHON312 ref: 00007FFE13387DCB

Strings

port/proto not found, xrefs: 00007FFE13387D93
getservbyport: port must be 0-65535., xrefs: 00007FFE13387DC1
socket.getservbyport, xrefs: 00007FFE13387D35
i|s:getservbyport, xrefs: 00007FFE13387CF8

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: String$Err_Eval_Thread$Arg_AuditFromParseRestoreSaveSizeSys_Tuple_Unicode_getservbyporthtons
String ID: getservbyport: port must be 0-65535.$i|s:getservbyport$port/proto not found$socket.getservbyport
API String ID: 3420281234-2618607128
Opcode ID: df385e0b112e720f1497a781268f28e1972b04836732b04ec17d0f334ba274de
Instruction ID: 84fe19ff18064be79f5b61ac2c9c65d7bba8c9597e51ba9431bd2767bd1fc7ec
Opcode Fuzzy Hash: df385e0b112e720f1497a781268f28e1972b04836732b04ec17d0f334ba274de
Instruction Fuzzy Hash: B5211921A18E0289EA408B17E85457D6361FFA9BA4F5002F1DA5E67E78DF3DE0D8D708

Function 00007FFE126E1110 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE126E1156
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE126E1197
PyThread_allocate_lock.PYTHON312 ref: 00007FFE126E11FE
PyErr_Format.PYTHON312 ref: 00007FFE126E1286
_Py_Dealloc.PYTHON312 ref: 00007FFE126E1299
PyErr_SetString.PYTHON312 ref: 00007FFE126E1319
_Py_Dealloc.PYTHON312 ref: 00007FFE126E5E05

Strings

Cannot specify both preset and filter chain, xrefs: 00007FFE126E1308
Invalid container format: %d, xrefs: 00007FFE126E127C
|iiOO:LZMACompressor, xrefs: 00007FFE126E1169
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFE126E5DEC
Unable to allocate lock, xrefs: 00007FFE126E5E12

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 1600877341-3984722346
Opcode ID: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction ID: 29c37fe70159b916fd02184901290c5bffed659534948d51db823402a85e0573
Opcode Fuzzy Hash: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction Fuzzy Hash: 09611B31A08E12C9EB50CB66EC900F837A5BB48BA4B5045B2D90D537F8DFBCD9849780

Function 00007FFE1463B280 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463B2D1
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463B39A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463B3E3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463B3F4

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction ID: d1cc9f63feb7ec386c762078c63d9f5f9073872e5528c1a9db3dc52715d5b1c8
Opcode Fuzzy Hash: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction Fuzzy Hash: 03F16A76B08A869EEB10DFA6D4901FC37B0EB0675CB444076EA4D57BAADE38D51DC380

Function 00007FFE126E0B5C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0B81
PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0B9B
PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0BB0
PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0BC7
PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0C40
PyErr_Format.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0C89
PyErr_SetString.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0CA2
_Py_Dealloc.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E5D3A

Strings

Filter specifier must have an "id" entry, xrefs: 00007FFE126E0C98
Filter specifier must be a dict or dict-like object, xrefs: 00007FFE126E5D2B
Invalid filter ID: %llu, xrefs: 00007FFE126E0C7C

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction ID: 6206e4e2a39d79f3e0bee61e4da1fb69a626772955ab68830513a05dff0b90d6
Opcode Fuzzy Hash: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction Fuzzy Hash: AE41DA71A08E43C5EA64CF17AC9417863A4FB45BA4B4480B5CA8E677F4EEBDE885D300

Function 00007FFE133875A4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE133875E0
PySys_Audit.PYTHON312 ref: 00007FFE13387602
PyErr_SetString.PYTHON312 ref: 00007FFE13387668
PyMem_Free.PYTHON312 ref: 00007FFE133876D5

Strings

unsupported address family, xrefs: 00007FFE1338765E
socket.gethostbyaddr, xrefs: 00007FFE133875FB
idna, xrefs: 00007FFE133875CD
et:gethostbyaddr, xrefs: 00007FFE133875D7

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_AuditErr_FreeMem_ParseSizeStringSys_Tuple_
String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
API String ID: 1738687268-1751716127
Opcode ID: 17dc3cb58174f4dc7df811a36dd272339ac8b6b8490b7850cf16da8a9be953b1
Instruction ID: 5ab07d5813eeec88afbddade2677aafad4f41aa1689c436294ddbc4aeb457f8c
Opcode Fuzzy Hash: 17dc3cb58174f4dc7df811a36dd272339ac8b6b8490b7850cf16da8a9be953b1
Instruction Fuzzy Hash: D8317361A08E4689E6209F17E8447AE6361BBA8BE0F4002F2DE6D67F74DE7DD484C744

Function 00007FFE13386660 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE133866AF
PyBuffer_Release.PYTHON312 ref: 00007FFE133866C8
PyErr_SetString.PYTHON312 ref: 00007FFE133866DF
PyBuffer_Release.PYTHON312 ref: 00007FFE13386728
_Py_Dealloc.PYTHON312 ref: 00007FFE13386743
PyBuffer_Release.PYTHON312 ref: 00007FFE13386757
PyBuffer_Release.PYTHON312 ref: 00007FFE13386769
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1338677E

Strings

negative buffersize in recvfrom_into, xrefs: 00007FFE133866CE
w*|ni:recvfrom_into, xrefs: 00007FFE1338667E
nbytes is greater than the length of the buffer, xrefs: 00007FFE1338675D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_Release$Size$Arg_BuildDeallocErr_Keywords_ParseStringTupleValue_
String ID: nbytes is greater than the length of the buffer$negative buffersize in recvfrom_into$w*|ni:recvfrom_into
API String ID: 252658603-4033050226
Opcode ID: cbd05dbb59b33da20bee7d15abf173420b95374231d8228cad919bc37cd99a43
Instruction ID: 6d0c44389e11e99a083d0d50e45b21dfb8f47b6f873be5f7a2c2d02aa137b0a0
Opcode Fuzzy Hash: cbd05dbb59b33da20bee7d15abf173420b95374231d8228cad919bc37cd99a43
Instruction Fuzzy Hash: 0E313C71A08F8289EE108F52E4442BD7364FB697B0F5002B6DA6D63A60DF3DD5C8C704

Function 00007FFE126E0710 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE126E0741
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE126E0756
PyErr_Occurred.PYTHON312 ref: 00007FFE126E075F
PyObject_GetBuffer.PYTHON312 ref: 00007FFE126E0776
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE126E0787
PyBuffer_Release.PYTHON312 ref: 00007FFE126E07B5
_PyArg_CheckPositional.PYTHON312 ref: 00007FFE126E5C03
_PyArg_BadArgument.PYTHON312 ref: 00007FFE126E5C2F

Part of subcall function 00007FFE126E07D4: PyModule_GetState.PYTHON312(?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E07E6
Part of subcall function 00007FFE126E07D4: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0822

Strings

contiguous buffer, xrefs: 00007FFE126E5C1A
_decode_filter_properties, xrefs: 00007FFE126E5BF9, 00007FFE126E5C28
argument 2, xrefs: 00007FFE126E5C21

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction ID: d26aab86069d92c58544a0f390ef4882d01e956f76f6ea20e27f028b1d66f6e9
Opcode Fuzzy Hash: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction Fuzzy Hash: 3E317F25A08E4685EA10CB27EC445B96360FF88FA4F5441B1CA4D677F4DFBCE949CB00

Function 00007FFE126D86B8 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE126D8707
PyErr_NoMemory.PYTHON312 ref: 00007FFE126E4E18

Strings

Memory usage limit exceeded, xrefs: 00007FFE126D8735
Internal error, xrefs: 00007FFE126D872C
Unrecognized error from liblzma: %d, xrefs: 00007FFE126E4E37
Insufficient buffer space, xrefs: 00007FFE126D8754
Invalid or unsupported options, xrefs: 00007FFE126D8742
Corrupt input data, xrefs: 00007FFE126D874B
Unsupported integrity check, xrefs: 00007FFE126E4E24
Input format not supported by decoder, xrefs: 00007FFE126D86FC

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction ID: 57dfbe31257415d35f8f04f3db1f720f6830844e44866e5692f80da1e04143aa
Opcode Fuzzy Hash: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction Fuzzy Hash: A1212C65E2CE4F92FAA8872B9C5C47C12A1EF45770F6060B1C08E429F4DEEEF946C200

Function 00007FFE13387C20 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387C41
PySys_Audit.PYTHON312 ref: 00007FFE13387C67
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387C7B
getservbyname.WS2_32 ref: 00007FFE13387C8E
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387C9A
PyErr_SetString.PYTHON312 ref: 00007FFE13387CBB
htons.WS2_32 ref: 00007FFE13387CD1
PyLong_FromLong.PYTHON312 ref: 00007FFE13387CDA

Strings

socket.getservbyname, xrefs: 00007FFE13387C60
service/proto not found, xrefs: 00007FFE13387CB1
s|s:getservbyname, xrefs: 00007FFE13387C30

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditErr_FromLongLong_ParseRestoreSaveSizeStringSys_Tuple_getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 1135235387-1257235949
Opcode ID: 3b5f47b3c7fe93ff51d3c351ac1364b9cc3afc28ca2730272accc108aa8dca2c
Instruction ID: 943573f1a807cc661a3e09f9bfc7b8a59aa7c96870baf071ec09d68320cb5937
Opcode Fuzzy Hash: 3b5f47b3c7fe93ff51d3c351ac1364b9cc3afc28ca2730272accc108aa8dca2c
Instruction Fuzzy Hash: 2F11FE61A0CE4289EA408B13E85427D63B1FBA9BA5F5002F1DA9E63E74DF3CD5D5C704

Function 00007FFE14633334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE14633390

Part of subcall function 00007FFE14635768: __GetUnwindTryBlock.LIBCMT ref: 00007FFE146357AB
Part of subcall function 00007FFE14635768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE146357D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE14633468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14633475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE146336B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE146336E7

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE146337AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE146337E2

Strings

csm, xrefs: 00007FFE146333AA
csm, xrefs: 00007FFE14633411
csm, xrefs: 00007FFE1463348D

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction ID: 428fd3f116d8a1dea6ac09ac32cae2476ea7e0ea8e8895d3f770061316f42433
Opcode Fuzzy Hash: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction Fuzzy Hash: 94D18372A08F818AEB219F66D4C02AD77A0FB46BACF140175DE8D57B65DF38E498C740

Function 00007FFE1463ED94 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1463EDEE

Strings

template-parameter-, xrefs: 00007FFE1463EE50
generic-type-, xrefs: 00007FFE1463EE97
`template-parameter-, xrefs: 00007FFE1463EE83
`generic-type-, xrefs: 00007FFE1463EECA

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction ID: e871de35ff163a3a33c5c6d9a904e7b6bc426169dbe0e8d7ee0042e6cb00f619
Opcode Fuzzy Hash: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction Fuzzy Hash: 9991A536A08E8699FB109F26D8D01B837A0EB5676CF4851B6EA4D037A5DF3CE509C390

Function 00007FFE13385850 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13385884
getsockopt.WS2_32 ref: 00007FFE133858BF
PyLong_FromLong.PYTHON312 ref: 00007FFE133858CD
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133858E7
getsockopt.WS2_32 ref: 00007FFE13385912
_Py_Dealloc.PYTHON312 ref: 00007FFE1338592C
_PyBytes_Resize.PYTHON312 ref: 00007FFE13385941

Strings

ii|i:getsockopt, xrefs: 00007FFE13385870
getsockopt buflen out of range, xrefs: 00007FFE13385955

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Bytes_FromSizegetsockopt$Arg_DeallocLongLong_ParseResizeStringTuple_
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3532181676-2750947780
Opcode ID: 9b7346a9f4b417b4410470c21b5fb1116251040c05f54305fa742b3d80924aa3
Instruction ID: 21c32994a0291b0a0335df653ec5e40af21a46d4a9cbf788720da3254969e88c
Opcode Fuzzy Hash: 9b7346a9f4b417b4410470c21b5fb1116251040c05f54305fa742b3d80924aa3
Instruction Fuzzy Hash: 0D316D72A09E46CAEB14CF26E44056D73A0FB94B64F5002B5E69E53EB8DF3CD489CB04

Function 00007FFE133862FC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13386347
PyBuffer_Release.PYTHON312 ref: 00007FFE13386360
PyErr_SetString.PYTHON312 ref: 00007FFE13386377
PyBuffer_Release.PYTHON312 ref: 00007FFE133863AF
PyBuffer_Release.PYTHON312 ref: 00007FFE133863C3
PyBuffer_Release.PYTHON312 ref: 00007FFE133863D2
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE133863DB

Strings

buffer too small for requested bytes, xrefs: 00007FFE133863C9
negative buffersize in recv_into, xrefs: 00007FFE13386366
w*|ni:recv_into, xrefs: 00007FFE1338631A

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_Release$Arg_Err_FromKeywords_Long_ParseSizeSsize_tStringTuple
String ID: buffer too small for requested bytes$negative buffersize in recv_into$w*|ni:recv_into
API String ID: 1544103690-1758107600
Opcode ID: 673946159e8f77a6d26c868030c16ac5463a28c82a9e80c6b2633c18a65d49cd
Instruction ID: 6f75eb29b4588a664d030d2a2cde8e49cf61cb7c443cd8ac3c4fd12a0b54633e
Opcode Fuzzy Hash: 673946159e8f77a6d26c868030c16ac5463a28c82a9e80c6b2633c18a65d49cd
Instruction Fuzzy Hash: 9E210A61A08F4289EB11CB56E4542AD7360FB697B0F4002B6DA6E63A74DF6CE5C8C708

Function 00007FFE14639164 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE146391CC
DName::operator+.LIBVCRUNTIME ref: 00007FFE146392C9
DName::operator+.LIBVCRUNTIME ref: 00007FFE14639322
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463934E
DName::operator+.LIBVCRUNTIME ref: 00007FFE14639360
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463938F

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction ID: 61456153304e47dbe975822ab0a9bd647256018add6bb59090f510f43b99a53c
Opcode Fuzzy Hash: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction Fuzzy Hash: EC713B72B18E8699EB10DF66D4901EC33B1AB4579CB808472DA0D57BA9DF38D61DC7C0

Function 00007FFE126D7FEC Relevance: 16.7, APIs: 11, Instructions: 154COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFE126D80AD
memcpy.VCRUNTIME140 ref: 00007FFE126D80D5
memcpy.VCRUNTIME140 ref: 00007FFE126D811F
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE126D8152
PyMem_Realloc.PYTHON312 ref: 00007FFE126D8196
memmove.VCRUNTIME140 ref: 00007FFE126D81C4
PyErr_SetNone.PYTHON312 ref: 00007FFE126E4CC0
PyMem_Free.PYTHON312 ref: 00007FFE126E4CE5
_Py_Dealloc.PYTHON312 ref: 00007FFE126E4D19

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Mem_$memcpy$Bytes_DeallocErr_FreeFromMallocNoneReallocSizeStringmemmove
String ID:
API String ID: 1220578264-0
Opcode ID: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction ID: 8bd0b25d4aebc83c19e1e4b0cb0566c94b5a3b00c7571ba10c8784d497c5e95c
Opcode Fuzzy Hash: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction Fuzzy Hash: 8D513C22A09F4A86EB60CF26AD4827963A5FB44FA4F184175CE8D177B4DF7CE4568340

Function 00007FFE1463AAC8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AB22
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AC58

Strings

cointerface , xrefs: 00007FFE1463ABFF
coclass , xrefs: 00007FFE1463AC11
`unknown ecsu', xrefs: 00007FFE1463AAEE
class , xrefs: 00007FFE1463AC6D
enum , xrefs: 00007FFE1463AC35
struct , xrefs: 00007FFE1463AC7C
union , xrefs: 00007FFE1463AC85

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction ID: 08692e09a4bcd3678cc342f6370091d84deec46e14827e1392512b139d491b00
Opcode Fuzzy Hash: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction Fuzzy Hash: 87516E71E08E9689FB10CB66E8C05BC27B1BB0676CF5441B5DA4E13BA9DF38E549D380

Function 00007FFE133868DC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338691E
_PyDeadline_Get.PYTHON312 ref: 00007FFE13386956
PyErr_CheckSignals.PYTHON312 ref: 00007FFE133869C6
PyBuffer_Release.PYTHON312 ref: 00007FFE133869DE
PyBuffer_Release.PYTHON312 ref: 00007FFE133869F9
PyErr_SetString.PYTHON312 ref: 00007FFE13386A3C

Strings

y*|i:sendall, xrefs: 00007FFE13386904
timed out, xrefs: 00007FFE13386A32

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_Err_Release$Arg_CheckDeadline_ParseSignalsSizeStringTuple_
String ID: timed out$y*|i:sendall
API String ID: 1463051379-3431350491
Opcode ID: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction ID: a84c6590942b24be2501816caff5cdf2807a9589442972a8afb212615a9565ca
Opcode Fuzzy Hash: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction Fuzzy Hash: D9411032608E828AE7109F16E8403AD7364FB54BA4F5441B5DE6E63F65DF3CE4859704

Function 00007FFE133863EC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1338641B
PyErr_SetString.PYTHON312 ref: 00007FFE13386440
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13386455
_PyBytes_Resize.PYTHON312 ref: 00007FFE1338649E
PyTuple_Pack.PYTHON312 ref: 00007FFE133864B5
_Py_Dealloc.PYTHON312 ref: 00007FFE133864D3
_Py_Dealloc.PYTHON312 ref: 00007FFE133864EC

Strings

negative buffersize in recvfrom, xrefs: 00007FFE13386436
n|i:recvfrom, xrefs: 00007FFE13386408

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Bytes_DeallocSizeStringTuple_$Arg_Err_FromPackParseResize
String ID: negative buffersize in recvfrom$n|i:recvfrom
API String ID: 3092067012-1867657612
Opcode ID: 73346fe6d78f416ddd0d404cc1eab1bd50427c101807ce8ae55e63a2c3ceedcf
Instruction ID: 5496b0f85759050565d3768b5f4a740260d78d55d6b8e437f7f6587ee162b333
Opcode Fuzzy Hash: 73346fe6d78f416ddd0d404cc1eab1bd50427c101807ce8ae55e63a2c3ceedcf
Instruction Fuzzy Hash: 67311A71A09F428AEA418B16E44467D63A0EFA4BB4F0442B5DA6E67E74DF3CE0C4D704

Function 00007FFE133877C0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387802
PySys_Audit.PYTHON312 ref: 00007FFE13387824
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387856
gethostbyname.WS2_32 ref: 00007FFE13387864
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387870
PyMem_Free.PYTHON312 ref: 00007FFE13387897

Strings

et:gethostbyname_ex, xrefs: 00007FFE133877F9
idna, xrefs: 00007FFE133877EF
socket.gethostbyname, xrefs: 00007FFE1338781D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditFreeMem_ParseRestoreSaveSizeSys_Tuple_gethostbyname
String ID: et:gethostbyname_ex$idna$socket.gethostbyname
API String ID: 646687969-574663143
Opcode ID: ecae8c52844685ee7768a9ded28dbc98570d1ed912cf0638831457c899a20b59
Instruction ID: e555ad9f930280fad19df576280486efc648bfa38623446d8e20374d675e8930
Opcode Fuzzy Hash: ecae8c52844685ee7768a9ded28dbc98570d1ed912cf0638831457c899a20b59
Instruction Fuzzy Hash: 34214121618E8289E6109B13E4442AE6361FBA8BE0F4442B6DE5D63F64DF3CD185C744

Function 00007FFE133883C0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE133883E7
inet_pton.WS2_32 ref: 00007FFE133883FF
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE13388413
PyErr_SetString.PYTHON312 ref: 00007FFE13388469

Strings

unknown address family, xrefs: 00007FFE13388458
illegal IP address string passed to inet_pton, xrefs: 00007FFE1338841D
is:inet_pton, xrefs: 00007FFE133883DB

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_$Arg_ErrnoFromParseSizeStringTuple_inet_pton
String ID: illegal IP address string passed to inet_pton$is:inet_pton$unknown address family
API String ID: 907464-903159468
Opcode ID: 5f6f26fc013610328acae758eccd67dd248d553df625ba587abfcb104ef9a032
Instruction ID: 3afd8e497eb95d3023bbd32cee8752dbf87cbc424d2a9eadbe9f348a543e0d27
Opcode Fuzzy Hash: 5f6f26fc013610328acae758eccd67dd248d553df625ba587abfcb104ef9a032
Instruction Fuzzy Hash: C4211222A1CD4689EA50DB12E45017D2761FFA4B64F9002F1E56EA7EB4CF2CE5C4C704

Function 00007FFE13382A20 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE13382A48
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE13382A9A
_RTC_Initialize.LIBCMT ref: 00007FFE13382AC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE13382AEE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13382B19

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 91504536c4c753e82cdbe588412995d0809db0d3d25c664ce5a0f1fe9eeb7b4f
Instruction ID: 30227aad38cab671fdcec38eebc65330b8d64e0a9e3ca15b4811a406ad1fbc1c
Opcode Fuzzy Hash: 91504536c4c753e82cdbe588412995d0809db0d3d25c664ce5a0f1fe9eeb7b4f
Instruction Fuzzy Hash: EF819E20E09E038EFA509B6794412BD6290AF657B0F1442F5D92DA7FB2DE3CE8C58708

Function 00007FFE126E3550 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE126E3578
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE126E35CA
_RTC_Initialize.LIBCMT ref: 00007FFE126E35F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE126E361E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE126E3649

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction ID: 6a5d1a9a7325518aad03aaa59baa1be6ee6a0266b3d92920c228ff7b99baa229
Opcode Fuzzy Hash: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction Fuzzy Hash: 3081B160E0CE4386FB50EB679C512B96690AF85BA0F5480B5DA0D477F2DFFCE8658740

Function 00007FFE148B1190 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE148B11B8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE148B120A
_RTC_Initialize.LIBCMT ref: 00007FFE148B1238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE148B125E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE148B1289

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction ID: 0954d822aeafabbaaa0b0900473a49df1a17cec6a7d765d926569fa9f7e0ea85
Opcode Fuzzy Hash: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction Fuzzy Hash: D8817A21E08E438EFA509B6794C12B92691BF477E0F5481B5FA4D8B7B6DF2CA84D8700

Function 00007FFE1321A2F0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1321A318
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1321A36A
_RTC_Initialize.LIBCMT ref: 00007FFE1321A398
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1321A3BE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1321A3E9

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction ID: 849ca409fabefa88ebe22b112c4b9b22257a38b8b879adab904b5a3afedde605
Opcode Fuzzy Hash: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction Fuzzy Hash: A7816C21E0CE438EFA54BB67AA4127962E0AFF57A0F5440B5D90D633B7DE3DE946C600

Function 00007FFE13213270 Relevance: 15.2, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE132132EE
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13213376
PyMem_Malloc.PYTHON312 ref: 00007FFE132133BE
memcpy.VCRUNTIME140 ref: 00007FFE132133EC
PyMem_Realloc.PYTHON312 ref: 00007FFE13213409
_Py_Dealloc.PYTHON312 ref: 00007FFE1321B81B

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Mem_memcpy$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 2377850682-0
Opcode ID: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction ID: 3f5db416dfa904720435a4842480e2a8a635662e34db75aee67e4a89e041f6d2
Opcode Fuzzy Hash: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction Fuzzy Hash: C8517D32A09F4289EB50AF239A4427963A5FFA4FA4F188475CE8D67766DF3CE441C344

Function 00007FFE13387090 Relevance: 15.1, APIs: 10, Instructions: 60networkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON312 ref: 00007FFE133870AE
PyErr_Occurred.PYTHON312 ref: 00007FFE133870BD
GetCurrentProcessId.KERNEL32 ref: 00007FFE133870C8
WSADuplicateSocketW.WS2_32 ref: 00007FFE133870D8
WSASocketW.WS2_32 ref: 00007FFE1338710B
SetHandleInformation.KERNEL32 ref: 00007FFE13387125
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13387131
closesocket.WS2_32 ref: 00007FFE1338713A
PyLong_FromLongLong.PYTHON312 ref: 00007FFE1338714F
closesocket.WS2_32 ref: 00007FFE13387160

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Long$Err_FromLong_Socketclosesocket$CurrentDuplicateHandleInformationOccurredProcessWindows
String ID:
API String ID: 3394293678-0
Opcode ID: 4c347251b0cb3e997720691e5f1e8047ee37cb6823bc12014edeb51918814818
Instruction ID: 1e9e586b49eee0898962c8d1446ec33292e8349565fc0a8587e2528f575a3ab6
Opcode Fuzzy Hash: 4c347251b0cb3e997720691e5f1e8047ee37cb6823bc12014edeb51918814818
Instruction Fuzzy Hash: B1213560A1DE4285EA255B23A85837D6291AFA9BB4F0403F4C83E66FF4DF3CE0948604

Function 00007FFE146337F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE14633996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE146339A3

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14633C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14633CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE14633CD7

Strings

csm, xrefs: 00007FFE146339BF
csm, xrefs: 00007FFE146338DD
csm, xrefs: 00007FFE1463393F

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction ID: d5dbed2dccdc14e235fe571a236d31956a1cdac4d5ac1da6b09e4a8bd6a2f271
Opcode Fuzzy Hash: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction Fuzzy Hash: BEE19E73908AC28AE7219F36D4C02AD77A0FB46B6CF140275DA8D577A5DF38E489C780

Function 00007FFE13211ED4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321B22A

Strings

%d work, %d block, ratio %5.2f, xrefs: 00007FFE1321B210
VUUU, xrefs: 00007FFE13211F91
too repetitive; using fallback sorting algorithm, xrefs: 00007FFE1321B233

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction ID: bfb4fb12a5f92d860ba507c67417b83ec8224202bf7309052f41eecafbeb5ade
Opcode Fuzzy Hash: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction Fuzzy Hash: BC41B632A08B418BE614AF26954517973A5FBE4B74F100275DE0E637B7DF3DE442C600

Function 00007FFE148B266C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON312(00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2694
PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B2709
PyErr_SetString.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B278F
_Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B27A3
_Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B27B7

Strings

arguments 1-3 must be sequences, xrefs: 00007FFE148B268D
too many file descriptors in select(), xrefs: 00007FFE148B2785

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction ID: 0df5d861dd82fb24af12961be9b0c2d6f3d1540ab10169b6c5e73a27a5a49d22
Opcode Fuzzy Hash: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction Fuzzy Hash: 82417036A08F0289EB158F16D98817877A5FB96BB4F1442B1EE6E437B4DF38E459C304

Function 00007FFE1463C7F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463C9AC

Part of subcall function 00007FFE146394B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE14639A29
Part of subcall function 00007FFE146394B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE14639A5E

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463C95E

Strings

cli::array<, xrefs: 00007FFE1463C92B
std::nullptr_t, xrefs: 00007FFE1463C8D7
std::nullptr_t , xrefs: 00007FFE1463C8EA
void, xrefs: 00007FFE1463C842
void , xrefs: 00007FFE1463C86A
cli::pin_ptr<, xrefs: 00007FFE1463C975

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction ID: 3e89c93d576595e0ce4463e5a97b265114053a3f58687aaccd95906a596681fd
Opcode Fuzzy Hash: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction Fuzzy Hash: CD515F72E18F9598FB118F62D8812BC3BB4BB0A76CF454176DA4D127A9DF3CA148C790

Function 00007FFE126D84D0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE126D84FA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE126D850A
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE126D851B
PyBuffer_Release.PYTHON312 ref: 00007FFE126D8546
_PyArg_BadArgument.PYTHON312 ref: 00007FFE126E4D8A

Part of subcall function 00007FFE126D9010: PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126D9036
Part of subcall function 00007FFE126D9010: PyThread_release_lock.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126D9068

Strings

contiguous buffer, xrefs: 00007FFE126E4D75
compress, xrefs: 00007FFE126E4D83
argument, xrefs: 00007FFE126E4D7C

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction ID: d512c9f1c3437fa0390aaeee16a7314cf30a9c7baeea5d7d2bb0a1ee8b3907f1
Opcode Fuzzy Hash: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction Fuzzy Hash: 24116362B08E4A92EB10CB27EC442B96361FB89B94F948171DA4D536B4DFBCD94AC740

Function 00007FFE13212690 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE132126BA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE132126CA
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE132126DB
PyBuffer_Release.PYTHON312 ref: 00007FFE13212706
_PyArg_BadArgument.PYTHON312 ref: 00007FFE1321B45A

Part of subcall function 00007FFE132125FC: PyThread_acquire_lock.PYTHON312 ref: 00007FFE1321261F
Part of subcall function 00007FFE132125FC: PyThread_release_lock.PYTHON312 ref: 00007FFE1321264B

Strings

argument, xrefs: 00007FFE1321B44C
contiguous buffer, xrefs: 00007FFE1321B445
compress, xrefs: 00007FFE1321B453

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction ID: f4af7284d3223d10cc311a1cb0f0f374cdd833cf374e83a1ffa69c844849599d
Opcode Fuzzy Hash: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction Fuzzy Hash: 61118162B18F8295EB20EB26EA502B9A360FBE8F90F544171E94D63675EF3CD549C700

Function 00007FFE1338855C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

_PyTime_FromSeconds.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE13388573
_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE1338858A
PyErr_SetString.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE133885AD
_PyTime_AsTimeval.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE133885CA
_PyTime_AsMilliseconds.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE133885DD
PyErr_SetString.PYTHON312(?,?,?,00007FFE13386E2F), ref: 00007FFE1338860B

Strings

Timeout value out of range, xrefs: 00007FFE133885A3
timeout doesn't fit into C timeval, xrefs: 00007FFE13388601

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Time_$Err_FromSecondsString$MillisecondsObjectTimeval
String ID: Timeout value out of range$timeout doesn't fit into C timeval
API String ID: 4240314503-2798848688
Opcode ID: c3110628e0ff8c45ed48e6e42bc6a9de53dce8f64d393fbe66996934f00f37bc
Instruction ID: 576e4d18ef0f3351adc7589d3fa11714dd9c4752b1ab6b5f5852da155e90b2f2
Opcode Fuzzy Hash: c3110628e0ff8c45ed48e6e42bc6a9de53dce8f64d393fbe66996934f00f37bc
Instruction Fuzzy Hash: A9110D21B09E428AEB509B6AE49027C2251AB64BB0F1043F5DA3E57BF4DF6CE5C58318

Function 00007FFE133855C4 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

PyErr_GetRaisedException.PYTHON312 ref: 00007FFE133855D1
PyErr_ResourceWarning.PYTHON312 ref: 00007FFE133855F8
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE1338560C
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE13385619
PyEval_SaveThread.PYTHON312 ref: 00007FFE1338562B
closesocket.WS2_32 ref: 00007FFE13385637
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385640

Strings

unclosed %R, xrefs: 00007FFE133855E9

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_$Eval_ExceptionThread$MatchesRaisedResourceRestoreSaveUnraisableWarningWriteclosesocket
String ID: unclosed %R
API String ID: 1660182617-2306019038
Opcode ID: 25b85fd08a291e67ea72e71a9db263f5598e99ae11a4cc00c223ef1659b4300f
Instruction ID: 8ebda6ad915dadd4b66d5457bebcb7bcf13d3400916b193f0e18af35a33fcf1a
Opcode Fuzzy Hash: 25b85fd08a291e67ea72e71a9db263f5598e99ae11a4cc00c223ef1659b4300f
Instruction Fuzzy Hash: 8A01B725A19F4286E6149F23A8040A86361BB59BB4B0813B1DE7F67BF5CF3CD5D5C314

Function 00007FFE13387B9C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 32threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387BAF
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387BC7
getprotobyname.WS2_32 ref: 00007FFE13387BD5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13387BE1
PyErr_SetString.PYTHON312 ref: 00007FFE13387C02

Strings

s:getprotobyname, xrefs: 00007FFE13387BA8
protocol not found, xrefs: 00007FFE13387BF8

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveSizeStringTuple_getprotobyname
String ID: protocol not found$s:getprotobyname
API String ID: 862796068-630402058
Opcode ID: 5e26fb8bbdc9310467d939e6e5269e35e791270880cd3d67430df1cfafc901d3
Instruction ID: 320978e66f54f6cff0836b840baf9a5a2661761f95156a5e11e130b8a6707f05
Opcode Fuzzy Hash: 5e26fb8bbdc9310467d939e6e5269e35e791270880cd3d67430df1cfafc901d3
Instruction Fuzzy Hash: 8F010C65A18E428ADA159B13E94407D6361FBA8BA1F5402F1D96E67E34DF2CD0D48708

Function 00007FFE13388170 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13388183
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE13388199
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133881B4
inet_addr.WS2_32 ref: 00007FFE133881C4
PyErr_SetString.PYTHON312 ref: 00007FFE133881E4

Strings

s:inet_aton, xrefs: 00007FFE1338817C
illegal IP address string passed to inet_aton, xrefs: 00007FFE133881DA
255.255.255.255, xrefs: 00007FFE13388192

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: SizeString$Arg_Bytes_Err_FromParseTuple_inet_addrstrcmp
String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
API String ID: 717551241-4110412280
Opcode ID: 084e9850ab497b4604530a89a794d3b40a20c62355ffc3e93d442b1fc817a547
Instruction ID: 4c28750f38b196c014275f7debcd4cd5177b1de490696a081809fcfc6575fde2
Opcode Fuzzy Hash: 084e9850ab497b4604530a89a794d3b40a20c62355ffc3e93d442b1fc817a547
Instruction Fuzzy Hash: 67014460A08D0389EA009B26EC5407D2771EFA1BB4F6003F1D63DA69B4DF2DD4C9C708

Function 00007FFE133881F0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13388203
PyErr_SetString.PYTHON312 ref: 00007FFE13388226
PyBuffer_Release.PYTHON312 ref: 00007FFE13388231
PyBuffer_Release.PYTHON312 ref: 00007FFE1338824C
inet_ntoa.WS2_32 ref: 00007FFE13388254
PyUnicode_FromString.PYTHON312 ref: 00007FFE1338825D

Strings

packed IP wrong length for inet_ntoa, xrefs: 00007FFE1338821C
y*:inet_ntoa, xrefs: 00007FFE133881FC

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Buffer_ReleaseString$Arg_Err_FromParseSizeTuple_Unicode_inet_ntoa
String ID: packed IP wrong length for inet_ntoa$y*:inet_ntoa
API String ID: 1492101624-3027498899
Opcode ID: a37c0709ab42e32b6aa69015115254f28bf8fa2c783f834efdb7c9b9a77bb895
Instruction ID: f4d9caf4da774e59b72d7e60e94d06acb1e298e2c860e92cef61e54019d779ed
Opcode Fuzzy Hash: a37c0709ab42e32b6aa69015115254f28bf8fa2c783f834efdb7c9b9a77bb895
Instruction Fuzzy Hash: 15012C31A08E428AEB10DF26E8940BD63A0FBA8B64F5402F1D65E67A74DF3CD1C9C714

Function 00007FFE13384F14 Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133841EC: PyErr_SetString.PYTHON312 ref: 00007FFE1338422F

memset.VCRUNTIME140 ref: 00007FFE13384F56

Part of subcall function 00007FFE13385190: WSAGetLastError.WS2_32 ref: 00007FFE13385237
Part of subcall function 00007FFE13385190: WSAGetLastError.WS2_32 ref: 00007FFE1338523F
Part of subcall function 00007FFE13385190: PyErr_CheckSignals.PYTHON312 ref: 00007FFE13385250

SetHandleInformation.KERNEL32 ref: 00007FFE13384FB7
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13384FC3
closesocket.WS2_32 ref: 00007FFE13384FCC
PyLong_FromLongLong.PYTHON312 ref: 00007FFE13384FE2
closesocket.WS2_32 ref: 00007FFE13384FF3

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_$ErrorFromLastLongclosesocket$CheckHandleInformationLong_SignalsStringWindowsmemset
String ID:
API String ID: 205095079-0
Opcode ID: 7e2d04470de31f4351b15ac443bcd17531285cff5ddf6e7177ad4701d4908fb7
Instruction ID: 78a9568132b0097ccdec778b5af66aad367b75a7bc057fc274a7d7068adce33f
Opcode Fuzzy Hash: 7e2d04470de31f4351b15ac443bcd17531285cff5ddf6e7177ad4701d4908fb7
Instruction Fuzzy Hash: DB416571A0CF82C9EA649B13E4443BD63A0FFA4B94F4442B5DA9D26FA9DF3DD0848744

Function 00007FFE1463662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE14636B60
Part of subcall function 00007FFE14636B10: RaiseException.KERNEL32 ref: 00007FFE14636BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE146366C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE14636723

Strings

Bad read pointer - no RTTI data!, xrefs: 00007FFE14636828
Access violation - no RTTI data!, xrefs: 00007FFE1463662A, 00007FFE1463684B
Bad dynamic_cast!, xrefs: 00007FFE14636792
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE14636805

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: a06894c29486aebfa63eba578e0e1a79f0d0e7fb775cb7756f0f01177fd72e93
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: 4C517C62B18E8A92EE30CB66E8D02B96360FF46BACF444471DA4D03775DE3CE949C740

Function 00007FFE126E246C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E24B8
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E24FC
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E2518
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E2567

Strings

Unable to allocate output buffer., xrefs: 00007FFE126E61A2

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction ID: bfdda80056fcdba7902d33f3b71496b8c8dcd606399f2995c3936e0eb15b51b3
Opcode Fuzzy Hash: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction Fuzzy Hash: 2F410CB6A19E0285EB15CF27DDA426927A1FB48FA4F184472CE0D477B5CFB8E891C340

Function 00007FFE126E083C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON312(?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0849

Part of subcall function 00007FFE126E0970: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0988
Part of subcall function 00007FFE126E0970: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0999
Part of subcall function 00007FFE126E0970: PyDict_SetItem.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E09B4

PyErr_Format.PYTHON312(?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E5C50
_Py_Dealloc.PYTHON312(?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E5C6C

Strings

dict_size, xrefs: 00007FFE126E0934
Invalid filter ID: %llu, xrefs: 00007FFE126E5C43
start_offset, xrefs: 00007FFE126E5C87
dist, xrefs: 00007FFE126E5C97

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction ID: fc24e26584ec9f5bc57abd4a0df82b61e5f943415d1bde89ec3a32d0b2468ef0
Opcode Fuzzy Hash: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction Fuzzy Hash: 1A412B31A18E03D1FA24CF57AD941782360EF65BB4F0451B6C62D566F4EFBCA8A5C701

Function 00007FFE14636FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE14637069
GetLastError.KERNEL32(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE14637077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE14637090
LoadLibraryExW.KERNEL32(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE146370A2
FreeLibrary.KERNEL32(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE14637110
GetProcAddress.KERNEL32(?,?,?,00007FFE146371A3,?,?,00000000,00007FFE14636FD4,?,?,?,?,00007FFE14636D11), ref: 00007FFE1463711C

Strings

api-ms-, xrefs: 00007FFE14637089

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: 653b30cff2527360495fe8232a53a2021bfaba85cd95f77617bb2df5d9fc16fd
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: 9531B061B1AF8291EE119B43A8806B523A4FF06FB9F1D8574DD1D0B7A4EF3CE5888350

Function 00007FFE126E6380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE126E4D6B,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E63B8
PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE126E4D6B,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E641B
PyList_Append.PYTHON312(?,?,?,00007FFE126E4D6B,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E642F
_Py_Dealloc.PYTHON312(?,?,?,00007FFE126E4D6B,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E644B
_Py_Dealloc.PYTHON312(?,?,?,00007FFE126E4D6B,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E6464

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE126E63AE
Unable to allocate output buffer., xrefs: 00007FFE126E640D

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction ID: 8f592f760b7e3eff6d21c3ec379c6c04258e2b797cb2d0c0bc81d9ff69ae81e1
Opcode Fuzzy Hash: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction Fuzzy Hash: 0B310522A18F46C5EA14CB27ED4416863A1AB44BF4F1492B1DA6E477F8DFBCE8458300

Function 00007FFE1321C790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1321C7C8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1321C82B
PyList_Append.PYTHON312 ref: 00007FFE1321C83F
_Py_Dealloc.PYTHON312 ref: 00007FFE1321C85B
_Py_Dealloc.PYTHON312 ref: 00007FFE1321C874

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE1321C7BE
Unable to allocate output buffer., xrefs: 00007FFE1321C81D

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction ID: e28e5631c598b421136135fcc259f6810f5e26b85ec5c4c2d2e342db35940053
Opcode Fuzzy Hash: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction Fuzzy Hash: 3E318D36A08F5689EE14AB26EA4422963A4EBA4FF4F104671D92D637F6DF7CE441C300

Function 00007FFE1321222C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE13212257
PyModule_GetState.PYTHON312 ref: 00007FFE13212260
_PyLong_AsInt.PYTHON312 ref: 00007FFE13212297
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE1321B31F

Strings

BZ2Compressor, xrefs: 00007FFE1321B318, 00007FFE1321B338

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Arg_KeywordsLong_ModuleModule_StateType_
String ID: BZ2Compressor
API String ID: 694278274-1096114097
Opcode ID: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction ID: a3c957476710ce37920561fa1558538e5eba401c53ae2a306135645d7e862626
Opcode Fuzzy Hash: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction Fuzzy Hash: F6218271A08F4689EB64AB13AA4017DA3A0EBE9FA0F0841B1DD0D677B2DF7CE455C300

Function 00007FFE126D95F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE126D961D
PyThread_release_lock.PYTHON312 ref: 00007FFE126D9650
PyErr_SetString.PYTHON312 ref: 00007FFE126D9685
PyEval_SaveThread.PYTHON312 ref: 00007FFE126E50C6
PyThread_acquire_lock.PYTHON312 ref: 00007FFE126E50DB
PyEval_RestoreThread.PYTHON312 ref: 00007FFE126E50E4

Strings

Already at end of stream, xrefs: 00007FFE126D967B

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction ID: 5d6b81ac9d18d5ecdd75e364ca7040f0ed16f1fd97f50dd0c19e72c1d4adecad
Opcode Fuzzy Hash: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction Fuzzy Hash: 8F115825A08E8686EA14DB63EC441A96365FB88FE0F1840B2DE4E577B4CF7CE455C300

Function 00007FFE132136D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE13213705
PyThread_release_lock.PYTHON312 ref: 00007FFE13213735
PyErr_SetString.PYTHON312 ref: 00007FFE1321376A

Part of subcall function 00007FFE13213270: memcpy.VCRUNTIME140 ref: 00007FFE132132EE

PyEval_SaveThread.PYTHON312 ref: 00007FFE1321B892
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1321B8A7
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1321B8B0

Strings

End of stream already reached, xrefs: 00007FFE13213760

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemcpy
String ID: End of stream already reached
API String ID: 180092378-3466344095
Opcode ID: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction ID: 84aac944d5c0fdf1d93df34478996553288a64340da03ee2bdb785932232af0d
Opcode Fuzzy Hash: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction Fuzzy Hash: E2113D76A08E4189EA14EB23EA54269A761FBD9FE0F0840B1DE0E63736CF3CE455C300

Function 00007FFE126D9010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126D9036
PyThread_release_lock.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126D9068
PyErr_SetString.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126D9098

Part of subcall function 00007FFE126D8564: PyType_GetModuleState.PYTHON312 ref: 00007FFE126D859D
Part of subcall function 00007FFE126D8564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE126D85B1
Part of subcall function 00007FFE126D8564: PyList_New.PYTHON312 ref: 00007FFE126D85C8
Part of subcall function 00007FFE126D8564: PyEval_SaveThread.PYTHON312 ref: 00007FFE126D8619
Part of subcall function 00007FFE126D8564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE126D8633

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126E4F44
PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126E4F59
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE126D8536), ref: 00007FFE126E4F62

Strings

Compressor has been flushed, xrefs: 00007FFE126D908E

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction ID: 80fd073fd16a2631be5ab4a368728fc8ffbe13f2147d2286ff58ccec9fc2b7e1
Opcode Fuzzy Hash: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction Fuzzy Hash: 79110A21A08E86C6EA54DB23EC442696366FB88FE0F4440B5DE4E57BB4CFBCE455C740

Function 00007FFE132125FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE1321261F
PyThread_release_lock.PYTHON312 ref: 00007FFE1321264B
PyEval_SaveThread.PYTHON312 ref: 00007FFE1321266A
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1321267C
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13212685

Strings

Compressor has been flushed, xrefs: 00007FFE1321B42B

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction ID: acbcd3c14adf9d8ecd820fcfa66bb1321c617d3a2a3b4ec3989df56dd293f95f
Opcode Fuzzy Hash: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction Fuzzy Hash: 4E113D71A08E8285EA14EB13EA54139A360FBD9FE0B045071DE0D63B76CF3CE455C340

Function 00007FFE126E2F1C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE126E2F41
PyThread_release_lock.PYTHON312 ref: 00007FFE126E2F7E
PyErr_SetString.PYTHON312 ref: 00007FFE126E2FA8

Part of subcall function 00007FFE126D8564: PyType_GetModuleState.PYTHON312 ref: 00007FFE126D859D
Part of subcall function 00007FFE126D8564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE126D85B1
Part of subcall function 00007FFE126D8564: PyList_New.PYTHON312 ref: 00007FFE126D85C8
Part of subcall function 00007FFE126D8564: PyEval_SaveThread.PYTHON312 ref: 00007FFE126D8619
Part of subcall function 00007FFE126D8564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE126D8633

PyEval_SaveThread.PYTHON312 ref: 00007FFE126E6274
PyThread_acquire_lock.PYTHON312 ref: 00007FFE126E6289
PyEval_RestoreThread.PYTHON312 ref: 00007FFE126E6292

Strings

Repeated call to flush(), xrefs: 00007FFE126E2F9E

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction ID: b4fdb709c5529c7f144603830d62dbcb0c7722c1f9ffdb694ddc68533af870f2
Opcode Fuzzy Hash: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction Fuzzy Hash: BB112121B18E82C6EA54CB27EC446796365FB84FA0F1440B1DA0E477B4CFBCE455C741

Function 00007FFE1321200C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE13212026
PyThread_release_lock.PYTHON312 ref: 00007FFE1321205E
PyEval_SaveThread.PYTHON312 ref: 00007FFE1321B250
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1321B262
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1321B26B
PyErr_SetString.PYTHON312 ref: 00007FFE1321B288

Part of subcall function 00007FFE13212C08: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13212C47
Part of subcall function 00007FFE13212C08: PyList_New.PYTHON312 ref: 00007FFE13212C5E
Part of subcall function 00007FFE13212C08: PyEval_SaveThread.PYTHON312 ref: 00007FFE13212CCC
Part of subcall function 00007FFE13212C08: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13212CE6

Strings

Repeated call to flush(), xrefs: 00007FFE1321B27E

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction ID: ff4741cd988ed4f270a553e3af643d3a640260f2b3d54284c4517650a27f5830
Opcode Fuzzy Hash: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction Fuzzy Hash: 93115131A08E5286FA14AB13EA54179A360FBE9FA0F044171DA0D53B76CF7CE495C340

Function 00007FFE133880E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13388102
if_nametoindex.IPHLPAPI ref: 00007FFE1338811E
_Py_Dealloc.PYTHON312 ref: 00007FFE13388136
PyErr_SetString.PYTHON312 ref: 00007FFE13388151

Strings

O&:if_nametoindex, xrefs: 00007FFE133880FB
no interface with this name, xrefs: 00007FFE13388147

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_DeallocErr_ParseSizeStringTuple_if_nametoindex
String ID: O&:if_nametoindex$no interface with this name
API String ID: 3052430728-3835682882
Opcode ID: 3ac5c3a51fb341192d0c4d14695c2bd4c19b6b6ccdf855b40aa773fc1d6a75dc
Instruction ID: e748c68fb8d92401e752e89b1e3155bb2983695c8c53b8bc7cf63b1c45130dc9
Opcode Fuzzy Hash: 3ac5c3a51fb341192d0c4d14695c2bd4c19b6b6ccdf855b40aa773fc1d6a75dc
Instruction Fuzzy Hash: 33011E61A08E0389EB109F23F88017D2360BFA9BA4F5016F1C56E67A71DF7DE4C48708

Function 00007FFE13387E48 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387E5B
PyErr_SetString.PYTHON312 ref: 00007FFE13387E7E
htons.WS2_32 ref: 00007FFE13387E99
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE13387EA2

Strings

htons: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE13387E90
i:htons, xrefs: 00007FFE13387E54
htons: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE13387E6D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: htons: Python int too large to convert to C 16-bit unsigned integer$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
API String ID: 1102113319-997571130
Opcode ID: 6fe04cd82cc3000d18dcf2e81bb2daf4d1c2563f8a0b84c539f7a4416ede929e
Instruction ID: f1f9f06c95b5a2160bb5b4956841543a41aa4b8908fb26eefd93f294dca6f1a2
Opcode Fuzzy Hash: 6fe04cd82cc3000d18dcf2e81bb2daf4d1c2563f8a0b84c539f7a4416ede929e
Instruction Fuzzy Hash: 93F01D61A08E4389EA158B57E89017C3362BF65BA5F9006F5C56E66DB0CF2CF8D8D318

Function 00007FFE133884F4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13388507
PyErr_SetString.PYTHON312 ref: 00007FFE1338852A
htons.WS2_32 ref: 00007FFE13388545
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1338854E

Strings

i:ntohs, xrefs: 00007FFE13388500
ntohs: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE1338853C
ntohs: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE13388519

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: i:ntohs$ntohs: Python int too large to convert to C 16-bit unsigned integer$ntohs: can't convert negative Python int to C 16-bit unsigned integer
API String ID: 1102113319-2476431691
Opcode ID: 89a767ad913e0f8faf4df47f62d0b46607f468db7b7541010cbad5f5dbaaabd7
Instruction ID: 08453a17e30d474a1425e3d544c2289ce16dd8bf7ac1c6fbe0a392e2d5acce76
Opcode Fuzzy Hash: 89a767ad913e0f8faf4df47f62d0b46607f468db7b7541010cbad5f5dbaaabd7
Instruction Fuzzy Hash: 68F036A0E0DE4389EA548B17F85017C2360BF65761F9006F5C52E6AD74DF2CE5C8D318

Function 00007FFE14632E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632EF5
__AdjustPointer.LIBCMT ref: 00007FFE14632F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632F43
__AdjustPointer.LIBCMT ref: 00007FFE14632F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632FE0

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction ID: 3d13735837b67a25e2f227b1d7c05ed0aa94c2cb5a6ea284c535f53778f0a18c
Opcode Fuzzy Hash: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction Fuzzy Hash: 8051C221A49EC681EE65DF1394C46386394AF46FACF1980B9EA4D077B5DF3CE489C380

Function 00007FFE14632C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632D0E
__AdjustPointer.LIBCMT ref: 00007FFE14632D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632D5C
__AdjustPointer.LIBCMT ref: 00007FFE14632D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632DF9

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction ID: 9240ab2772df847c2ef41766da282f764287d4a0d718f8b223f2e4677533c996
Opcode Fuzzy Hash: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction Fuzzy Hash: 8B51B171A09E9681FEA59B17D4C46396394AF46FACB0940B6CE4D067F5DF3CE44AC380

Function 00007FFE1463EB88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463EBFC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463EC0B

Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE4D
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE86
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463ECAB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463ECBB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463ED67

Strings

{for , xrefs: 00007FFE1463EC34

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction ID: 8a1f58dca8d6b8df0ef954535dfbc4ae9541f7c4689815624ecd80667b4825d2
Opcode Fuzzy Hash: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction Fuzzy Hash: 67515F72A08E859DEB019F66D8813E837A0EB4676CF4490B2EA4D07BA5DF7CE558C350

Function 00007FFE126D8564 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE126D859D
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE126D85B1
PyList_New.PYTHON312 ref: 00007FFE126D85C8
PyEval_SaveThread.PYTHON312 ref: 00007FFE126D8619
PyEval_RestoreThread.PYTHON312 ref: 00007FFE126D8633
_Py_Dealloc.PYTHON312 ref: 00007FFE126E4DB2
_Py_Dealloc.PYTHON312 ref: 00007FFE126E4E04

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction ID: 3c59f3fc4537e4b66b67ba740284f7cc472fc5b689647518d56ce96e771522e3
Opcode Fuzzy Hash: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction Fuzzy Hash: 09516126A09F5A86EA609B27DD4417923A0FF48B70F540275DE9D43BE0DFBCE851C340

Function 00007FFE13219C6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE13219CC8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13219D03
memcpy.VCRUNTIME140 ref: 00007FFE13219D47
_Py_Dealloc.PYTHON312 ref: 00007FFE13219D63

Strings

Unable to allocate output buffer., xrefs: 00007FFE1321C6EA

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction ID: efca35ae231ec3fee4f180ec8cb1789e938bbb655fb0c86027553ddbf91ba0e5
Opcode Fuzzy Hash: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction Fuzzy Hash: DF417C76B09E0289EB19AF17C64026873A0FBA9FA4F184072CE4D63776CF79E491C340

Function 00007FFE1463E174 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE1463D86D), ref: 00007FFE1463E238
DName::DName.LIBVCRUNTIME ref: 00007FFE1463E257

Strings

`template-parameter, xrefs: 00007FFE1463E265
void, xrefs: 00007FFE1463E1BA

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction ID: 93353bb7bc83ab6704e5a15351e5491d77cd75896b8b6cc444f94a7072b7ae81
Opcode Fuzzy Hash: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction Fuzzy Hash: 51413922B08F9698FB00DBA2D8912AC33A1BB4A7A8F545175DE0C16769DF7CA549C380

Function 00007FFE14638EC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE14638D3C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE14638DFD

DName::operator+.LIBVCRUNTIME ref: 00007FFE14638F72

Strings

,..., xrefs: 00007FFE14638F40
<ellipsis>, xrefs: 00007FFE14638FBF
void, xrefs: 00007FFE14638FE4
..., xrefs: 00007FFE14638FAF
,<ellipsis>, xrefs: 00007FFE14638F50

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction ID: a45a710232e0504deb0367180059944db467b0dc2337bf537fe57dada0da6102
Opcode Fuzzy Hash: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction Fuzzy Hash: EB413A75E08F8A9DFB018B66D8902B837E1BB0639CF4855B5DA4C12375DF7CA549C780

Function 00007FFE1463ACC4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463ADA7

Strings

short , xrefs: 00007FFE1463AD44
char , xrefs: 00007FFE1463AD4D
unsigned , xrefs: 00007FFE1463AD7B
long , xrefs: 00007FFE1463AD26
int , xrefs: 00007FFE1463AD35

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction ID: 760f7b1b0e177612825a5c25bf540fc3165e1d50832a4f6839ed854d4a91bbcb
Opcode Fuzzy Hash: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction Fuzzy Hash: B3315E32E18E9588EB018F6AD8901BC37A0FB0675DF448172DA4C06B78DF7CA508D740

Function 00007FFE132122D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,00000009,00007FFE132122B2), ref: 00007FFE132122FC
_Py_Dealloc.PYTHON312(?,?,00000009,00007FFE132122B2), ref: 00007FFE1321B378

Part of subcall function 00007FFE13212078: memset.VCRUNTIME140 ref: 00007FFE132121CD

_Py_Dealloc.PYTHON312 ref: 00007FFE1321B3A4
PyErr_SetString.PYTHON312(?,?,00000009,00007FFE132122B2), ref: 00007FFE1321B3C1

Strings

compresslevel must be between 1 and 9, xrefs: 00007FFE1321B3B7
Unable to allocate lock, xrefs: 00007FFE1321B385

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Dealloc$Err_StringThread_allocate_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 451674277-2500606449
Opcode ID: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction ID: 2a60dbcf6a911f54699f7ea15b7f5860b2222cdf0b1578127eca6d75e78008de
Opcode Fuzzy Hash: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction Fuzzy Hash: F8213D31A08F0389EB15BB26EA4427863A8AFF9B64F1440B1D60D622B6DF7CE455C300

Function 00007FFE13213838 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,?,00007FFE13213810), ref: 00007FFE1321384E
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13213881
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13213810), ref: 00007FFE1321B8EC
PyErr_SetString.PYTHON312(?,?,?,00007FFE13213810), ref: 00007FFE1321B903
_Py_Dealloc.PYTHON312 ref: 00007FFE1321B925

Strings

Unable to allocate lock, xrefs: 00007FFE1321B8F9

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: DeallocString$Bytes_Err_FromSizeThread_allocate_lock
String ID: Unable to allocate lock
API String ID: 553681934-3516605728
Opcode ID: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction ID: 32e442220eb21c8d157d18931e872b476f0fc31cc4e41f0feae25e34d998a9c4
Opcode Fuzzy Hash: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction Fuzzy Hash: B9211231E09F03C9FB557F36EA553B822A5AFA8B69F0444B5CA0D552B6DFBCA448C310

Function 00007FFE133876FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13387738
PySys_Audit.PYTHON312 ref: 00007FFE13387757
PyMem_Free.PYTHON312 ref: 00007FFE13387798

Strings

idna, xrefs: 00007FFE13387725
socket.gethostbyname, xrefs: 00007FFE13387750
et:gethostbyname, xrefs: 00007FFE1338772F

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Arg_AuditFreeMem_ParseSizeSys_Tuple_
String ID: et:gethostbyname$idna$socket.gethostbyname
API String ID: 3195760359-1353326193
Opcode ID: d320ddd8cf467191825d76107121f03e2110b40a9b42c9140a73192e072f53c4
Instruction ID: 72081e306dba972b3197ad3793a880fe6fe635771dd9b9ece3f8ba3779d815d5
Opcode Fuzzy Hash: d320ddd8cf467191825d76107121f03e2110b40a9b42c9140a73192e072f53c4
Instruction Fuzzy Hash: 2A117521718E4289E7109B23F4401AE6361FFA8BE4F4002B5FA6E67E74DE3CE181C704

Function 00007FFE126E1F4C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE126E1F88
PyMem_Calloc.PYTHON312 ref: 00007FFE126E1F9A
PyErr_SetString.PYTHON312 ref: 00007FFE126E1FCB
PyErr_NoMemory.PYTHON312 ref: 00007FFE126E1FD5

Strings

Invalid filter specifier for delta filter, xrefs: 00007FFE126E1FC1
|OO&, xrefs: 00007FFE126E1F79

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction ID: 5b2bafb7fcde3f371cee35163200ed7f5261b88e8d0ee7554c601d4a5af8d905
Opcode Fuzzy Hash: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction Fuzzy Hash: 3B110575A09E03DAEB00CB22EC546A933A4FB44B65F5041B6CA0D473B0DFBDE80AD780

Function 00007FFE126E1EC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE126E1EF9
PyMem_Calloc.PYTHON312 ref: 00007FFE126E1F0B
PyErr_SetString.PYTHON312 ref: 00007FFE126E1F38
PyErr_NoMemory.PYTHON312 ref: 00007FFE126E1F42

Strings

Invalid filter specifier for BCJ filter, xrefs: 00007FFE126E1F2E
|OO&, xrefs: 00007FFE126E1EDF

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction ID: 9e42e07199d34665a9f9f1bc934754ec1007c5b52a20c525e1690d6b997c853b
Opcode Fuzzy Hash: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction Fuzzy Hash: 5E01D775A08F42D9EB00CB26EC441A933A4FB44B64F5001B5D61D477B0DFBCE909D791

Function 00007FFE13388484 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE133884A1
PyErr_Occurred.PYTHON312 ref: 00007FFE133884AE
htonl.WS2_32 ref: 00007FFE133884C7
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE133884CF
PyErr_Format.PYTHON312 ref: 00007FFE133884EC

Strings

expected int, %s found, xrefs: 00007FFE133884DE

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: 1cbb25d059c373463275cb9141ec41ce007bb3d03350516039de7c41e169b97a
Instruction ID: 98e8838a17c14525f9bfa0a7182a419337ea3258abcbdc95e2958934ef6d7270
Opcode Fuzzy Hash: 1cbb25d059c373463275cb9141ec41ce007bb3d03350516039de7c41e169b97a
Instruction Fuzzy Hash: F9F03161A09E42CAEA549B63A88417D2760BF69B75F1407F5D52F67AB0CF3CE4C8C308

Function 00007FFE13387DD8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE13387DF5
PyErr_Occurred.PYTHON312 ref: 00007FFE13387E02
htonl.WS2_32 ref: 00007FFE13387E1B
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE13387E23
PyErr_Format.PYTHON312 ref: 00007FFE13387E40

Strings

expected int, %s found, xrefs: 00007FFE13387E32

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: b2daa29250e1f6628aa8a96a2420fefb0829875c2a9b427d46b77ebb6b88cbc8
Instruction ID: 640b7168aaa2a0b144ecc16b369deb1bf847166c8e4c8614046aab8836abdd93
Opcode Fuzzy Hash: b2daa29250e1f6628aa8a96a2420fefb0829875c2a9b427d46b77ebb6b88cbc8
Instruction Fuzzy Hash: 5BF01260A08E42CAEA559B23A84517C6361BF69B75F1407F5D52F63AB0DF2CE8E8C314

Function 00007FFE1321C8E4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321C8F1

Part of subcall function 00007FFE1321C8A0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FFE1321B152), ref: 00007FFE1321C8D6

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321C91D
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1321C937

Strings

*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFE1321C926
bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFE1321C904
1.0.8, 13-Jul-2019, xrefs: 00007FFE1321C8F7

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction ID: 612e2317682c7aab4957931043bb837a8ffcdb8a8bf22b40e44e6c4691ee8907
Opcode Fuzzy Hash: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction Fuzzy Hash: 1EE0ED24A18D164AFA187763E9852785211AFF4B60F4000B9C90E272B39E6C6809C382

Function 00007FFE1463ADEC Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1463AE9E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AEAE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AECB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AF3E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463AF67

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction ID: c339776111e2a42692d45adef4fd306960abb42f2064bf35392c27b2837b1fe7
Opcode Fuzzy Hash: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction Fuzzy Hash: 88717A76E08E8689EB01CB92D8802BC37A1BB46768F548175EA0D177A6CF3CE449C380

Function 00007FFE13212C08 Relevance: 9.1, APIs: 6, Instructions: 114threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13212C47
PyList_New.PYTHON312 ref: 00007FFE13212C5E
PyEval_SaveThread.PYTHON312 ref: 00007FFE13212CCC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13212CE6
_Py_Dealloc.PYTHON312 ref: 00007FFE1321B5CD
_Py_Dealloc.PYTHON312 ref: 00007FFE1321B61C

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction ID: b9ed16ca4e913d5f845785f4e32c9ff1016bb98a8f2b9ff70bd5c918d8d61ba8
Opcode Fuzzy Hash: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction Fuzzy Hash: A741A372E18F428AEA65AB23D60027962A0FBE9B70F140675DE4D637A6DF3CE450C740

Function 00007FFE146369F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE14636A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14636A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE14636AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE14636ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14636AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE14636AE2

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction ID: 93f7091552bb14510493558425dbf8f8707f54f96b4b9ba048e04e7bd7651081
Opcode Fuzzy Hash: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction Fuzzy Hash: 7531D522B19F9590EA25DF17984416933A0FF0AFF8B598571DD2D037A0EE3DD859C340

Function 00007FFE126E0970 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0988
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E0999
PyDict_SetItem.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E09B4
_Py_Dealloc.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E5CBE
_Py_Dealloc.PYTHON312(?,?,?,00007FFE126E086D,?,?,?,00007FFE126E081A,?,?,?,?,?,00007FFE126E07A5), ref: 00007FFE126E5CD7

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction ID: 1da029384fee89260496bcf0ef8e57f90a3000b079a160d9e903536a42119451
Opcode Fuzzy Hash: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction Fuzzy Hash: B8112E21D0CE4386FA158F23AD582392290AF69BF5F0860B1D90E567F5DFBCA8418701

Function 00007FFE133846B0 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE1338446A), ref: 00007FFE133846C4
ioctlsocket.WS2_32 ref: 00007FFE133846E9
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE1338446A), ref: 00007FFE133846F6
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE1338446A), ref: 00007FFE13384700
WSAGetLastError.WS2_32(?,?,?,00007FFE1338446A), ref: 00007FFE13384706
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFE1338446A), ref: 00007FFE13384718

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
String ID:
API String ID: 863680558-0
Opcode ID: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction ID: f8e9ddcbb8e670a8ee978cf68bc519c6c33987fd64c1642acd1b25b2ff4cff47
Opcode Fuzzy Hash: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction Fuzzy Hash: 34012C21A19E428AE3509B77F84406E63A0EF98BB1B5042B1EA6E63F74DE2CD4D58704

Function 00007FFE1338701C Relevance: 9.0, APIs: 6, Instructions: 32threadnetworkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON312 ref: 00007FFE13387025
PyErr_Occurred.PYTHON312 ref: 00007FFE13387034
PyEval_SaveThread.PYTHON312 ref: 00007FFE13387048
closesocket.WS2_32 ref: 00007FFE13387054
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1338705F
WSAGetLastError.WS2_32 ref: 00007FFE1338706E

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_LongThread$Err_ErrorLastLong_OccurredRestoreSaveclosesocket
String ID:
API String ID: 586723380-0
Opcode ID: 88cad95bcb5dfa4951526296af0bf2ff21b88eb4dabe66cc17352eaa9c495d40
Instruction ID: 90a60e4bf5f818a3b8c18b134d451a3401ed8f2bda612881e71b604dda707115
Opcode Fuzzy Hash: 88cad95bcb5dfa4951526296af0bf2ff21b88eb4dabe66cc17352eaa9c495d40
Instruction Fuzzy Hash: 4AF03150A1DE0389FA5567A3694807C1256AF34BB1F0417F4C93E62FF0DE2CE1D48218

Function 00007FFE14633F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

EncodePointer.KERNEL32 ref: 00007FFE14633FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1463401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1463424E

Strings

RCC, xrefs: 00007FFE14633FEC
MOC, xrefs: 00007FFE14633FE4

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction ID: dffcc3411f39d0760e55b9d4f57cc736afc16d6ea003f1edb2453ab911b64b28
Opcode Fuzzy Hash: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction Fuzzy Hash: B391D377A08B918AE710CF66E8802ADBBA0FB4579CF144139EE8C17769DF38D199C740

Function 00007FFE1463C540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463C7E0

Strings

std::nullptr_t, xrefs: 00007FFE1463C799
std::nullptr_t , xrefs: 00007FFE1463C770
volatile , xrefs: 00007FFE1463C5A7, 00007FFE1463C6D8
volatile, xrefs: 00007FFE1463C5B6, 00007FFE1463C6E7

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction ID: b584d3018efed4078b35d0bd52ca213aee10e2c4e22961a7cb3e6f77bceaf736
Opcode Fuzzy Hash: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction Fuzzy Hash: AE716077A08F8688EB149F27D9940BC27A0BB077A8F4455B5E94D42B79DF3CE168C380

Function 00007FFE14633CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

EncodePointer.KERNEL32 ref: 00007FFE14633D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE14633D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14633F57

Strings

MOC, xrefs: 00007FFE14633D63
RCC, xrefs: 00007FFE14633D6B

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction ID: 5fdf940f87476c53527a522a851ad4eaaba9872986cb7d85bd8ad3e54f7641ca
Opcode Fuzzy Hash: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction Fuzzy Hash: 83619572908FC581D7618F16E4803AAB7A0FB867A8F444265EB8D47B65DF7CD1D8CB40

Function 00007FFE14635C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE14635D22

Strings

csm, xrefs: 00007FFE14635DDF
MOC, xrefs: 00007FFE14635C90
csm, xrefs: 00007FFE14635CB2
RCC, xrefs: 00007FFE14635C9C

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction ID: 0c6ff5ed0410d2e0edfa9987f6d3cb4b45e9544eb7663d32a6b11dcebddbf9a7
Opcode Fuzzy Hash: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction Fuzzy Hash: 5A51A372A09E9286EA609F2791C017D3AA0FF46B6CF140076DE4D47761DF3CF8698B81

Function 00007FFE132139F4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

{0x%08x, 0x%08x}, xrefs: 00007FFE1321B9DD
combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFE1321BA31

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction ID: 463eb8ab84c57e3c6275001c0ddb606d9e838e34e71b9afa33e0cb859fe97d97
Opcode Fuzzy Hash: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction Fuzzy Hash: 3941DC31A0CD428EFB64AF36964027862A2DBE4B34F145275DA0EA73E7CF3CA841C750

Function 00007FFE126E0A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON312(00000000,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0A94
PySequence_GetItem.PYTHON312(?,00000000,00007FFE126E0A18), ref: 00007FFE126E0AC7

Part of subcall function 00007FFE126E0B5C: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0B81
Part of subcall function 00007FFE126E0B5C: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0B9B
Part of subcall function 00007FFE126E0B5C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0BB0
Part of subcall function 00007FFE126E0B5C: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE126E0AE3,?,00000000,00007FFE126E0A18), ref: 00007FFE126E0BC7

PyErr_Format.PYTHON312(?,00000000,00007FFE126E0A18), ref: 00007FFE126E5D09

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFE126E5CF9

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction ID: 1093e193a36dbb9e8ffdc07ce374e8b56a492188f4574cfff7ba0548461c636d
Opcode Fuzzy Hash: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction Fuzzy Hash: 7C317F21B08E4685EA54DB1BAC441796691BB45FF8F1443B1DD3D277F5EEBCE4468300

Function 00007FFE126E20DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FFE126E2132
PyErr_Format.PYTHON312 ref: 00007FFE126E60C4

Strings

Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFE126E6117
Invalid compression preset: %u, xrefs: 00007FFE126E60BA

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction ID: ed0f668ae9311862849ebf5f65e64604a17b04d6e32b125ef34f2a1302eeedeb
Opcode Fuzzy Hash: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction Fuzzy Hash: A9219121A1CE4685EE20DB27EC853B92351BF89BB4F4012B1DA5E476F6DEACE9058700

Function 00007FFE13213774 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE132137A3
PyModule_GetState.PYTHON312 ref: 00007FFE132137AC
_PyArg_NoPositional.PYTHON312 ref: 00007FFE132137DC
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE132137FE

Strings

BZ2Decompressor, xrefs: 00007FFE132137D5, 00007FFE132137F7

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Arg_$KeywordsModuleModule_PositionalStateType_
String ID: BZ2Decompressor
API String ID: 2980520244-1337346095
Opcode ID: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction ID: f4f13ee9781146fc35560564ef3595017326bd158af345d28d1ac873cc110845
Opcode Fuzzy Hash: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction Fuzzy Hash: D3216232A08E4288EA50AF13EA00179A7A1FBA4FE4F494071DE4D27376DF7CE485C700

Function 00007FFE13381060 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON312 ref: 00007FFE1338106D
_Py_Dealloc.PYTHON312 ref: 00007FFE133810AD

Strings

_socket.CAPI, xrefs: 00007FFE13381066

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Capsule_DeallocPointer
String ID: _socket.CAPI
API String ID: 898671391-3774308389
Opcode ID: 147324779042020adf52fa7f054c0f0e2125f6212a673ba3a80a163640bf1b1a
Instruction ID: 47c19940c017cf9b093175b18623cd37105bf48e604c5a505718f147ab49a945
Opcode Fuzzy Hash: 147324779042020adf52fa7f054c0f0e2125f6212a673ba3a80a163640bf1b1a
Instruction Fuzzy Hash: 0A01C472E09D428DEA554F27CC5427C2264AB65B35F5442F0CA6E65AB1CF7DA8C28308

Function 00007FFE148B10E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE148B10ED
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE148B10FD
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE148B111F

Strings

error, xrefs: 00007FFE148B1112
close, xrefs: 00007FFE148B10F3

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction ID: d3aa770a5a03c67fbf9b1c93530b5882f3975cb4c5633f52497959ef6b1beb41
Opcode Fuzzy Hash: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction Fuzzy Hash: 56F03A21A09F47D5EA158B66F8840692368BF0ABA4B444176FE1D463B1DE3CE45D8300

Function 00007FFE13384ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,00000002,00007FFE13384E84), ref: 00007FFE13384AD7
PyErr_SetObject.PYTHON312(?,?,00000002,00007FFE13384E84), ref: 00007FFE13384AEC
_Py_Dealloc.PYTHON312(?,?,00000002,00007FFE13384E84), ref: 00007FFE13384B00

Strings

(is), xrefs: 00007FFE13384AD0
getaddrinfo failed, xrefs: 00007FFE13384AC9

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$getaddrinfo failed
API String ID: 3413694139-582941868
Opcode ID: c34809af6fe48c3d98dc105baad316adadc833bdd741b3991c46394a393d3a53
Instruction ID: a207764a78b2e0b1b342e02319a594df9588451ea8969aae9f77132fe45d48d0
Opcode Fuzzy Hash: c34809af6fe48c3d98dc105baad316adadc833bdd741b3991c46394a393d3a53
Instruction Fuzzy Hash: B8F05421A09E0386EA058B22F9481AD23A0EF58B65F4441F5C96D67E74EE3CD4C4C304

Function 00007FFE13384B14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B2F
PyErr_SetObject.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B44
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13383B5A), ref: 00007FFE13384B58

Strings

(is), xrefs: 00007FFE13384B28
host not found, xrefs: 00007FFE13384B21

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$host not found
API String ID: 3413694139-3306034047
Opcode ID: e90ec528a1d937703f33ea49ca5fade7d46b30f37fbc55b9918f483f3cce63c4
Instruction ID: 87ee9ad60bbd0f5213ffd4476ae6bc7b3a646b71ca403b2434c78fa872e05749
Opcode Fuzzy Hash: e90ec528a1d937703f33ea49ca5fade7d46b30f37fbc55b9918f483f3cce63c4
Instruction Fuzzy Hash: 71F0FE21A09E4689EA154B63F8482AD63A0EF68BB4F4442F5CA7D66E74DE3CD4C58304

Function 00007FFE1463A920 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1463A99B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A9BD
DName::DName.LIBVCRUNTIME ref: 00007FFE1463A9CC
DName::DName.LIBVCRUNTIME ref: 00007FFE1463AA03
DName::DName.LIBVCRUNTIME ref: 00007FFE1463AA0E

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction ID: 8bca26998280529ea66f493817bea121303509cfc05d0b70d8ddd7d992b2c980
Opcode Fuzzy Hash: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction Fuzzy Hash: C8417336E18E9698EB00DB62D8D01BC3774BF167A8B9440B2D94D137A5DF3CE459D380

Function 00007FFE148B27F8 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FFE148B281E
PyList_New.PYTHON312(00007FFDFB2FD290,?,?,00007FFE148B22E5), ref: 00007FFE148B2844
__WSAFDIsSet.WS2_32 ref: 00007FFE148B2870
PyList_SetItem.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B288A
_Py_Dealloc.PYTHON312(?,?,00007FFE148B22E5), ref: 00007FFE148B28D1

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction ID: f74ede8ca6e6e52354b3b8b3b755cd03a8274cd0d460c03eab9420e599c7c69e
Opcode Fuzzy Hash: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction Fuzzy Hash: 17218032A18F429AEB248F13E4882A977A4FB4ABA1F444575DF8D43760DF3DE559C340

Function 00007FFE148B1070 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE148B1086
_Py_Dealloc.PYTHON312 ref: 00007FFE148B2196

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction ID: cb63092eb1be9a8be0ea715c2a9038da57e896904a5e1b598dbcf6b05f7b7f93
Opcode Fuzzy Hash: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction Fuzzy Hash: A021FE31D09E92CDFB555F72888837832A8BB57B69F1441B0E60E4A3A1CF7DA44E8701

Function 00007FFE126E314C Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE126E315A
_Py_Dealloc.PYTHON312 ref: 00007FFE126E31CF
_Py_Dealloc.PYTHON312 ref: 00007FFE126E31D7
_Py_Dealloc.PYTHON312 ref: 00007FFE126E629E

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction ID: 208d91202d73a09c0e80a0bb9002122a8ae6b7becf59c9fb5d5ef8355484bc56
Opcode Fuzzy Hash: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction Fuzzy Hash: 7C21BD3691AE0289FB69CF76CC583B832A0AF45B29F1844B8C50D491F4CFBDA8658350

Function 00007FFE13219F74 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE13219F86
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13219F9C
PyModule_AddType.PYTHON312 ref: 00007FFE13219FB2
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13219FC9
PyModule_AddType.PYTHON312 ref: 00007FFE13219FDE

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction ID: e1cdb6ab02086b56a187a07c17fec283c22e47c74743a97736ed5abf8c6bb5ec
Opcode Fuzzy Hash: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction Fuzzy Hash: BE019231B19F5285FA60AB17BA8463AA394AF99FE0B444470EE4D26775DF3CE444C700

Function 00007FFE13386E64 Relevance: 7.5, APIs: 5, Instructions: 39threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE13386E94
PyEval_SaveThread.PYTHON312 ref: 00007FFE13386EAA
WSADuplicateSocketW.WS2_32 ref: 00007FFE13386EC0
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13386ECB

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_DuplicateParseRestoreSaveSizeSocketTuple_
String ID:
API String ID: 3898289384-0
Opcode ID: c8e2bad8f66a6fb79bb8ed3b2e5e97b1d887adf2b3fc17a41d9c2dd7865fadd9
Instruction ID: 4185aea22676f683e9e68f61ac39e179da6af9ab4ddf4e06fd9b7a277af893ab
Opcode Fuzzy Hash: c8e2bad8f66a6fb79bb8ed3b2e5e97b1d887adf2b3fc17a41d9c2dd7865fadd9
Instruction Fuzzy Hash: CC110361A18F85C6EA219B62E5483AD6354FF647B4F4002F1D96E53BB4DF3CE0858604

Function 00007FFE13386F10 Relevance: 7.5, APIs: 5, Instructions: 33threadCOMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON312 ref: 00007FFE13386F20
PyErr_Occurred.PYTHON312 ref: 00007FFE13386F2D
PyEval_SaveThread.PYTHON312 ref: 00007FFE13386F41
shutdown.WS2_32 ref: 00007FFE13386F50
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13386F5B

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_Long_OccurredRestoreSaveshutdown
String ID:
API String ID: 24305128-0
Opcode ID: 6516a418a14a859acfa3d73bcf82298d2a1ff85a94d003fe5974aec2db2ce4ef
Instruction ID: fc8a5b6bc99c801779f16d0c91fa3b1fdf7663345bc2090bb728c532a42460c4
Opcode Fuzzy Hash: 6516a418a14a859acfa3d73bcf82298d2a1ff85a94d003fe5974aec2db2ce4ef
Instruction Fuzzy Hash: 2E01FB21B18F428AEA509B63B58417D6360AFA8BB0F0447F0DA6E53F74DF2CE8C59214

Function 00007FFE13387EB0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE13387ECE
PyErr_Occurred.PYTHON312 ref: 00007FFE13387EDB
if_indextoname.IPHLPAPI ref: 00007FFE13387EED
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE13387F02
PyUnicode_DecodeFSDefault.PYTHON312 ref: 00007FFE13387F11

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_$DecodeDefaultErrnoFromLongLong_OccurredUnicode_Unsignedif_indextoname
String ID:
API String ID: 2382930745-0
Opcode ID: 3cc25d69238de96e231579351c1bec566e97787018e5fdd4677d39b8f471e047
Instruction ID: 31f713636a6500521f97566c528d48077bb5b3cd47c89094deb0f19ffa99ca40
Opcode Fuzzy Hash: 3cc25d69238de96e231579351c1bec566e97787018e5fdd4677d39b8f471e047
Instruction Fuzzy Hash: 81011761A19E4589FA219B33E8943BD2391AFAC774F4007F4C97E56BB0DF2CE594C604

Function 00007FFE13212358 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1321B3D3

Strings

block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFE1321B3DE
final combined CRC = 0x%08x , xrefs: 00007FFE1321B40F

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction ID: 372b7165806d3ab71fb35618ee2421c0089456c446a57cef80ac34e49f0b868d
Opcode Fuzzy Hash: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction Fuzzy Hash: 82610576B18B168AE620FF2B95052BA3361EBD6F94F145075DE0A17367CE7DE402CB80

Function 00007FFE1463470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1463488B

Strings

csm, xrefs: 00007FFE1463475B
, xrefs: 00007FFE146347DC
csm, xrefs: 00007FFE146348C5

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction ID: c91c17722d3083782e6fb8953473d169881d8c4bc062f0c8746f2b27a8b208e4
Opcode Fuzzy Hash: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction Fuzzy Hash: BE71C236908AC186DB618F26D4D037DBBA0FB46BACF048175DA8D07BA9CB3CD459C780

Function 00007FFE146344E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE146345DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE146345EB

Strings

csm, xrefs: 00007FFE1463452E
csm, xrefs: 00007FFE1463463D

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction ID: 1e418abd2ac838270279053a8cef1d01eb816ae3b36cb8d559e8b7834147af7a
Opcode Fuzzy Hash: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction Fuzzy Hash: 4351A67AA08AC286EB648F1395C4368B790FB52BBCF145175DA4D47BA5CF3CE894CB40

Function 00007FFE1463B118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1463B172

Strings

%lf, xrefs: 00007FFE1463B1AD, 00007FFE1463B1E1, 00007FFE1463B211

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction ID: bed18067989b109c02ae07bc5f0ffff0b2234bc75e109c6fd933e7d4aeaf9616
Opcode Fuzzy Hash: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction Fuzzy Hash: 8831CA31A0CF8A85EA11DB13A8911F97360BF57BA8F444276E98D43776DE3CE509C744

Function 00007FFE13385450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13383DD0: PyErr_Format.PYTHON312 ref: 00007FFE13384154

PySys_Audit.PYTHON312 ref: 00007FFE133854A8

Part of subcall function 00007FFE13384484: PyEval_SaveThread.PYTHON312 ref: 00007FFE133844A2
Part of subcall function 00007FFE13384484: connect.WS2_32 ref: 00007FFE133844B5
Part of subcall function 00007FFE13384484: PyEval_RestoreThread.PYTHON312 ref: 00007FFE133844C0
Part of subcall function 00007FFE13384484: WSAGetLastError.WS2_32 ref: 00007FFE133844CE
Part of subcall function 00007FFE13384484: WSAGetLastError.WS2_32 ref: 00007FFE133844DA
Part of subcall function 00007FFE13384484: PyErr_CheckSignals.PYTHON312 ref: 00007FFE133844E7
Part of subcall function 00007FFE13384484: WSASetLastError.WS2_32 ref: 00007FFE13384501

PyLong_FromLong.PYTHON312 ref: 00007FFE133854CD

Strings

socket.connect, xrefs: 00007FFE133854A1
connect_ex, xrefs: 00007FFE1338546F

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatFromLongLong_RestoreSaveSignalsSys_connect
String ID: connect_ex$socket.connect
API String ID: 3879675179-935070752
Opcode ID: 414937b2a6d92fbc3da88fc1208311d46d9418bcea39934cf64ea2bb9134626d
Instruction ID: 627696768130ef758e7844242569e4ced1d5ad2faefdb1b3d6264bbb92095467
Opcode Fuzzy Hash: 414937b2a6d92fbc3da88fc1208311d46d9418bcea39934cf64ea2bb9134626d
Instruction Fuzzy Hash: C5113021B09E82C5F7208B23F4107EE63A0BF647A5F5102F2DA5D67E69EE2CD184C704

Function 00007FFE14632A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14632A8E

Strings

RCC, xrefs: 00007FFE14632A60
csm, xrefs: 00007FFE14632A70
MOC, xrefs: 00007FFE14632A68

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: e6925ddeae9f6abb212e7a32541bb014c6d86355b9cc18b04f60eda383221cf3
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: 56F04F32918A8786E7646B22E1C106D3664EF4DB68F1950B1D74C06362CF7CD8A8C781

Function 00007FFE126E1E7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE126E0CFC), ref: 00007FFE126E1E89
PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE126E0CFC), ref: 00007FFE126E1E92
PyErr_SetString.PYTHON312(?,?,00000006,00007FFE126E0CFC), ref: 00007FFE126E607B

Strings

Value too large for uint32_t type, xrefs: 00007FFE126E6071

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction ID: 9338b9d48c8c5f1e2beef6a63028fe1879162f6e379281f18b1dc15c59644895
Opcode Fuzzy Hash: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction Fuzzy Hash: 2CF05E20B18E03C9EF10DB27EC941B82360AB48BA4F0481B0D90D463B4DEBCEC949340

Function 00007FFE126E6490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE126E649D
PyErr_Occurred.PYTHON312 ref: 00007FFE126E64A6
PyErr_SetString.PYTHON312 ref: 00007FFE126E64CE

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFE126E64C4

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction ID: 729eae96b20d61f694159f789a320accc1dde94eb8d5e430a96a9c9936995e91
Opcode Fuzzy Hash: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction Fuzzy Hash: C3F0FE21A08E47D9EF148F17FD841796360AF44BA4F1880B4CA1D463F8DEBCE8948700

Function 00007FFE126E64E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE126E64F5
PyErr_Occurred.PYTHON312 ref: 00007FFE126E64FE
PyErr_SetString.PYTHON312 ref: 00007FFE126E6526

Strings

Value too large for lzma_mode type, xrefs: 00007FFE126E651C

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction ID: 161f783985c155275a091e9d5513aae00a1bf79c176ee091f5b178c2cb921204
Opcode Fuzzy Hash: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction Fuzzy Hash: 72F0F821B08E43DAEF508F17FC841786360AF48BA4F5854B4DA1E4A2F8DEBCE8948300

Function 00007FFE1338678C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE133867B0
PyErr_SetString.PYTHON312 ref: 00007FFE133867D5

Strings

<socket object, fd=%ld, family=%d, type=%d, proto=%d>, xrefs: 00007FFE133867A5
no printf formatter to display the socket descriptor in decimal, xrefs: 00007FFE133867CB

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_FormatFromStringUnicode_
String ID: <socket object, fd=%ld, family=%d, type=%d, proto=%d>$no printf formatter to display the socket descriptor in decimal
API String ID: 1884982852-285600062
Opcode ID: adbad624c4c56f29da8e25935a1100d7f970daaacfccf8b58daafbc43e48176e
Instruction ID: 54c1c6ca860ff7ded5f362fd38d6228516beef6a1fd6791e616f88118ff41945
Opcode Fuzzy Hash: adbad624c4c56f29da8e25935a1100d7f970daaacfccf8b58daafbc43e48176e
Instruction Fuzzy Hash: BDF0D075A0890289DA109B16D44047C3361FB68BB8F6047B1DA3D57AF4DE2DE486D744

Function 00007FFE1463A638 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE4D
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE86
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A793
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A7F2
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A824
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A834

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction ID: 4e759cbe01357f428da183593d63ca0698bb1e0d35096d71a122cb4a08d46c52
Opcode Fuzzy Hash: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction Fuzzy Hash: 61916F76E08E9689FB118BA6D8803BC37B0BB0676CF5440B5DA4D177A5DF7CA849D380

Function 00007FFE126D838C Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126D83C1

Part of subcall function 00007FFE126E2574: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE126D83DB,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E25AB
Part of subcall function 00007FFE126E2574: PyList_New.PYTHON312(?,?,?,00007FFE126D83DB,?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126E25BE

PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126D83E8
PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126D8401
_Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FFE126D8041), ref: 00007FFE126D84C1

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction ID: f0c353b0ad88cc95ea6520a0ed7015348c318e0e4f7b88ec56f0973129eaf96b
Opcode Fuzzy Hash: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction Fuzzy Hash: 6C419422A09E4A86EA64CF279C481BD23A4FF847A8F644175D98D476F4DFBCE846C340

Function 00007FFE1463D274 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1463ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1463EDEE

Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE4D
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463CE86
Part of subcall function 00007FFE1463CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D2F4
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D303
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D380
DName::operator+.LIBVCRUNTIME ref: 00007FFE1463D38F

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction ID: 4379586cff08e618d62f1e8d712a2c5391c0bb3061c51640ebc84362d4665547
Opcode Fuzzy Hash: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction Fuzzy Hash: 03417B72A04B8589FB01CF66D8803AC37A0FB4AB6CF548075DA4C57769DF7C9849C390

Function 00007FFE13384594 Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON

Download Yara Rule

APIs

_PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE133845E9
PyEval_SaveThread.PYTHON312 ref: 00007FFE13384628
select.WS2_32 ref: 00007FFE1338465C
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13384667

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
String ID:
API String ID: 3905867726-0
Opcode ID: 12a889711c2c2e54b49b1f454469c8620633830652707fbfba1c602784efdac5
Instruction ID: c1a7997d3fd07c68c87419914ca2c0bccd2e2fa14c0c05439e4b508273ca52ee
Opcode Fuzzy Hash: 12a889711c2c2e54b49b1f454469c8620633830652707fbfba1c602784efdac5
Instruction Fuzzy Hash: 5131B862B08F818AD760CF26A8542AD6390FB987B4F5103B9DA7D63FA4DF3DD4458708

Function 00007FFE13385790 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133841EC: PyErr_SetString.PYTHON312 ref: 00007FFE1338422F

memset.VCRUNTIME140 ref: 00007FFE133857DC
PyEval_SaveThread.PYTHON312 ref: 00007FFE133857E1
getsockname.WS2_32 ref: 00007FFE133857F8
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385803

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetsocknamememset
String ID:
API String ID: 772546412-0
Opcode ID: bb4860f722e20605b845678caae1940802489a0c30753b108cbd7cf2fc4f76aa
Instruction ID: d041b349f2df4355e66327b36cdad3cedfa68b051f9f86e5ea38c7c23e17db8b
Opcode Fuzzy Hash: bb4860f722e20605b845678caae1940802489a0c30753b108cbd7cf2fc4f76aa
Instruction Fuzzy Hash: D8115421A0CFC2C5EA309B52F0403AE6361FBA4795F4042B2DA9E23E69DF2CD185C704

Function 00007FFE133856D0 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133841EC: PyErr_SetString.PYTHON312 ref: 00007FFE1338422F

memset.VCRUNTIME140 ref: 00007FFE1338571C
PyEval_SaveThread.PYTHON312 ref: 00007FFE13385721
getpeername.WS2_32 ref: 00007FFE13385738
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385743

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetpeernamememset
String ID:
API String ID: 1387529023-0
Opcode ID: 6217d1f52f68499da46158bc7b5de8f19134ea31d65d8230de025008c52050e8
Instruction ID: fe95fe306e967cc842de358708646afee3e07d8c7a8edb3ecdce386536ef80a5
Opcode Fuzzy Hash: 6217d1f52f68499da46158bc7b5de8f19134ea31d65d8230de025008c52050e8
Instruction Fuzzy Hash: AD116A2560CFC2C6EA309B52F0443AE6361FB54794F0041B1E59D27E69DF3CD145C704

Function 00007FFE126D76FC Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON312 ref: 00007FFE126D7749
PyMem_Free.PYTHON312 ref: 00007FFE126D7776
_Py_Dealloc.PYTHON312 ref: 00007FFE126D777E

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction ID: 91337d1d92da4384fad797dd18eabe3ea032453974090572818dc07df538fcb2
Opcode Fuzzy Hash: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction Fuzzy Hash: E2111E22A09D8A96EA9E8F63DD583782360FF44BA4F185470C65E465F4CFBDA8558302

Function 00007FFE146409FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE14640A28
GetCurrentThreadId.KERNEL32 ref: 00007FFE14640A36
GetCurrentProcessId.KERNEL32 ref: 00007FFE14640A42
QueryPerformanceCounter.KERNEL32 ref: 00007FFE14640A52

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction ID: 9abc4f2b4532c2ad06ebd828dac809781d0567ac8431bf72fbc5d16c76933b88
Opcode Fuzzy Hash: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction Fuzzy Hash: 89110026B14F058AEF00DF61E8952B833A4F75AB68F481E35DA6D467A4DF7CD198C340

Function 00007FFE13382EEC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE13382F18
GetCurrentThreadId.KERNEL32 ref: 00007FFE13382F26
GetCurrentProcessId.KERNEL32 ref: 00007FFE13382F32
QueryPerformanceCounter.KERNEL32 ref: 00007FFE13382F42

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d9f98cd6e8095113ce688e9adc81d2d2b62b70132384823deca84349fed3ec32
Instruction ID: fa37b18ab83286193f416118204c7e7a0b1d3d8bb35824436a0aac88a9f26eca
Opcode Fuzzy Hash: d9f98cd6e8095113ce688e9adc81d2d2b62b70132384823deca84349fed3ec32
Instruction Fuzzy Hash: 11112122B14F0189EB00CF61E8542B833A4F769768F440E75DA6E96BA4DF7CD1A4C340

Function 00007FFE126E3A1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE126E3A48
GetCurrentThreadId.KERNEL32 ref: 00007FFE126E3A56
GetCurrentProcessId.KERNEL32 ref: 00007FFE126E3A62
QueryPerformanceCounter.KERNEL32 ref: 00007FFE126E3A72

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction ID: 356803224521a8205054d58fe031216dec29550b5a1644e4f483fd099286af1e
Opcode Fuzzy Hash: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction Fuzzy Hash: 81112A26B14F418AEB00CF65EC542B833A4FB59768F441E31DA6D46BB8DFBCD1588340

Function 00007FFE148B165C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE148B1688
GetCurrentThreadId.KERNEL32 ref: 00007FFE148B1696
GetCurrentProcessId.KERNEL32 ref: 00007FFE148B16A2
QueryPerformanceCounter.KERNEL32 ref: 00007FFE148B16B2

Memory Dump Source

Source File: 00000002.00000002.3780180225.00007FFE148B1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000002.00000002.3780140147.00007FFE148B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780240716.00007FFE148B3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780287247.00007FFE148B5000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3780341109.00007FFE148B6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe148b0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction ID: 6b0db8e52b91edf6adafa73bd49b4477a3dfc43c1b561008ba7e0b7ad12ea8ca
Opcode Fuzzy Hash: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction Fuzzy Hash: 7F112E26B14F058AEB00DF61E8942B833A4FB1A768F440E31EE6D467B4DF7CD1598340

Function 00007FF63D56D6F4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF63D56D720
GetCurrentThreadId.KERNEL32 ref: 00007FF63D56D72E
GetCurrentProcessId.KERNEL32 ref: 00007FF63D56D73A
QueryPerformanceCounter.KERNEL32 ref: 00007FF63D56D74A

Memory Dump Source

Source File: 00000002.00000002.3777428273.00007FF63D541000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF63D540000, based on PE: true

Associated: 00000002.00000002.3777399946.00007FF63D540000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3777464571.00007FF63D58C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3777541146.00007FF63D5A6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3777597726.00007FF63D5B1000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff63d540000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3e9bf284f51a014416bd2e884015404433c55462ee1280fbdb526b963edf0727
Instruction ID: b541a4641615c286454e1f8bb0dd302ecba42d15b4901a6ac7acbe8973795a95
Opcode Fuzzy Hash: 3e9bf284f51a014416bd2e884015404433c55462ee1280fbdb526b963edf0727
Instruction Fuzzy Hash: 87111226B14F058AFB00CFA4E8552B833A4FB59768F441E35EE6D867A4EF7CE1549340

Function 00007FFE1321A640 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1321A66C
GetCurrentThreadId.KERNEL32 ref: 00007FFE1321A67A
GetCurrentProcessId.KERNEL32 ref: 00007FFE1321A686
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1321A696

Memory Dump Source

Source File: 00000002.00000002.3779820045.00007FFE13211000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE13210000, based on PE: true

Associated: 00000002.00000002.3779801540.00007FFE13210000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779842597.00007FFE1321E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779866844.00007FFE13222000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.3779888024.00007FFE13223000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13210000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction ID: 8437af570f47870c80f8e875cffcce7462140b4c1dc676b4cc24284dcb520c40
Opcode Fuzzy Hash: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction Fuzzy Hash: D9111C22B15F018EEB00DB61EC552A933A4FB69768F440E31DA6D567A4DF7CD254C340

Function 00007FFDFAF48960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFAF4898C
GetCurrentThreadId.KERNEL32 ref: 00007FFDFAF4899A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFAF489A6
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFAF489B6

Memory Dump Source

Source File: 00000002.00000002.3778068805.00007FFDFADA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFDFADA0000, based on PE: true

Associated: 00000002.00000002.3777981553.00007FFDFADA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778260813.00007FFDFB022000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778260813.00007FFDFB042000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778260813.00007FFDFB051000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778260813.00007FFDFB0C7000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778260813.00007FFDFB192000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778923898.00007FFDFB296000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778971593.00007FFDFB2FE000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3778996982.00007FFDFB305000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779015042.00007FFDFB306000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779033239.00007FFDFB307000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779053332.00007FFDFB308000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779108688.00007FFDFB38F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779135699.00007FFDFB391000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779172568.00007FFDFB39B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779234889.00007FFDFB3C0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779259790.00007FFDFB3C1000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779290761.00007FFDFB3C2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779384560.00007FFDFB3C3000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779408832.00007FFDFB3C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779467209.00007FFDFB3D1000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779529860.00007FFDFB3D2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779597046.00007FFDFB414000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3779642753.00007FFDFB431000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffdfada0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction ID: fbf676f528adcf70278098af14a93d004fbcfd943431bf3b737f207af8cc2572
Opcode Fuzzy Hash: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction Fuzzy Hash: 49112E22B15F068AEB00DF60E8646B833A4FB19758F440E31DE6D867A8EF78D168C340

Function 00007FFE13385338 Relevance: 6.0, APIs: 4, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1338535C
closesocket.WS2_32 ref: 00007FFE13385368
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13385373
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13385382

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSave_errnoclosesocket
String ID:
API String ID: 1624953543-0
Opcode ID: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction ID: c21d6796134de5eb2dae7a4da6d438e374b640a3fe05050152034e1edf11bfa6
Opcode Fuzzy Hash: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction Fuzzy Hash: 38F01D62A08F41C6EA545B57A44406C6364AB69BB1B1843B0DA7E23BF4CFBCD4C58204

Function 00007FFE1463F670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1463F732
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1463F435), ref: 00007FFE1463F78C

Strings

csm, xrefs: 00007FFE1463F719

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction ID: 912a420aa57b10216419ccbdc7d1708d0a238f7e1718de5302257e8ca348a66a
Opcode Fuzzy Hash: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction Fuzzy Hash: 6551C432B19A828ADB1CCB16E494A7D33A1EB45BACF148175DA9E437A4DF3CE845C740

Function 00007FFE14634E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE14634F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE14634F74

Strings

csm, xrefs: 00007FFE1463501A

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction ID: bd14d1ea8562fcc03783a77cb69c20435b44c98c8010db5bf6870e4d28a52551
Opcode Fuzzy Hash: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction Fuzzy Hash: 66513F77618B8186D6219F26E48026E77B4FB8ABA8F140174EB8D07B65CF3DE459CB40

Function 00007FFE1463A524 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1463A622

Strings

void, xrefs: 00007FFE1463A584
void , xrefs: 00007FFE1463A5AC

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction ID: de619c582bfcd9de31f24dc11709010c01369863c0720fb535491d3bd46141a0
Opcode Fuzzy Hash: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction Fuzzy Hash: CF312762E18F999CFB01DFA5E8810EC37B0BB4A75CB444176EA4E52B69DF3C9148C790

Function 00007FFE13384B6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13388654: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE13388698

PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE13383FC0), ref: 00007FFE13384C47

Strings

%X:%X:%X:%X:%X:%X%c, xrefs: 00007FFE13384B97
bad bluetooth address, xrefs: 00007FFE13384C3D

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_String__stdio_common_vsscanf
String ID: %X:%X:%X:%X:%X:%X%c$bad bluetooth address
API String ID: 3283897942-3956635471
Opcode ID: 82460378f9390543d5d03a976a5082cfe22b1e135c935a62461cff4db5ddd525
Instruction ID: cf376ae742655957d730583ce5b89dcf550edb9e3ac5d787486ddf780c1ccb4c
Opcode Fuzzy Hash: 82460378f9390543d5d03a976a5082cfe22b1e135c935a62461cff4db5ddd525
Instruction Fuzzy Hash: A721CF71718E859ADB10CB02E8880AC73A6F7543E0F418276EAAC57B64DF3DD894C710

Function 00007FFE1463676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE14636B60
Part of subcall function 00007FFE14636B10: RaiseException.KERNEL32 ref: 00007FFE14636BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE146367DF

Strings

Access violation - no RTTI data!, xrefs: 00007FFE1463676F
Bad dynamic_cast!, xrefs: 00007FFE14636792

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: 5d9dcf5d8e16ca2755ffc62d6587067daae1bf94659cc2439780e44db716af17
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: 5C018C61A19E8AA1EF108B16E4D01B82360EF82B68F4464B1E60E06779EF7CD94DC740

Function 00007FFE14636B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE14636B60
RaiseException.KERNEL32 ref: 00007FFE14636BA1

Strings

csm, xrefs: 00007FFE14636B8E

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: 2c49ca0c93ec38a44e9efedd819222976c9feefe520be5dd85d1507b6449a408
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: 7C116032608F8082EB618F16F440259B7E4FB89B98F1842B0DE8D07768DF3DC955CB40

Function 00007FFE133841EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1338422F

Strings

getsockaddrlen: unknown BT protocol, xrefs: 00007FFE1338421E
getsockaddrlen: bad family, xrefs: 00007FFE13384207

Memory Dump Source

Source File: 00000002.00000002.3779925922.00007FFE13381000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13380000, based on PE: true

Associated: 00000002.00000002.3779906557.00007FFE13380000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779945206.00007FFE13389000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779968681.00007FFE13391000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3779992737.00007FFE13393000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe13380000_l4.jbxd

Similarity

API ID: Err_String
String ID: getsockaddrlen: bad family$getsockaddrlen: unknown BT protocol
API String ID: 1450464846-3381576205
Opcode ID: 68c5e8985835ae6d1ad6a3eb8734c9d41b7279e8c40dd2ee74cade83e5c1d99f
Instruction ID: 14044924cc45ebb0801ad232f1a3a875589f02619bf1094f2058dca407b26288
Opcode Fuzzy Hash: 68c5e8985835ae6d1ad6a3eb8734c9d41b7279e8c40dd2ee74cade83e5c1d99f
Instruction Fuzzy Hash: C00119B190CA028DF7248F0AE48427C22A1ABA5720F6146F5C12EB6EB0CF7CA5C59709

Function 00007FFE1463F420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE14636E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE146329EE), ref: 00007FFE14636E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1463F45A

Strings

csm, xrefs: 00007FFE1463F43B
f, xrefs: 00007FFE1463F435

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction ID: aaa39fd6bfd0ec9323aa151cd562e82c06c3f6f28c5db0453587b600dd587b7b
Opcode Fuzzy Hash: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction Fuzzy Hash: 28E03721D08B9141D6255B22A1C013D2654AF5BB68F144074D6CC06767CE38D8984641

Function 00007FFE126D9D80 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE126D9DDD
memmove.VCRUNTIME140 ref: 00007FFE126E52D1
memcpy.VCRUNTIME140 ref: 00007FFE126E52E8

Memory Dump Source

Source File: 00000002.00000002.3779693689.00007FFE126D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE126D0000, based on PE: true

Associated: 00000002.00000002.3779673308.00007FFE126D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126E8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779716950.00007FFE126EC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779756441.00007FFE126F4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.3779776370.00007FFE126F5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe126d0000_l4.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction ID: 69f007042ba27914a906eb334263b5e30ca11ddeb14b21c0030e2e4f3a0e5fb7
Opcode Fuzzy Hash: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction Fuzzy Hash: 1131D432B19A4987DA149F37B84407DB762FB55BA0B280139DB8E57BE5DEBCE4418700

Function 00007FFE14636E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE14636CE9,?,?,?,?,00007FFE14640582,?,?,?,?,?), ref: 00007FFE14636E83
SetLastError.KERNEL32(?,?,?,00007FFE14636CE9,?,?,?,?,00007FFE14640582,?,?,?,?,?), ref: 00007FFE14636F0C

Memory Dump Source

Source File: 00000002.00000002.3780038959.00007FFE14631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE14630000, based on PE: true

Associated: 00000002.00000002.3780019875.00007FFE14630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780070003.00007FFE14643000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780092350.00007FFE14648000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3780111476.00007FFE14649000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe14630000_l4.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: 041555b59f236db338692be52b05ba9aa045ce3c48d18c6eaa14d8e0a78eb1d3
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: F4112724B1DE8642FE249B27A8901742291AF47BBCF0846B4D92D077F5DE3CA84DC650

Analysis Process: l4.exePID: 7148, Parent PID: 2580COMMON

Non-executed Functions

Function 00007FF7E437C0F0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E437C11C
GetCurrentThreadId.KERNEL32 ref: 00007FF7E437C12A
GetCurrentProcessId.KERNEL32 ref: 00007FF7E437C136
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E437C146

Memory Dump Source

Source File: 00000004.00000002.2155988662.00007FF7E4371000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF7E4370000, based on PE: true

Associated: 00000004.00000002.2155965352.00007FF7E4370000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156014211.00007FF7E4392000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156046797.00007FF7E439F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156046797.00007FF7E43B1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156046797.00007FF7E43B7000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156046797.00007FF7E43B9000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156046797.00007FF7E43BB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.2156156105.00007FF7E43C4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e4370000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e5452eedf9582e092569b7414b2f17c91349fbc22d9af30a0b797327307e927a
Instruction ID: 0fe696a4d03f63c22f3d53fdd029d28215199b4f9b7a9416378cc8c5da8e4ff4
Opcode Fuzzy Hash: e5452eedf9582e092569b7414b2f17c91349fbc22d9af30a0b797327307e927a
Instruction Fuzzy Hash: 36113D2AB14F028AEB10DF65EC843A873A4F729758F440E36EB6D52768DF38D1648351

Analysis Process: l4.exePID: 5768, Parent PID: 7148COMMON

Executed Functions

Function 00007FFE1A4D10C0 Relevance: 694.3, APIs: 203, Strings: 193, Instructions: 1313networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFE1A4D10F8
Py_AtExit.PYTHON312 ref: 00007FFE1A4D110D
PyErr_NewException.PYTHON312 ref: 00007FFE1A4D1133
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D1153
PyErr_NewException.PYTHON312 ref: 00007FFE1A4D1175
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D1195
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D11B7
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D11D9
PyType_FromMetaclass.PYTHON312 ref: 00007FFE1A4D11F6
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D1215
PyModule_AddType.PYTHON312 ref: 00007FFE1A4D1229
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D1248
PyMem_Malloc.PYTHON312 ref: 00007FFE1A4D125B
PyCapsule_New.PYTHON312 ref: 00007FFE1A4D12BF
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D12DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D130A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1328
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1346
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1364
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1382
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D13A0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D13BE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D13DC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D13FA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1418
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1436
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1454
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1472
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1490
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D14AE
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D14CD
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D14EC
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D150B
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D152A
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D1549
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D1568
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1586
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D15A4
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D15C3
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE1A4D15E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1600
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D161E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D163C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D165A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1678
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1696
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D16B4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D16D2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D16F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D170E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D172C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D174A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1786
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D17A4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D17C2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D17E0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D17FE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D181C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D183A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1858
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1876
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1894
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D18B2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D18D0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D18EE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D190C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D192A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1948
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1966
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1984
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D19A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D19C0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D19DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D19FC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1A1A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1A38
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1A53
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1A6E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1A8C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1AAA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1AC8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1AE6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B04
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B22
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B40
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B5E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B7C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1B9A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1BB8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1BD6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1BF4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1C12
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1C30
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1C4E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1C6C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1C8A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1CA8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1CC6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1CE4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D02
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D20
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D3E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D5C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D7A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1D98
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1DB6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1DD4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1DF2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1E10
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1E2E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1E49
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1E67
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1E85
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1EA3
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1EC1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1EDF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1EFD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1F1B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1F39
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1F57
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1F75
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1F93
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1FB1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1FCF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D1FED
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D200B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2029
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2047
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2065
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2083
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D20A1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D20BF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D20DD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D20FB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2119
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2137
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2155
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2173
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2191
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D21AF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D21CD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D21EB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2209
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2227
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2245
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2263
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2281
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D229F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D22BD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D22DB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D22F9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2317
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2335
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2353
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2371
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D238F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D23AD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D23CB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D23E9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2407
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2425
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2443
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2461
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D247F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D249D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D24BB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D24D9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D24F7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2515
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2533
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2551
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D256F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D258D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D25AB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D25C9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D25E7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2605
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2623
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D263E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D265C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D267A
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1A4D26D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4D26F0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D272C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D274A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2768
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1A4D2786
PyModule_GetDict.PYTHON312 ref: 00007FFE1A4D2797
memset.VCRUNTIME140 ref: 00007FFE1A4D27B6
VerSetConditionMask.KERNEL32 ref: 00007FFE1A4D27D6
VerSetConditionMask.KERNEL32 ref: 00007FFE1A4D27E7
VerSetConditionMask.KERNEL32 ref: 00007FFE1A4D27F8
VerifyVersionInfoA.KERNEL32 ref: 00007FFE1A4D281F
PyUnicode_FromString.PYTHON312 ref: 00007FFE1A4D283B
_PyDict_Pop.PYTHON312 ref: 00007FFE1A4D2856
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D286D
PyErr_Format.PYTHON312 ref: 00007FFE1A4D39DC
PyErr_NoMemory.PYTHON312 ref: 00007FFE1A4D3A0E
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D3A48

Strings

EAI_NONAME, xrefs: 00007FFE1A4D2439
IPV6_HOPOPTS, xrefs: 00007FFE1A4D221D
IPPROTO_IGMP, xrefs: 00007FFE1A4D1AA0
IP_MULTICAST_TTL, xrefs: 00007FFE1A4D1FE3
RCVALL_MAX, xrefs: 00007FFE1A4D277C
IPPROTO_ST, xrefs: 00007FFE1A4D1D34
socket.herror, xrefs: 00007FFE1A4D1117
IPPROTO_IDP, xrefs: 00007FFE1A4D1B90
CAPI, xrefs: 00007FFE1A4D12D4
IP_BLOCK_SOURCE, xrefs: 00007FFE1A4D2097
SOL_SOCKET, xrefs: 00007FFE1A4D19D4
SOL_UDP, xrefs: 00007FFE1A4D1A2E
SO_TYPE, xrefs: 00007FFE1A4D188A
HV_PROTOCOL_RAW, xrefs: 00007FFE1A4D142C
IPPROTO_MAX, xrefs: 00007FFE1A4D1CF8
IP_UNBLOCK_SOURCE, xrefs: 00007FFE1A4D2079
SO_DEBUG, xrefs: 00007FFE1A4D168C
TCP_KEEPINTVL, xrefs: 00007FFE1A4D232B
IPV6_HOPLIMIT, xrefs: 00007FFE1A4D21FF
TCP_KEEPCNT, xrefs: 00007FFE1A4D2349
IPPROTO_IPV4, xrefs: 00007FFE1A4D1ADC
AI_NUMERICSERV, xrefs: 00007FFE1A4D24ED
INADDR_LOOPBACK, xrefs: 00007FFE1A4D1E7B
SO_LINGER, xrefs: 00007FFE1A4D177C
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFE1A4D1538
HV_GUID_CHILDREN, xrefs: 00007FFE1A4D1523
IPV6_MULTICAST_HOPS, xrefs: 00007FFE1A4D212D
AI_PASSIVE, xrefs: 00007FFE1A4D2493
TCP_FASTOPEN, xrefs: 00007FFE1A4D2367
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFE1A4D20D3
SO_SNDLOWAT, xrefs: 00007FFE1A4D17F4
AF_APPLETALK, xrefs: 00007FFE1A4D135A
SIO_KEEPALIVE_VALS, xrefs: 00007FFE1A4D26A1
IPPROTO_DSTOPTS, xrefs: 00007FFE1A4D1C80
SOL_IP, xrefs: 00007FFE1A4D19F2
SHUT_RDWR, xrefs: 00007FFE1A4D2670
AI_ALL, xrefs: 00007FFE1A4D250B
00000000-0000-0000-0000-000000000000, xrefs: 00007FFE1A4D14BC, 00007FFE1A4D14DB
IPPROTO_L2TP, xrefs: 00007FFE1A4D1DCA
INADDR_UNSPEC_GROUP, xrefs: 00007FFE1A4D1E99
IPPROTO_FRAGMENT, xrefs: 00007FFE1A4D1BEA
NI_DGRAM, xrefs: 00007FFE1A4D2619
AF_HYPERV, xrefs: 00007FFE1A4D140E
MSG_DONTROUTE, xrefs: 00007FFE1A4D1902
IP_TOS, xrefs: 00007FFE1A4D1F4D
IPPROTO_SCTP, xrefs: 00007FFE1A4D1CBC, 00007FFE1A4D1DE8
NI_NAMEREQD, xrefs: 00007FFE1A4D25DD
EAI_SERVICE, xrefs: 00007FFE1A4D2457
AF_UNSPEC, xrefs: 00007FFE1A4D1300
SO_ACCEPTCONN, xrefs: 00007FFE1A4D16AA
socket.gaierror, xrefs: 00007FFE1A4D1168
MSG_OOB, xrefs: 00007FFE1A4D18C6
HV_GUID_LOOPBACK, xrefs: 00007FFE1A4D1542
IPV6_MULTICAST_IF, xrefs: 00007FFE1A4D214B
IP_RECVDSTADDR, xrefs: 00007FFE1A4D1FA7
IPV6_JOIN_GROUP, xrefs: 00007FFE1A4D20F1
SHUT_WR, xrefs: 00007FFE1A4D2652
IPPROTO_AH, xrefs: 00007FFE1A4D1C26
EAI_NODATA, xrefs: 00007FFE1A4D241B
BDADDR_LOCAL, xrefs: 00007FFE1A4D15DB
MSG_WAITALL, xrefs: 00007FFE1A4D195C
error, xrefs: 00007FFE1A4D11AA
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFE1A4D1557
EAI_MEMORY, xrefs: 00007FFE1A4D23FD
EAI_FAMILY, xrefs: 00007FFE1A4D23DF
IPPROTO_GGP, xrefs: 00007FFE1A4D1ABE
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFE1A4D1ED5
TCP_KEEPIDLE, xrefs: 00007FFE1A4D230D
AF_INET, xrefs: 00007FFE1A4D131E
IP_HDRINCL, xrefs: 00007FFE1A4D1F2F
SOCK_SEQPACKET, xrefs: 00007FFE1A4D1650
IP_RECVTOS, xrefs: 00007FFE1A4D1F89
IP_OPTIONS, xrefs: 00007FFE1A4D1F11
IPV6_V6ONLY, xrefs: 00007FFE1A4D21A5
IPPROTO_HOPOPTS, xrefs: 00007FFE1A4D1A64
SHUT_RD, xrefs: 00007FFE1A4D2634
SO_SNDTIMEO, xrefs: 00007FFE1A4D1830
SO_RCVTIMEO, xrefs: 00007FFE1A4D184E
AF_BLUETOOTH, xrefs: 00007FFE1A4D157C
INADDR_BROADCAST, xrefs: 00007FFE1A4D1E5D
EAI_AGAIN, xrefs: 00007FFE1A4D2385
SOCK_RAW, xrefs: 00007FFE1A4D1632
IPPROTO_ICMP, xrefs: 00007FFE1A4D1A82
SO_SNDBUF, xrefs: 00007FFE1A4D17B8
NI_MAXSERV, xrefs: 00007FFE1A4D2583
MSG_TRUNC, xrefs: 00007FFE1A4D1920
gaierror, xrefs: 00007FFE1A4D118B
MSG_BCAST, xrefs: 00007FFE1A4D1998
AI_ADDRCONFIG, xrefs: 00007FFE1A4D2529
has_ipv6, xrefs: 00007FFE1A4D123E
SOCK_STREAM, xrefs: 00007FFE1A4D15F6
00:00:00:FF:FF:FF, xrefs: 00007FFE1A4D15D1
SO_USELOOPBACK, xrefs: 00007FFE1A4D175E
MSG_ERRQUEUE, xrefs: 00007FFE1A4D197A
AI_CANONNAME, xrefs: 00007FFE1A4D24B1
IPPROTO_ICLFXBM, xrefs: 00007FFE1A4D1D16
SocketType, xrefs: 00007FFE1A4D120B
IPV6_LEAVE_GROUP, xrefs: 00007FFE1A4D210F
IP_TTL, xrefs: 00007FFE1A4D1F6B
SOMAXCONN, xrefs: 00007FFE1A4D18A8
IP_PKTINFO, xrefs: 00007FFE1A4D205B
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFE1A4D26BA
TCP_MAXSEG, xrefs: 00007FFE1A4D22EF
IPV6_CHECKSUM, xrefs: 00007FFE1A4D21C3
IPPROTO_PUP, xrefs: 00007FFE1A4D1B54
IPPROTO_NONE, xrefs: 00007FFE1A4D1C62
RCVALL_OFF, xrefs: 00007FFE1A4D2722
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFE1A4D1519
SO_ERROR, xrefs: 00007FFE1A4D186C
IPV6_RECVRTHDR, xrefs: 00007FFE1A4D2259
SO_REUSEADDR, xrefs: 00007FFE1A4D16C8
AI_NUMERICHOST, xrefs: 00007FFE1A4D24CF
IPV6_RTHDR, xrefs: 00007FFE1A4D2295
IPPROTO_RDP, xrefs: 00007FFE1A4D1D8E
SO_RCVBUF, xrefs: 00007FFE1A4D17D6
HV_GUID_BROADCAST, xrefs: 00007FFE1A4D1504
IP_MULTICAST_IF, xrefs: 00007FFE1A4D1FC5
IPV6_MULTICAST_LOOP, xrefs: 00007FFE1A4D2169
AF_IRDA, xrefs: 00007FFE1A4D13F0
IPPROTO_CBT, xrefs: 00007FFE1A4D1D52
AF_IPX, xrefs: 00007FFE1A4D133C
timeout, xrefs: 00007FFE1A4D11CC
IPPROTO_RAW, xrefs: 00007FFE1A4D1CDA
MSG_CTRUNC, xrefs: 00007FFE1A4D193E
BTPROTO_RFCOMM, xrefs: 00007FFE1A4D159A
IPPORT_RESERVED, xrefs: 00007FFE1A4D1E06
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFE1A4D1468
TCP_NODELAY, xrefs: 00007FFE1A4D22D1
IPV6_RECVTCLASS, xrefs: 00007FFE1A4D2277
EAI_SOCKTYPE, xrefs: 00007FFE1A4D2475
HV_GUID_PARENT, xrefs: 00007FFE1A4D1561
NI_NOFQDN, xrefs: 00007FFE1A4D25A1
EAI_FAIL, xrefs: 00007FFE1A4D23C1
AF_LINK, xrefs: 00007FFE1A4D13B4
IPPROTO_EGP, xrefs: 00007FFE1A4D1B36
HV_GUID_ZERO, xrefs: 00007FFE1A4D14C6
IPPROTO_ND, xrefs: 00007FFE1A4D1BAE
INADDR_ANY, xrefs: 00007FFE1A4D1E3F
IPPORT_USERRESERVED, xrefs: 00007FFE1A4D1E24
IPV6_PKTINFO, xrefs: 00007FFE1A4D223B
EAI_BADFLAGS, xrefs: 00007FFE1A4D23A3
SO_OOBINLINE, xrefs: 00007FFE1A4D179A
IP_ADD_MEMBERSHIP, xrefs: 00007FFE1A4D201F
IPV6_UNICAST_HOPS, xrefs: 00007FFE1A4D2187
WSAStartup failed: network not ready, xrefs: 00007FFE1A4D39E8
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFE1A4D1486
AF_INET6, xrefs: 00007FFE1A4D1378
IPPROTO_ESP, xrefs: 00007FFE1A4D1C08
MSG_PEEK, xrefs: 00007FFE1A4D18E4
MSG_MCAST, xrefs: 00007FFE1A4D19B6
IP_DROP_MEMBERSHIP, xrefs: 00007FFE1A4D203D
AF_DECnet, xrefs: 00007FFE1A4D1396
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFE1A4D144A
NI_NUMERICSERV, xrefs: 00007FFE1A4D25FB
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFE1A4D275E
IPPROTO_UDP, xrefs: 00007FFE1A4D1B72
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFE1A4D14FA
BDADDR_ANY, xrefs: 00007FFE1A4D15BC
HV_GUID_WILDCARD, xrefs: 00007FFE1A4D14E5
AI_V4MAPPED, xrefs: 00007FFE1A4D2547
IPPROTO_ICMPV6, xrefs: 00007FFE1A4D1C44
herror, xrefs: 00007FFE1A4D1149
SOCK_RDM, xrefs: 00007FFE1A4D166E
00:00:00:00:00:00, xrefs: 00007FFE1A4D15B2
IPV6_TCLASS, xrefs: 00007FFE1A4D22B3
NI_MAXHOST, xrefs: 00007FFE1A4D2565
SO_KEEPALIVE, xrefs: 00007FFE1A4D1704
IPPROTO_IGP, xrefs: 00007FFE1A4D1D70
WSAStartup failed: requested version not supported, xrefs: 00007FFE1A4D39F1
IPPROTO_IPV6, xrefs: 00007FFE1A4D1AFA
IPPROTO_ROUTING, xrefs: 00007FFE1A4D1BCC
NI_NUMERICHOST, xrefs: 00007FFE1A4D25BF
IPPROTO_IP, xrefs: 00007FFE1A4D1A49
IPV6_DONTFRAG, xrefs: 00007FFE1A4D21E1
SOCK_DGRAM, xrefs: 00007FFE1A4D1614
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFE1A4D1EB7
AF_SNA, xrefs: 00007FFE1A4D13D2
_socket.CAPI, xrefs: 00007FFE1A4D12B8
IPPROTO_PIM, xrefs: 00007FFE1A4D1C9E
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFE1A4D16E6
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFE1A4D20B5
INADDR_NONE, xrefs: 00007FFE1A4D1EF3
SIO_RCVALL, xrefs: 00007FFE1A4D2688
SOL_TCP, xrefs: 00007FFE1A4D1A10
IP_MULTICAST_LOOP, xrefs: 00007FFE1A4D2001
IPPROTO_TCP, xrefs: 00007FFE1A4D1B18
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFE1A4D14A4
SO_BROADCAST, xrefs: 00007FFE1A4D1740
SO_DONTROUTE, xrefs: 00007FFE1A4D1722
RCVALL_ON, xrefs: 00007FFE1A4D2740
SO_RCVLOWAT, xrefs: 00007FFE1A4D1812
IPPROTO_PGM, xrefs: 00007FFE1A4D1DAC
WSAStartup failed: error code %d, xrefs: 00007FFE1A4D39CF

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Module_$Constant$String$Object$Err_$ConditionFromMask$DeallocException$Capsule_DictDict_ExitFormatInfoLongLong_MallocMem_MemoryMetaclassStartupTypeType_Unicode_UnsignedVerifyVersionmemset
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 1196102948-1188461360
Opcode ID: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction ID: 91bfa21acbba39540c82c5a2f57a757e769b7907cd80300cf11b145c941c97eb
Opcode Fuzzy Hash: 0fb31f2eee656220925b4e47e62874025d6cd115870c459d51081d29a567eca9
Instruction Fuzzy Hash: 0AD2C329F08F1385F6108B27A81427426A2BF25FE4F8455FAC91ED6A75EF7DE224C341

Function 00007FFE133127C0 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE133127D7
PyTuple_New.PYTHON312 ref: 00007FFE133127E2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13312804
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13312820
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1331283C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE13312858

Part of subcall function 00007FFE13312BA4: PyLong_FromLongLong.PYTHON312(?,?,?,00007FFE13312878), ref: 00007FFE13312BBC
Part of subcall function 00007FFE13312BA4: PyModule_AddObject.PYTHON312(?,?,?,00007FFE13312878), ref: 00007FFE13312BD3

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE13312B09
PyModule_AddType.PYTHON312 ref: 00007FFE13312B22
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13312B39
PyModule_AddType.PYTHON312 ref: 00007FFE13312B4D
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13312B64
PyModule_AddType.PYTHON312 ref: 00007FFE13312B79

Strings

FILTER_ARMTHUMB, xrefs: 00007FFE133129B7
FORMAT_XZ, xrefs: 00007FFE13312819
FILTER_DELTA, xrefs: 00007FFE1331294C
Call to liblzma failed., xrefs: 00007FFE13312AF8
FILTER_SPARC, xrefs: 00007FFE133129D2
FILTER_IA64, xrefs: 00007FFE13312981
FORMAT_RAW, xrefs: 00007FFE13312851
CHECK_SHA256, xrefs: 00007FFE133128BF
CHECK_NONE, xrefs: 00007FFE13312869
MF_BT4, xrefs: 00007FFE13312A73
CHECK_UNKNOWN, xrefs: 00007FFE133128F5
PRESET_DEFAULT, xrefs: 00007FFE13312AC4
MF_BT3, xrefs: 00007FFE13312A58
FILTER_POWERPC, xrefs: 00007FFE133129ED
FORMAT_AUTO, xrefs: 00007FFE133127FA
CHECK_CRC32, xrefs: 00007FFE13312887
MODE_NORMAL, xrefs: 00007FFE13312AA9
MODE_FAST, xrefs: 00007FFE13312A8E
MF_HC3, xrefs: 00007FFE13312A08
FILTER_X86, xrefs: 00007FFE13312963
FORMAT_ALONE, xrefs: 00007FFE13312835
MF_BT2, xrefs: 00007FFE13312A3D
MF_HC4, xrefs: 00007FFE13312A1F
FILTER_LZMA1, xrefs: 00007FFE13312913
_lzma.LZMAError, xrefs: 00007FFE13312B02
CHECK_ID_MAX, xrefs: 00007FFE133128DA
FILTER_LZMA2, xrefs: 00007FFE13312931
FILTER_ARM, xrefs: 00007FFE1331299C
CHECK_CRC64, xrefs: 00007FFE133128A4
PRESET_EXTREME, xrefs: 00007FFE13312ADE

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction ID: ada479a0d365e0557a5aebaf8283800aac10ae04f8d43e00e8aedef946902e9d
Opcode Fuzzy Hash: b091e49e01b098b25a876694f3ea7601ad3c204f15de4486665e150d791b2536
Instruction Fuzzy Hash: 6BA150A0B18E12CAEA149F27E9402B67B65AF247A4F4090B0CD2CEA677DE5DF104C71C

Function 00007FFE1A4D5AFC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE1A4D5B40
PySys_Audit.PYTHON312 ref: 00007FFE1A4D5B78
PyErr_Format.PYTHON312 ref: 00007FFE1A4D5BD0
PySys_Audit.PYTHON312 ref: 00007FFE1A4D5CCE
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D5CDC
WSASocketW.WS2_32 ref: 00007FFE1A4D5D08
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5D14
SetHandleInformation.KERNEL32 ref: 00007FFE1A4D5D32
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D5D3E
closesocket.WS2_32 ref: 00007FFE1A4D5D47
PyLong_AsLongLong.PYTHON312 ref: 00007FFE1A4D5D71
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D5D80
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D5DA0
memset.VCRUNTIME140 ref: 00007FFE1A4D5DC0
getsockname.WS2_32 ref: 00007FFE1A4D5DD2
WSAGetLastError.WS2_32 ref: 00007FFE1A4D5DF1
getsockopt.WS2_32 ref: 00007FFE1A4D5E2E
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D5E6F
WSASocketW.WS2_32 ref: 00007FFE1A4D5E90
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5E9C

Strings

negative file descriptor, xrefs: 00007FFE1A4D5D96
socket.__new__, xrefs: 00007FFE1A4D5B71, 00007FFE1A4D5C69
Oiii, xrefs: 00007FFE1A4D5B5F, 00007FFE1A4D5CA9
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFE1A4D5BC0

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 3363282672-2881308447
Opcode ID: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction ID: 7221f780c336ebb839e86d99dfe3da14408b106666e53c5daf465e4a1780b0bf
Opcode Fuzzy Hash: 4cb0448f202c41487222ee5ef5d738bee55fded3baec7f269166aa18e43a2a4b
Instruction Fuzzy Hash: EDB1A566F08E8582E6508F2AD4042B97360FBA9FB4F0453B6DE5D53AB1DF3CE5A48740

Function 00007FFE1A4D5190 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyDeadline_Get.PYTHON312 ref: 00007FFE1A4D51E4
_PyDeadline_Init.PYTHON312 ref: 00007FFE1A4D520C
WSAGetLastError.WS2_32 ref: 00007FFE1A4D5237
WSAGetLastError.WS2_32 ref: 00007FFE1A4D523F
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D5250
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D527B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5295
WSAGetLastError.WS2_32 ref: 00007FFE1A4D52A4
WSAGetLastError.WS2_32 ref: 00007FFE1A4D52AC
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D52B9

Part of subcall function 00007FFE1A4D4594: _PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE1A4D45E9
Part of subcall function 00007FFE1A4D4594: PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D4628
Part of subcall function 00007FFE1A4D4594: select.WS2_32 ref: 00007FFE1A4D465C
Part of subcall function 00007FFE1A4D4594: PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D4667

WSAGetLastError.WS2_32 ref: 00007FFE1A4D52CC
WSAGetLastError.WS2_32 ref: 00007FFE1A4D52E1
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D531D

Strings

timed out, xrefs: 00007FFE1A4D5313

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
String ID: timed out
API String ID: 497267021-3163636755
Opcode ID: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction ID: 019459ac81abd5ee688be80a05557bf265453d930a03cc2e2e8286abb393603a
Opcode Fuzzy Hash: e8d612662e15c7c42ff97858117ad99e66a695495dedd8023d3accc3127b9541
Instruction Fuzzy Hash: 90418125F0CE4286FA645B77A44423D6290BF64FB4F1445F3CD4D82AB5CF3CA8A98682

Function 00007FFE1A4D6C9C Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6CCC
setsockopt.WS2_32 ref: 00007FFE1A4D6CF6
PyErr_Clear.PYTHON312 ref: 00007FFE1A4D6D03
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6D47
PyErr_Clear.PYTHON312 ref: 00007FFE1A4D6D5E
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6D88
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6DA4
PyErr_Format.PYTHON312 ref: 00007FFE1A4D6DC1
setsockopt.WS2_32 ref: 00007FFE1A4D6DE7
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6DF4

Strings

iiy*:setsockopt, xrefs: 00007FFE1A4D6D81
socket option is larger than %i bytes, xrefs: 00007FFE1A4D6DB1
iii:setsockopt, xrefs: 00007FFE1A4D6CC5
iiO!I:setsockopt, xrefs: 00007FFE1A4D6D20

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction ID: 6f81f14403cbba25b8125af1151c966e31d11d93c934b02f5bd46af8d581acc9
Opcode Fuzzy Hash: e5620e990f8220b448d5b59fe45baab9dc0f6dbd4740d24abe31777b74632af3
Instruction Fuzzy Hash: 50411B36708E8696EB208B12E4406B97361FB98FA8F5002B2DA9D83B64DF3CD559C740

Function 00007FFE1A4D4484 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D44A2
connect.WS2_32 ref: 00007FFE1A4D44B5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D44C0
WSAGetLastError.WS2_32 ref: 00007FFE1A4D44CE
WSAGetLastError.WS2_32 ref: 00007FFE1A4D44DA
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D44E7
WSASetLastError.WS2_32 ref: 00007FFE1A4D4501

Strings

3', xrefs: 00007FFE1A4D451A

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
String ID: 3'
API String ID: 4284410693-280543908
Opcode ID: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction ID: 719c435ed6e60e0005f8aca751b07f4cd2ce1872dd53e6d7f0bacf021e15fc1b
Opcode Fuzzy Hash: ed0aa6f5daee608154e3db044a1abba8314d7115e20110d062241df6d74eb585
Instruction Fuzzy Hash: CA315035F08F4286E7604F67A8541B92690AF68FB4F1405F6EA5E83BB6DF3CE4608644

Function 00007FFE1A4D6198 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D61C0
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D61E5
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1A4D61F5
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D6230
_PyBytes_Resize.PYTHON312 ref: 00007FFE1A4D6247

Strings

n|i:recv, xrefs: 00007FFE1A4D61B9
negative buffersize in recv, xrefs: 00007FFE1A4D61DB

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Bytes_SizeString$Arg_DeallocErr_FromParseResizeTuple_
String ID: negative buffersize in recv$n|i:recv
API String ID: 1342606314-3647384195
Opcode ID: 29fb8dffb30c6af5d72d23fc4fc4b8e2e26d01538630a85b1ae85e9e50577ef5
Instruction ID: 92638ce2274e94d7ea1ede7394e4cd0b0bde5c9d1228ef149d8fb91e4021e8bc
Opcode Fuzzy Hash: 29fb8dffb30c6af5d72d23fc4fc4b8e2e26d01538630a85b1ae85e9e50577ef5
Instruction Fuzzy Hash: FB114D75B19E4281EA148B52E440179E361FFA8FA4F0400F7D98D86BB6DF7CE168C740

Function 00007FFE1A4D599C Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE1A4D5A2C
_PyLong_AsInt.PYTHON312 ref: 00007FFE1A4D5A4B
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D5A58
_PyLong_AsInt.PYTHON312 ref: 00007FFE1A4D5A72
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D5A7F
_PyLong_AsInt.PYTHON312 ref: 00007FFE1A4D5A99
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D5AA7

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction ID: ad9d903b6470c5a7dd712bfdfe990ccfd801958d95b6ef34a59476cdc60f0860
Opcode Fuzzy Hash: eaa410074ab6af26ceaef7c7596cb67db9cb42dc3dbf0cc41afd0b861dd1535a
Instruction Fuzzy Hash: 1941A362B09E5242FE509B37A4543782291BF24FB4F1846F7DE1D47BA0EF7CE4648291

Function 00007FFE1A4D67E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D680B

Part of subcall function 00007FFE1A4D5190: WSAGetLastError.WS2_32 ref: 00007FFE1A4D5237
Part of subcall function 00007FFE1A4D5190: WSAGetLastError.WS2_32 ref: 00007FFE1A4D523F
Part of subcall function 00007FFE1A4D5190: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D5250

PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6870
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D687A
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE1A4D6885

Strings

y*|i:send, xrefs: 00007FFE1A4D6804

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Buffer_ErrorLastRelease$Arg_CheckErr_FromLong_ParseSignalsSizeSsize_tTuple_
String ID: y*|i:send
API String ID: 3302300731-3140140677
Opcode ID: 95aff07904a5713212a361be42d32b99a9b670a8c5ed14225624f7d16d8b4274
Instruction ID: aea136fe3580fec84b268327871acd3257bd85b71168774f3a954acb57867883
Opcode Fuzzy Hash: 95aff07904a5713212a361be42d32b99a9b670a8c5ed14225624f7d16d8b4274
Instruction Fuzzy Hash: 2A118C32718F4582E7508F26E4003AAB3A0FB98B94F1000B2EA8D83B64DF3CD458CB40

Function 00007FFE1A4D53A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFE1A4D3DD0: PyErr_Format.PYTHON312 ref: 00007FFE1A4D4154

PySys_Audit.PYTHON312 ref: 00007FFE1A4D53FC

Part of subcall function 00007FFE1A4D4484: PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D44A2
Part of subcall function 00007FFE1A4D4484: connect.WS2_32 ref: 00007FFE1A4D44B5
Part of subcall function 00007FFE1A4D4484: PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D44C0
Part of subcall function 00007FFE1A4D4484: WSAGetLastError.WS2_32 ref: 00007FFE1A4D44CE
Part of subcall function 00007FFE1A4D4484: WSAGetLastError.WS2_32 ref: 00007FFE1A4D44DA
Part of subcall function 00007FFE1A4D4484: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D44E7
Part of subcall function 00007FFE1A4D4484: WSASetLastError.WS2_32 ref: 00007FFE1A4D4501

Strings

socket.connect, xrefs: 00007FFE1A4D53F5
connect, xrefs: 00007FFE1A4D53C3

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction ID: 9434b28b99d2cf09b4e17eb36887163c5466a6b77fd7b29134f023aff308f2ad
Opcode Fuzzy Hash: f61d2d1e51494460e737621043c48afaf6b2b37121598ef846ec6ce56cffa346
Instruction Fuzzy Hash: 30110921758E8281EA209B22F4507B66760BB68BA4F5410F3DA4D47A6ADE2CE165C741

Function 00007FFE1A4D6894 Relevance: 1.5, APIs: 1, Instructions: 19
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 00007FFE1A4D68C3

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction ID: 127543ba2f6b114f07354373f30f3625a46467e1ffca70d496ac844b88240984
Opcode Fuzzy Hash: 857e2324bf16085a4ea68c05b138027c44fdbe11cde1698f6f4c9787cdbcdc49
Instruction Fuzzy Hash: E4E0DFF2F10A4582E7145B26E0402787360F719FB4F245322CA385B3E0CE38C4E1C340

Function 00007FFE1A4D62B4 Relevance: 1.5, APIs: 1, Instructions: 19
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FFE1A4D62E3

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction ID: 14eee794d39fc74cfe6ef799cdfff32cd6c97e1f207c6f194fb9e82532770c1f
Opcode Fuzzy Hash: a704ae423db7ff80c5d8b78b9383ad9a6b728f341f5aa79d46b21ad35153d223
Instruction Fuzzy Hash: 9DE04FF2B10A4582D7145B56E04027873A1F719FB4F245762CA385B7E0DE38D4F1C740

Non-executed Functions

Function 00007FFE1A4D3B20 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 181networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FFE1A4D3B4A

Part of subcall function 00007FFE1A4D4B14: _Py_BuildValue_SizeT.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B2F
Part of subcall function 00007FFE1A4D4B14: PyErr_SetObject.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B44
Part of subcall function 00007FFE1A4D4B14: _Py_Dealloc.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B58

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4D3B6E
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE1A4D3B84

Strings

NOO, xrefs: 00007FFE1A4D3D43
unsupported address family, xrefs: 00007FFE1A4D3D62
surrogatepass, xrefs: 00007FFE1A4D3D2E

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_$BuildDeallocErrnoErrorFromLastObjectSizeValue__errno
String ID: NOO$surrogatepass$unsupported address family
API String ID: 316901363-472101058
Opcode ID: b91f96f39c30ed59f8962875126381abc059683d57aa2602eb85b04b624b84c7
Instruction ID: 482bed587aef09550c6adc427dd213fabfe6acc1ced930757fa5f31dae8b9072
Opcode Fuzzy Hash: b91f96f39c30ed59f8962875126381abc059683d57aa2602eb85b04b624b84c7
Instruction Fuzzy Hash: 6A817336B09E4282EA558B22A44427963A1FF65FA5F1441F6DA4E837B5EF3CF4A1C700

Function 00007FFE1A4C1AA0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1A4C1ABC
memset.VCRUNTIME140 ref: 00007FFE1A4C1AE0
RtlCaptureContext.KERNEL32 ref: 00007FFE1A4C1AE9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1A4C1B03
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1A4C1B44
memset.VCRUNTIME140 ref: 00007FFE1A4C1B77
IsDebuggerPresent.KERNEL32 ref: 00007FFE1A4C1B98
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A4C1BB5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A4C1BC0

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction ID: 35955ea380cd88c5afe6130433c1b3de5cb2cdcb61fb92103e6c9080943de785
Opcode Fuzzy Hash: 99395305cdb11cdb041beb820624a25ea4585affacafc0dcd255409337a1a2bc
Instruction Fuzzy Hash: 20314D72708F8195EB608F66E8403F97360FB84B54F8440BADA4E47BADEF38D6588700

Function 00007FFE1333AA7C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1333AA98
memset.VCRUNTIME140 ref: 00007FFE1333AABC
RtlCaptureContext.KERNEL32 ref: 00007FFE1333AAC5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1333AADF
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1333AB20
memset.VCRUNTIME140 ref: 00007FFE1333AB53
IsDebuggerPresent.KERNEL32 ref: 00007FFE1333AB74
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1333AB91
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1333AB9C

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction ID: 666dc499c246deff3cc420c09ac71565fb68ad0c4031820e6f60615cdcce24ee
Opcode Fuzzy Hash: 012467218d5544a4534461b4b62cf789c3f5b00e1029445c7606c465824eddd2
Instruction Fuzzy Hash: 23314D76A08F818AEB608F62E8403EDB360FB94B54F04847ADA5D57BA4DF3CD649C714

Function 00007FFE13313E60 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13313E7C
memset.VCRUNTIME140 ref: 00007FFE13313EA0
RtlCaptureContext.KERNEL32 ref: 00007FFE13313EA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13313EC3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE13313F04
memset.VCRUNTIME140 ref: 00007FFE13313F37
IsDebuggerPresent.KERNEL32 ref: 00007FFE13313F58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13313F75
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13313F80

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction ID: 05411ecf56e7d4eea346f2e392f58426f41dcc72e0b6665c0272c05674886904
Opcode Fuzzy Hash: 3d249a4d3ec741f06bccba3fca43a7136d5c4f0ed13e34deacf6695f45bbc58d
Instruction Fuzzy Hash: 3E314872608F81DAEB608F61E8403E97760FB94764F44403ADA5E67AA6DF3CD6488718

Function 00007FFE1A4D3328 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1A4D3344
memset.VCRUNTIME140 ref: 00007FFE1A4D3368
RtlCaptureContext.KERNEL32 ref: 00007FFE1A4D3371
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1A4D338B
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1A4D33CC
memset.VCRUNTIME140 ref: 00007FFE1A4D33FF
IsDebuggerPresent.KERNEL32 ref: 00007FFE1A4D3420
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A4D343D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1A4D3448

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 5130b0c2a8b4ddc3ad2379c44f9e6e14e4431d38d65cb8e8484721bef110eafb
Instruction ID: 33badd70b1f6261bc93022f15ae25ab57d64bb51b799f7680370eea5847e5862
Opcode Fuzzy Hash: 5130b0c2a8b4ddc3ad2379c44f9e6e14e4431d38d65cb8e8484721bef110eafb
Instruction Fuzzy Hash: B2312A76709E818AEB608F61E8403FD6361FB94B54F4440BADA4E87BA5DF38D558C700

Function 00007FFE1A4D60CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D60EF
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D6107
listen.WS2_32 ref: 00007FFE1A4D6122
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D612D

Strings

|i:listen, xrefs: 00007FFE1A4D60E8

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveSizeTuple_listen
String ID: |i:listen
API String ID: 3610171639-1087349693
Opcode ID: e8d47ebe0e10a6c5cc8300ffc03bcd4294c79b16c36a614c1882deaffce03895
Instruction ID: f7ee6eefebf1e2383500e5549a7c678d49ac64216a17bcc270873ef1414a5c8f
Opcode Fuzzy Hash: e8d47ebe0e10a6c5cc8300ffc03bcd4294c79b16c36a614c1882deaffce03895
Instruction Fuzzy Hash: D301E125B28E4182EA548F57E884079A371FFA5FA0F1441F6DA4E83B65DF3CE4658740

Function 00007FFE1A4F94B8 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9A29
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9A5E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9A97

Strings

volatile, xrefs: 00007FFE1A4F98A2
decltype(auto), xrefs: 00007FFE1A4F9900
__int64, xrefs: 00007FFE1A4F975F
UNKNOWN, xrefs: 00007FFE1A4F992C
int, xrefs: 00007FFE1A4F9564
unsigned , xrefs: 00007FFE1A4F99E6
char8_t, xrefs: 00007FFE1A4F97D9
__int32, xrefs: 00007FFE1A4F976E
volatile, xrefs: 00007FFE1A4F98CF
__int8, xrefs: 00007FFE1A4F96D2
<unknown>, xrefs: 00007FFE1A4F97CA
void, xrefs: 00007FFE1A4F961C
__int128, xrefs: 00007FFE1A4F9750
__int16, xrefs: 00007FFE1A4F96C0
float, xrefs: 00007FFE1A4F960A
double, xrefs: 00007FFE1A4F95DE
const, xrefs: 00007FFE1A4F9887
char32_t, xrefs: 00007FFE1A4F99AB
wchar_t, xrefs: 00007FFE1A4F994A
short, xrefs: 00007FFE1A4F9576
this , xrefs: 00007FFE1A4F9971
__w64 , xrefs: 00007FFE1A4F96FC
signed , xrefs: 00007FFE1A4F99F6
char, xrefs: 00007FFE1A4F9588
char16_t, xrefs: 00007FFE1A4F97B8
long , xrefs: 00007FFE1A4F95C7
long, xrefs: 00007FFE1A4F9552
bool, xrefs: 00007FFE1A4F9780
auto, xrefs: 00007FFE1A4F97EB

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction ID: 2f1165035a5b7931de736ceed6315a28281418fb42edb2c0aa39cd436ba9ac27
Opcode Fuzzy Hash: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction Fuzzy Hash: C6028066F18E1288FB149F6ED9505FC3AB0BB05B65F4121F7CA0D92ABADF2C9514C340

Function 00007FFE1A4D3DD0 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 244
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyErr_Format.PYTHON312 ref: 00007FFE1A4D3E4C
PyErr_Format.PYTHON312 ref: 00007FFE1A4D4154
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D41B2
htons.WS2_32 ref: 00007FFE1A4D41CF

Strings

%s(): port must be 0-65535., xrefs: 00007FFE1A4D413F
%s(): flowinfo must be 0-1048575., xrefs: 00007FFE1A4D40A3
%s(): unsupported AF_HYPERV protocol: %d, xrefs: 00007FFE1A4D3E3E
%s(): wrong format, xrefs: 00007FFE1A4D3FA7
%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FFE1A4D3FFA
%s(): unknown Bluetooth protocol, xrefs: 00007FFE1A4D3F72
%s(): AF_HYPERV address vm_id is not a valid UUID string, xrefs: 00007FFE1A4D3EE9
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FFE1A4D40F7
%s(): AF_HYPERV address service_id is not a valid UUID string, xrefs: 00007FFE1A4D3F2C
UU;AF_HYPERV address must be a str tuple (vm_id, service_id), xrefs: 00007FFE1A4D3EB9
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FFE1A4D411A
%s(): AF_HYPERV address must be tuple, not %.500s, xrefs: 00007FFE1A4D3E8A
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FFE1A4D402A
%s(): bad family, xrefs: 00007FFE1A4D3E21

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_Format$Deallochtons
String ID: %s(): AF_HYPERV address must be tuple, not %.500s$%s(): AF_HYPERV address service_id is not a valid UUID string$%s(): AF_HYPERV address vm_id is not a valid UUID string$%s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): unsupported AF_HYPERV protocol: %d$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$UU;AF_HYPERV address must be a str tuple (vm_id, service_id)
API String ID: 2819711985-3631354148
Opcode ID: 2a7c56321471c2d82b95262e8f982d4fde5c20bb87aa390549c57e4e666f4892
Instruction ID: d0f9777f517d19164d1542395be5ab78f74080a8f18225381789b190ff78047b
Opcode Fuzzy Hash: 2a7c56321471c2d82b95262e8f982d4fde5c20bb87aa390549c57e4e666f4892
Instruction Fuzzy Hash: 72C11975B08E4686EB108F66D8441B823B1FB68FA8F5441F7DA4D93AA5DF3CE568C300

Function 00007FFE1A4D718C Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 260
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE1A4D7228
PyUnicode_AsEncodedString.PYTHON312 ref: 00007FFE1A4D7262
PyObject_Str.PYTHON312 ref: 00007FFE1A4D72A5
PyUnicode_AsUTF8.PYTHON312 ref: 00007FFE1A4D72CB
PySys_Audit.PYTHON312 ref: 00007FFE1A4D7329
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D735F
getaddrinfo.WS2_32 ref: 00007FFE1A4D7376
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D7382
PyList_New.PYTHON312 ref: 00007FFE1A4D73A4
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1A4D740F
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7429
PyList_Append.PYTHON312 ref: 00007FFE1A4D743E
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7457
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D747D
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7496
freeaddrinfo.WS2_32 ref: 00007FFE1A4D74A5
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D74C0
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D74D5
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D74EE
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7507
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7520
freeaddrinfo.WS2_32 ref: 00007FFE1A4D752F
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7548

Strings

OO|iiii:getaddrinfo, xrefs: 00007FFE1A4D71DC
iiisO, xrefs: 00007FFE1A4D7404
OOiii, xrefs: 00007FFE1A4D7306
getaddrinfo() argument 1 must be string or None, xrefs: 00007FFE1A4D753E
Int or String expected, xrefs: 00007FFE1A4D74E4
socket.getaddrinfo, xrefs: 00007FFE1A4D7317
idna, xrefs: 00007FFE1A4D725B

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Dealloc$String$Err_Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_Object_ParseRestoreSaveSys_TupleValue_getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 3469260611-1074899869
Opcode ID: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction ID: 744f7338838b86e50fd4beebd5c849a4b1f1881fc9e9c4a8bee87e5805d75495
Opcode Fuzzy Hash: 2f423c6ffa71151a3adb167c7cdb8e101b5c9d8c3bce7bb13a85d95737d9847a
Instruction Fuzzy Hash: 24C15836B08E8286EB15CF62D8545B837A1BB68FA4F1445F6DE4E92B65DF3CE464C300

Function 00007FFE1A4D78C8 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 162threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D791F
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D794F
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D7997
PySys_Audit.PYTHON312 ref: 00007FFE1A4D79CE
PyOS_snprintf.PYTHON312 ref: 00007FFE1A4D7A01
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D7A2F
getaddrinfo.WS2_32 ref: 00007FFE1A4D7A4B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D7A56
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7A91
htonl.WS2_32 ref: 00007FFE1A4D7AB1
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D7AC1
getnameinfo.WS2_32 ref: 00007FFE1A4D7AF9
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D7B04
PyUnicode_DecodeMBCS.PYTHON312 ref: 00007FFE1A4D7B52
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1A4D7B6B
freeaddrinfo.WS2_32 ref: 00007FFE1A4D7B8E

Strings

sockaddr resolved to multiple addresses, xrefs: 00007FFE1A4D7A80
getnameinfo() argument 1 must be a tuple, xrefs: 00007FFE1A4D7945
si|II;getnameinfo(): illegal sockaddr argument, xrefs: 00007FFE1A4D7990
getnameinfo(): flowinfo must be 0-1048575., xrefs: 00007FFE1A4D79B2
socket.getnameinfo, xrefs: 00007FFE1A4D79C7
IPv4 sockaddr must be 2 tuple, xrefs: 00007FFE1A4D7B27
, xrefs: 00007FFE1A4D7ADF
(O), xrefs: 00007FFE1A4D79C0
Oi:getnameinfo, xrefs: 00007FFE1A4D7914
surrogatepass, xrefs: 00007FFE1A4D7B47

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Size$Arg_Err_ParseRestoreSaveStringTuple_$AuditBuildDecodeS_snprintfSys_Unicode_Value_freeaddrinfogetaddrinfogetnameinfohtonl
String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo$surrogatepass
API String ID: 2526741257-243639936
Opcode ID: 04604c1635eafd80c084e70278c0c195183a3ebb5ddeaecdd157658cd547c5cb
Instruction ID: 5dd196d6d27a196c639c1e661c0f68dc3a7999fbe7726c05ff1041caa022b9e3
Opcode Fuzzy Hash: 04604c1635eafd80c084e70278c0c195183a3ebb5ddeaecdd157658cd547c5cb
Instruction Fuzzy Hash: DB812A76B08E8286EA10CB22E4401B967A1FB94FA4F1401B7DA4D87A79CF7CE555CB40

Function 00007FFE1A4D4C58 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 170threadstringCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D4CBD
getaddrinfo.WS2_32 ref: 00007FFE1A4D4CD9
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D4CE5
freeaddrinfo.WS2_32 ref: 00007FFE1A4D4D09
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D4D20
freeaddrinfo.WS2_32 ref: 00007FFE1A4D4D46
memcpy.VCRUNTIME140 ref: 00007FFE1A4D4D68
freeaddrinfo.WS2_32 ref: 00007FFE1A4D4D70
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A4D4D87
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A4D4D9E
inet_pton.WS2_32 ref: 00007FFE1A4D4DCA
strchr.VCRUNTIME140 ref: 00007FFE1A4D4DEF
inet_pton.WS2_32 ref: 00007FFE1A4D4E15
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D4E43
getaddrinfo.WS2_32 ref: 00007FFE1A4D4E5B
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D4E67
memcpy.VCRUNTIME140 ref: 00007FFE1A4D4EA1
freeaddrinfo.WS2_32 ref: 00007FFE1A4D4EA9

Strings

wildcard resolved to multiple address, xrefs: 00007FFE1A4D4D4C
unknown address family, xrefs: 00007FFE1A4D4EC2
address family mismatched, xrefs: 00007FFE1A4D4EDB
<broadcast>, xrefs: 00007FFE1A4D4D94
255.255.255.255, xrefs: 00007FFE1A4D4D7D
unsupported address family, xrefs: 00007FFE1A4D4D0F

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Threadfreeaddrinfo$RestoreSavegetaddrinfoinet_ptonmemcpystrcmp$Err_Stringstrchr
String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
API String ID: 535957624-1715193308
Opcode ID: 84e0856cd869813e583fc43c899fd160c3153486a779d11b04d7bc0fb41145c4
Instruction ID: 592739a99fbc4909c4c9981662d3df11b84a5ccc38cb5b15921bddd019f83421
Opcode Fuzzy Hash: 84e0856cd869813e583fc43c899fd160c3153486a779d11b04d7bc0fb41145c4
Instruction Fuzzy Hash: 1D719131B08E4292F7608F2694442B923A1FB68FA4F5442F7DA4D93AB6CF3CE565C704

Function 00007FFE1A4C22F8 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 206timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2356
PyErr_ExceptionMatches.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C236A
PyErr_SetString.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C23B6

Part of subcall function 00007FFE1A4C266C: PySequence_Fast.PYTHON312(00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2694

_PyDeadline_Init.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2471
PyEval_SaveThread.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24AB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24B4
select.WS2_32(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24CD
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24D9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24DF
PyErr_CheckSignals.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C24EE
_PyDeadline_Get.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C250B
_PyTime_AsTimeval_clamp.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2529
PyErr_Occurred.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2584
PyTuple_Pack.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C259D
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C25BA
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C25D3
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C25EC
WSAGetLastError.WS2_32(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2652
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2664

Part of subcall function 00007FFE1A4C266C: PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2709
Part of subcall function 00007FFE1A4C266C: PyErr_SetString.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C278F
Part of subcall function 00007FFE1A4C266C: _Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C27A3
Part of subcall function 00007FFE1A4C266C: _Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C27B7

Part of subcall function 00007FFE1A4C266C: _Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C27D2

Strings

timeout must be non-negative, xrefs: 00007FFE1A4C23AC
timeout must be a float or None, xrefs: 00007FFE1A4C237B

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction ID: 19dcd2808adbc9a0fad7816d2fe7eabdd9dc855fa228f389aeb2c35773c9da7b
Opcode Fuzzy Hash: d788fc8d8f2c4c3425777ff2c68e582025ccc74bbe31b0ae76aafc8d094d01c2
Instruction Fuzzy Hash: 7E911F61B08E8299EB21AF27D8541B963A0FF44FA4F8041B6DA4E476BCDF7CE655C700

Function 00007FFE1A4D4864 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1A4D48C0

Strings

iy#, xrefs: 00007FFE1A4D48B9
Unknown Bluetooth protocol, xrefs: 00007FFE1A4D498A
OiII, xrefs: 00007FFE1A4D4A1B

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: BuildSizeValue_
String ID: OiII$Unknown Bluetooth protocol$iy#
API String ID: 1740464280-1931379703
Opcode ID: 902a55de1e61e57d9b75f782d95346036916bf3d28d7f19c3b677d66217b6a38
Instruction ID: 19290d87be7ffb18f4ff35d1b7aec040acb2dee467dfa282e5bf632c66a5330a
Opcode Fuzzy Hash: 902a55de1e61e57d9b75f782d95346036916bf3d28d7f19c3b677d66217b6a38
Instruction Fuzzy Hash: FF513F35B08E4392EA244B23E4540B96361BF65FB0F4445F6CA5E87AB6EF3CE5A5C300

Function 00007FFE1A4FCDBC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE4D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE86
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCF5A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCF6B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCFCE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCFDE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD02A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD03C
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD1B1

Part of subcall function 00007FFE1A4FED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4FEDEE

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD233
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD242

Strings

`anonymous namespace', xrefs: 00007FFE1A4FD10E

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction ID: bead5cf35a395cf4b8663ef25634e8e427853c58fc4f84ceab9f584e24e07386
Opcode Fuzzy Hash: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction Fuzzy Hash: E6E16D72A08F8299EB10CF2AE8801FD77A0FB45B59F4061B6EA8D57B65DF38D525C700

Function 00007FFE133071F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE13307217
PyThread_allocate_lock.PYTHON312 ref: 00007FFE1330728A
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133072CA
_Py_Dealloc.PYTHON312 ref: 00007FFE1330736B
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE13307389
PyErr_Occurred.PYTHON312 ref: 00007FFE13307392
PyErr_SetString.PYTHON312 ref: 00007FFE133073E0
_Py_Dealloc.PYTHON312 ref: 00007FFE13314B1D
_Py_Dealloc.PYTHON312 ref: 00007FFE13314B4E

Strings

Invalid container format: %d, xrefs: 00007FFE13314B61
Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFE133073CF
Unable to allocate lock, xrefs: 00007FFE13314B2A
Must specify filters for FORMAT_RAW, xrefs: 00007FFE13314B04
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFE133073ED

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction ID: 8312ae15b9ebf1be1fdb7cce80b1522a4405a93e1eb51774fc5a3debb9ec3e0b
Opcode Fuzzy Hash: 83269ee791d243be0076bb43cd9e278918348ca24e3dda33455d90f1b8b1c2f8
Instruction Fuzzy Hash: 0A617921A08F42C9EA668F27A81427D77A4FF64BB4F0841B5DD2D2A6B5DF3CE445834C

Function 00007FFE13310CAC Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON312 ref: 00007FFE13310CD5
PyMem_Calloc.PYTHON312 ref: 00007FFE13310D2C
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13310E12
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE13310E3C
PyErr_Clear.PYTHON312 ref: 00007FFE13310E46

Part of subcall function 00007FFE13311E7C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE13310CFC), ref: 00007FFE13311E89
Part of subcall function 00007FFE13311E7C: PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE13310CFC), ref: 00007FFE13311E92

PyErr_SetString.PYTHON312 ref: 00007FFE13310E62
PyMem_Free.PYTHON312 ref: 00007FFE13310E6B
_Py_Dealloc.PYTHON312 ref: 00007FFE13315D46

Strings

|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFE13310DBF
preset, xrefs: 00007FFE13310CC8
Invalid filter specifier for LZMA filter, xrefs: 00007FFE13310E58
Invalid compression preset: %u, xrefs: 00007FFE13315D6B

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1879153319-1461672608
Opcode ID: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction ID: c55dd4dafa50e98963487e5259a387cf5d7b3ea1ef163d0d9a7e35ec02860947
Opcode Fuzzy Hash: f4c4c6e41dfebc803be0e4ebb02aeaa3e2e4c228a037d78fce276d899d29ed1e
Instruction Fuzzy Hash: 48516036A08F42C9EA208F12F4402A9B7A4FBA8BA4F544075CEAD17776DF3CE455C748

Function 00007FFE1A4D8270 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D829D
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D82C9
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D82D4
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D8303
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D830E
inet_ntop.WS2_32 ref: 00007FFE1A4D8335
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE1A4D834D
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D8358
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D8385
PyUnicode_FromString.PYTHON312 ref: 00007FFE1A4D838E
PyErr_Format.PYTHON312 ref: 00007FFE1A4D83AA
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D83B5

Strings

unknown address family %d, xrefs: 00007FFE1A4D839D
iy*:inet_ntop, xrefs: 00007FFE1A4D8291
invalid length of packed IP address string, xrefs: 00007FFE1A4D82BF, 00007FFE1A4D82F9

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Buffer_Release$Err_$String$From$Arg_ErrnoFormatParseSizeTuple_Unicode_inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 1507301079-2822559286
Opcode ID: 53b98e0b39da5fdef2c7c0ee4bcb4f09635da776308b6f8e1f3f5746954ec4bc
Instruction ID: af664442c91f02b9b27033ba2d04e1d95d7b158c8c71dc97717baaf9f1903434
Opcode Fuzzy Hash: 53b98e0b39da5fdef2c7c0ee4bcb4f09635da776308b6f8e1f3f5746954ec4bc
Instruction Fuzzy Hash: 7C31FB65B1CE4682EA608B16E8506B923A1FFA8F64F5004F3D54EC7A76DF3DE468C740

Function 00007FFE1A4D2950 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE1A4D296C
GetComputerNameExW.KERNEL32 ref: 00007FFE1A4D298D
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE1A4D29A4
GetLastError.KERNEL32 ref: 00007FFE1A4D3A6E
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D3A7D

Strings

socket.gethostname, xrefs: 00007FFE1A4D2965

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
String ID: socket.gethostname
API String ID: 1075394898-2650736202
Opcode ID: 25ae612990bab75232c8daec9245eaa7fbb0b38a1306ba03551d9cdaf76ece37
Instruction ID: 2d70ba532a292e36ccc6e75889200f1d96707d2f26bd033d2d62baa58cf2edb9
Opcode Fuzzy Hash: 25ae612990bab75232c8daec9245eaa7fbb0b38a1306ba03551d9cdaf76ece37
Instruction Fuzzy Hash: 35312525B0CF4282E7249B23A91427A63A2FFA9FA5F5444F7D54EC6BB5DF3CE4148600

Function 00007FFE1A4D7F30 Relevance: 24.1, APIs: 16, Instructions: 106COMMON

Download Yara Rule

APIs

PyList_New.PYTHON312 ref: 00007FFE1A4D7F4D
GetIfTable2Ex.IPHLPAPI ref: 00007FFE1A4D7F71
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D7F8B
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D7F93
memcpy.VCRUNTIME140 ref: 00007FFE1A4D7FD1
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FFE1A4D7FE9
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1A4D800C
PyList_Append.PYTHON312 ref: 00007FFE1A4D8020
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D803A
FreeMibTable.IPHLPAPI ref: 00007FFE1A4D8053
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D8092
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D80A6
FreeMibTable.IPHLPAPI ref: 00007FFE1A4D80B1
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D80C9
FreeMibTable.IPHLPAPI ref: 00007FFE1A4D80D4
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D80DC

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Dealloc$FreeTable$Err_FromList_Windows$AppendBuildConvertInterfaceLuidNameSizeTable2Value_memcpy
String ID:
API String ID: 1684791173-0
Opcode ID: 6e5f08eccdd5b29cfe341dff8070fb2ed0092c75082b83863e899f864d342429
Instruction ID: cfdd7d9b04584b03a9c14b014e664904df0306443338c7538b4b16e114a917ba
Opcode Fuzzy Hash: 6e5f08eccdd5b29cfe341dff8070fb2ed0092c75082b83863e899f864d342429
Instruction Fuzzy Hash: 09412E35B08E4282FB669B22E85437973A1EFA5F65F0544F6C94E82AB5DF3CE4648700

Function 00007FFE1A4FDC24 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE1A4F90F4), ref: 00007FFE1A4FE08A
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FE0C9
swprintf_s.PGOCR ref: 00007FFE1A4FE0E9
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FE0F9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FE149

Strings

`generic-class-parameter-, xrefs: 00007FFE1A4FE15A
lambda, xrefs: 00007FFE1A4FDFE8
`template-type-parameter-, xrefs: 00007FFE1A4FE16A
nullptr, xrefs: 00007FFE1A4FDE0D
`generic-method-parameter-, xrefs: 00007FFE1A4FE116
NULL, xrefs: 00007FFE1A4FDCF1

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction ID: 5471f19570d1ee83d7182e714f7ef01c2030f9fdde7a2e540bad0272dd722c33
Opcode Fuzzy Hash: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction Fuzzy Hash: 05F1A362F0CE1288FB249B6E95551FC27A0AF55F6AF5020F7DE4D16AB5DF3CA5288300

Function 00007FFE133081F0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE13308245
PyObject_GetBuffer.PYTHON312 ref: 00007FFE13308279
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE1330828A
PyBuffer_Release.PYTHON312 ref: 00007FFE133082BD
_PyNumber_Index.PYTHON312 ref: 00007FFE133082EF
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE13308300
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE1330835B
PyErr_Occurred.PYTHON312 ref: 00007FFE1330837B
_PyArg_BadArgument.PYTHON312 ref: 00007FFE13314D3E

Strings

argument 'data', xrefs: 00007FFE13314D30
decompress, xrefs: 00007FFE13314D37
contiguous buffer, xrefs: 00007FFE13314D29

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction ID: 9e65a5389bfa6924f535dc3356bc785296b5d8977155c88d1cfb60bb08a0c783
Opcode Fuzzy Hash: bd01afbcdf428c3c6fd1533d6da37d25cba52a063e969e166f86159c4183e5fb
Instruction Fuzzy Hash: C9418022A08F428AEA518F13E44027D7BA5FB69BA0F4441B1DE6D2B7B5DF3CE405C708

Function 00007FFE13333548 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE1333359F
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE133335E8
PyObject_GetBuffer.PYTHON312 ref: 00007FFE13333605
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE13333616
_PyNumber_Index.PYTHON312 ref: 00007FFE13333630
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE13333645
PyBuffer_Release.PYTHON312 ref: 00007FFE13333688

Strings

contiguous buffer, xrefs: 00007FFE1333B84D
decompress, xrefs: 00007FFE1333B85B
argument 'data', xrefs: 00007FFE1333B854

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction ID: af36f23ad89d5d41c951698ff80e7183b0af1196220fcafda224e8e90464a6b3
Opcode Fuzzy Hash: 765b22e1d0c43746eefacce39cc61ecbcbbe27cbcf58c331b942709e186efdb8
Instruction Fuzzy Hash: 69415B22A18F468AEA509B13D4446B8A3A0FB68FB4F44C171DD6D677B4DF3CE549C704

Function 00007FFE1A4D5EDC Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D5F1E
PyErr_Format.PYTHON312 ref: 00007FFE1A4D5F60
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D5F9B
WSAIoctl.WS2_32 ref: 00007FFE1A4D5FD4
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6008
WSAIoctl.WS2_32 ref: 00007FFE1A4D6045
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1A4D6053
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6077
WSAIoctl.WS2_32 ref: 00007FFE1A4D60B4

Strings

k(kkk):ioctl, xrefs: 00007FFE1A4D6001
invalid ioctl command %lu, xrefs: 00007FFE1A4D5F56
kI:ioctl, xrefs: 00007FFE1A4D5F94, 00007FFE1A4D6070
kO:ioctl, xrefs: 00007FFE1A4D5F17

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Ioctl$Err_FormatFromLongLong_Unsigned
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 1148432870-4238462244
Opcode ID: 3f76204c42d358388be91a2e0fa01af582f79ca479d8e6d2f391cea6ebf1b823
Instruction ID: 5a421316eb14cf6f0f77b56f2afa3ab0b6f0a5f5979e641b72cc8b1a64236551
Opcode Fuzzy Hash: 3f76204c42d358388be91a2e0fa01af582f79ca479d8e6d2f391cea6ebf1b823
Instruction Fuzzy Hash: 0B512E31B18E4289E750CB76E8405FD33B1FB58B68F5401B6EA4D97A68DF38D564C740

Function 00007FFE1A4D4284 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON312 ref: 00007FFE1A4D42C5
PyBytes_Size.PYTHON312 ref: 00007FFE1A4D42D2
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D4374
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D43FB

Strings

host name must not contain null character, xrefs: 00007FFE1A4D4401
str, bytes or bytearray expected, not %s, xrefs: 00007FFE1A4D4399
encoding of hostname failed, xrefs: 00007FFE1A4D4363
idna, xrefs: 00007FFE1A4D434B

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Bytes_String$DeallocErr_Size
String ID: encoding of hostname failed$host name must not contain null character$idna$str, bytes or bytearray expected, not %s
API String ID: 2522550923-2120988924
Opcode ID: 4bff7bdefa987b91148ee3b18d677af03c6520adca83e4b60bb055ec74d24b36
Instruction ID: b77c8facfdc089531f0447b1ecb4a9dcdb5fc4b939e01621c322727bccf100d3
Opcode Fuzzy Hash: 4bff7bdefa987b91148ee3b18d677af03c6520adca83e4b60bb055ec74d24b36
Instruction Fuzzy Hash: 66414D35B19F4282EB548B17E4503B823A1EB64FA4F2455F2CA5E877A2DF3CE4B58300

Function 00007FFE1A4D6A44 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON312 ref: 00007FFE1A4D6A7A
PyErr_Format.PYTHON312 ref: 00007FFE1A4D6AA3
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6ACB
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6AEE
PySys_Audit.PYTHON312 ref: 00007FFE1A4D6B3C
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6BB0
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE1A4D6BBB
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6BC7

Strings

sendto() takes 2 or 3 arguments (%zd given), xrefs: 00007FFE1A4D6A96
y*iO:sendto, xrefs: 00007FFE1A4D6AC4
y*O:sendto, xrefs: 00007FFE1A4D6AE7
sendto, xrefs: 00007FFE1A4D6B01
socket.sendto, xrefs: 00007FFE1A4D6B35

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: SizeTuple_$Arg_Buffer_ParseRelease$AuditErr_FormatFromLong_Ssize_tSys_
String ID: sendto$sendto() takes 2 or 3 arguments (%zd given)$socket.sendto$y*O:sendto$y*iO:sendto
API String ID: 3528750861-2448770124
Opcode ID: 0194c0e6244d6a72a08d98085803f7896a3b58e6dc587eada0c3a2fa3e416755
Instruction ID: c2a2de0d304e499812577f5c13fd17a790bc8a53cfbd2c9a52588646c0b93329
Opcode Fuzzy Hash: 0194c0e6244d6a72a08d98085803f7896a3b58e6dc587eada0c3a2fa3e416755
Instruction Fuzzy Hash: D741FC35718E4685EB10CF66E8502BA77A5FB98B98F5001B3DA8D83B68DF7CD518C740

Function 00007FFE13311110 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE13311156
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13311197
PyThread_allocate_lock.PYTHON312 ref: 00007FFE133111FE
PyErr_Format.PYTHON312 ref: 00007FFE13311286
_Py_Dealloc.PYTHON312 ref: 00007FFE13311299
PyErr_SetString.PYTHON312 ref: 00007FFE13311319
_Py_Dealloc.PYTHON312 ref: 00007FFE13315E05

Strings

Invalid container format: %d, xrefs: 00007FFE1331127C
|iiOO:LZMACompressor, xrefs: 00007FFE13311169
Unable to allocate lock, xrefs: 00007FFE13315E12
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFE13315DEC
Cannot specify both preset and filter chain, xrefs: 00007FFE13311308

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 1600877341-3984722346
Opcode ID: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction ID: 3c6104e981f12dc98862fc2b481b6e8b5c96c191ad70a71d21303b6d75269d09
Opcode Fuzzy Hash: 1e688a17dabf5163ed9c27b377d890ab5408a498247c306a90725e182f9f5b69
Instruction Fuzzy Hash: 19612932E08F12CDEB508B26E8400B877A5FB68BA8B540572DE2D67769DF3CD545C748

Function 00007FFE1A4FB280 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FB2D1
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FB39A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FB3E3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FB3F4

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction ID: 0b919e3f86e7e45364469907f048677035d811bbb94f862b236026428db8a618
Opcode Fuzzy Hash: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction Fuzzy Hash: 14F19B76B08A829DF700DF6AE4901FC37B0EB05B5DB4450B3DA4D57AA9DE38D926C340

Function 00007FFE13310B5C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310B81
PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310B9B
PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310BB0
PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310BC7
PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310C40
PyErr_Format.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310C89
PyErr_SetString.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310CA2
_Py_Dealloc.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13315D3A

Strings

Filter specifier must have an "id" entry, xrefs: 00007FFE13310C98
Invalid filter ID: %llu, xrefs: 00007FFE13310C7C
Filter specifier must be a dict or dict-like object, xrefs: 00007FFE13315D2B

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction ID: ff14f56372c3ab89f6f5dfd95314e71ed4a841016e7e76143313142c18dbfe07
Opcode Fuzzy Hash: 0c5f6f5e7484fbb015a79b71ea40a48de156ee4d8636223415d5697c2780f545
Instruction Fuzzy Hash: C5411231B08E03C9EA658F17E454139A7A0FF65BA4F0480B1CA6E6A772DE3CE491C70C

Function 00007FFE1A4D75A4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D75E0
PySys_Audit.PYTHON312 ref: 00007FFE1A4D7602
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7668
PyMem_Free.PYTHON312 ref: 00007FFE1A4D76D5

Strings

et:gethostbyaddr, xrefs: 00007FFE1A4D75D7
unsupported address family, xrefs: 00007FFE1A4D765E
socket.gethostbyaddr, xrefs: 00007FFE1A4D75FB
idna, xrefs: 00007FFE1A4D75CD

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Arg_AuditErr_FreeMem_ParseSizeStringSys_Tuple_
String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
API String ID: 1738687268-1751716127
Opcode ID: 17dc3cb58174f4dc7df811a36dd272339ac8b6b8490b7850cf16da8a9be953b1
Instruction ID: 593ef473e14bfa0cf179f60c73f80f9022fb0e3ccf4ad12ee0d759eea34b9ab6
Opcode Fuzzy Hash: 17dc3cb58174f4dc7df811a36dd272339ac8b6b8490b7850cf16da8a9be953b1
Instruction Fuzzy Hash: AE315E65B08E8682E620CB17E8547BA6361BBA8FE0F4440F3DE8D87B65DE3CD4588740

Function 00007FFE1A4D6660 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE1A4D66AF
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D66C8
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D66DF
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6728
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D6743
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6757
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D6769
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE1A4D677E

Strings

negative buffersize in recvfrom_into, xrefs: 00007FFE1A4D66CE
w*|ni:recvfrom_into, xrefs: 00007FFE1A4D667E
nbytes is greater than the length of the buffer, xrefs: 00007FFE1A4D675D

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Buffer_Release$Size$Arg_BuildDeallocErr_Keywords_ParseStringTupleValue_
String ID: nbytes is greater than the length of the buffer$negative buffersize in recvfrom_into$w*|ni:recvfrom_into
API String ID: 252658603-4033050226
Opcode ID: cbd05dbb59b33da20bee7d15abf173420b95374231d8228cad919bc37cd99a43
Instruction ID: ae997465583efff042605c6ab2cae93c839e7a88f2015500ba09ddd521df02d1
Opcode Fuzzy Hash: cbd05dbb59b33da20bee7d15abf173420b95374231d8228cad919bc37cd99a43
Instruction Fuzzy Hash: 1B314A75B0CF4281EA108B52E4442B9B361FBA9FA4F5000B7DA9D83A61DF7DE468C700

Function 00007FFE13310710 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE13310741
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE13310756
PyErr_Occurred.PYTHON312 ref: 00007FFE1331075F
PyObject_GetBuffer.PYTHON312 ref: 00007FFE13310776
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE13310787
PyBuffer_Release.PYTHON312 ref: 00007FFE133107B5
_PyArg_CheckPositional.PYTHON312 ref: 00007FFE13315C03
_PyArg_BadArgument.PYTHON312 ref: 00007FFE13315C2F

Part of subcall function 00007FFE133107D4: PyModule_GetState.PYTHON312(?,?,?,?,?,00007FFE133107A5), ref: 00007FFE133107E6
Part of subcall function 00007FFE133107D4: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310822

Strings

argument 2, xrefs: 00007FFE13315C21
_decode_filter_properties, xrefs: 00007FFE13315BF9, 00007FFE13315C28
contiguous buffer, xrefs: 00007FFE13315C1A

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction ID: 3bad2e7188b76af4eff2b45381826507058cbece111a0553e579d2079da0b769
Opcode Fuzzy Hash: 6ac779201fb040bc529056ec0a6a5a048fdef9ca7122a7e56471178991ab58fb
Instruction Fuzzy Hash: 8531A222B08E42C9EA508F23D8441B9A360FFA4F94F5881B1DA6D67676DF3CE549C708

Function 00007FFE133086B8 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE13308707
PyErr_NoMemory.PYTHON312 ref: 00007FFE13314E18

Strings

Corrupt input data, xrefs: 00007FFE1330874B
Memory usage limit exceeded, xrefs: 00007FFE13308735
Invalid or unsupported options, xrefs: 00007FFE13308742
Unsupported integrity check, xrefs: 00007FFE13314E24
Input format not supported by decoder, xrefs: 00007FFE133086FC
Internal error, xrefs: 00007FFE1330872C
Unrecognized error from liblzma: %d, xrefs: 00007FFE13314E37
Insufficient buffer space, xrefs: 00007FFE13308754

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction ID: 3efc25fc4e0d5108c0fe12791caac93c36c8f8cbf40915bfd2fa17d82f87826e
Opcode Fuzzy Hash: e667bd3184b1031ca586e5cabd8905ebea692642c7ea9d8a448339030e972199
Instruction Fuzzy Hash: 2A217C61E2CE23CDFAB8471B945407C1AA1AF71B70F6060B1D12E7DAB99E6DF944C60C

Function 00007FFE1A4D7C20 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D7C41
PySys_Audit.PYTHON312 ref: 00007FFE1A4D7C67
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D7C7B
getservbyname.WS2_32 ref: 00007FFE1A4D7C8E
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D7C9A
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7CBB
htons.WS2_32 ref: 00007FFE1A4D7CD1
PyLong_FromLong.PYTHON312 ref: 00007FFE1A4D7CDA

Strings

socket.getservbyname, xrefs: 00007FFE1A4D7C60
service/proto not found, xrefs: 00007FFE1A4D7CB1
s|s:getservbyname, xrefs: 00007FFE1A4D7C30

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditErr_FromLongLong_ParseRestoreSaveSizeStringSys_Tuple_getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 1135235387-1257235949
Opcode ID: 3b5f47b3c7fe93ff51d3c351ac1364b9cc3afc28ca2730272accc108aa8dca2c
Instruction ID: fc7f030ad4aa276064ac1b5f8e0d425d14ef52d1f62d5e4d861a76b0671c87ec
Opcode Fuzzy Hash: 3b5f47b3c7fe93ff51d3c351ac1364b9cc3afc28ca2730272accc108aa8dca2c
Instruction Fuzzy Hash: B011B825B08E4292EA408B17E8442B967B1FBA9FA5F5400F7DA8DC3A75DF3CD469C740

Function 00007FFE1A4F3334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A4F3390

Part of subcall function 00007FFE1A4F5768: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A4F57AB
Part of subcall function 00007FFE1A4F5768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A4F57D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A4F3468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F3475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A4F36B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F36E7

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F37AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4F37E2

Strings

csm, xrefs: 00007FFE1A4F33AA
csm, xrefs: 00007FFE1A4F3411
csm, xrefs: 00007FFE1A4F348D

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction ID: 971e8ab3a845f84856dca0f30f1be0c11b4f28642ff98f675f7c41cae1aca850
Opcode Fuzzy Hash: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction Fuzzy Hash: 32D1A172B08B4186EB609B6AD4402FD77A0FB45FA9F1051B6EE9D57B65CF38E0A0C700

Function 00007FFE1A4FED94 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4FEDEE

Strings

generic-type-, xrefs: 00007FFE1A4FEE97
`template-parameter-, xrefs: 00007FFE1A4FEE83
template-parameter-, xrefs: 00007FFE1A4FEE50
`generic-type-, xrefs: 00007FFE1A4FEECA

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction ID: c2e5d4188087a6b6364d0d3c47ab70cc3329b4aa085a43a25eb761df1f5aafe4
Opcode Fuzzy Hash: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction Fuzzy Hash: 16919C62B08E4699FB208F2AE4506FC37A0AB95F6AF4461F3DA4D036A5DF3CE515C350

Function 00007FFE1A4D5850 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D5884
getsockopt.WS2_32 ref: 00007FFE1A4D58BF
PyLong_FromLong.PYTHON312 ref: 00007FFE1A4D58CD
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1A4D58E7
getsockopt.WS2_32 ref: 00007FFE1A4D5912
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D592C
_PyBytes_Resize.PYTHON312 ref: 00007FFE1A4D5941

Strings

getsockopt buflen out of range, xrefs: 00007FFE1A4D5955
ii|i:getsockopt, xrefs: 00007FFE1A4D5870

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Bytes_FromSizegetsockopt$Arg_DeallocLongLong_ParseResizeStringTuple_
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3532181676-2750947780
Opcode ID: 9b7346a9f4b417b4410470c21b5fb1116251040c05f54305fa742b3d80924aa3
Instruction ID: dfcf112e3c82134747d8c7991498f71179b66db95d237d8eb744b8fea14cb8ce
Opcode Fuzzy Hash: 9b7346a9f4b417b4410470c21b5fb1116251040c05f54305fa742b3d80924aa3
Instruction Fuzzy Hash: 32311A36B18E42C3EB148F26E44057A73A1FB94F64F5001B6E68E82A78DF3CD469CB40

Function 00007FFE1A4F9164 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F91CC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F92C9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9322
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F934E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9360
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F938F

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction ID: bde8f30efc8500cb715db9d26fd20002ac51cb98179bdaa125637bf139627a6e
Opcode Fuzzy Hash: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction Fuzzy Hash: 7D714072B04A429DEB11DF6AD4501FC33B1AB44B99B4154B3DA0D57AAADF38D625C380

Function 00007FFE13307FEC Relevance: 16.7, APIs: 11, Instructions: 154COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFE133080AD
memcpy.VCRUNTIME140 ref: 00007FFE133080D5
memcpy.VCRUNTIME140 ref: 00007FFE1330811F
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13308152
PyMem_Realloc.PYTHON312 ref: 00007FFE13308196
memmove.VCRUNTIME140 ref: 00007FFE133081C4
PyErr_SetNone.PYTHON312 ref: 00007FFE13314CC0
PyMem_Free.PYTHON312 ref: 00007FFE13314CE5
_Py_Dealloc.PYTHON312 ref: 00007FFE13314D19

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Mem_$memcpy$Bytes_DeallocErr_FreeFromMallocNoneReallocSizeStringmemmove
String ID:
API String ID: 1220578264-0
Opcode ID: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction ID: 4038676a3d15f2412ac78c481223bef4c1521bde6b2211ea8b91fa994f576e75
Opcode Fuzzy Hash: 85adeaa55f33651ef0f232b94068ae9b2308325af99af7830eee87ddd8bfa38a
Instruction Fuzzy Hash: 73514922A09F42C9EA648F26E94023D6AA5FF24FA4F184471CE6D3B765DF3CE4518308

Function 00007FFE1A4FAAC8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAB22
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAC58

Strings

union , xrefs: 00007FFE1A4FAC85
class , xrefs: 00007FFE1A4FAC6D
struct , xrefs: 00007FFE1A4FAC7C
coclass , xrefs: 00007FFE1A4FAC11
cointerface , xrefs: 00007FFE1A4FABFF
`unknown ecsu', xrefs: 00007FFE1A4FAAEE
enum , xrefs: 00007FFE1A4FAC35

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction ID: dc142ae1007668c113d511852d14d893e3801f61537a96b165f1d71457b2a700
Opcode Fuzzy Hash: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction Fuzzy Hash: 4B517A32F08E52D9FB10CB6AE9805FD37B1BB05B69F5050F6DA4D53AA9DF28A525C300

Function 00007FFE1A4D68DC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D691E
_PyDeadline_Get.PYTHON312 ref: 00007FFE1A4D6956
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D69C6
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D69DE
PyBuffer_Release.PYTHON312 ref: 00007FFE1A4D69F9
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D6A3C

Strings

timed out, xrefs: 00007FFE1A4D6A32
y*|i:sendall, xrefs: 00007FFE1A4D6904

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Buffer_Err_Release$Arg_CheckDeadline_ParseSignalsSizeStringTuple_
String ID: timed out$y*|i:sendall
API String ID: 1463051379-3431350491
Opcode ID: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction ID: 14bbbf472254636e47292877c6d9ec98488a1b4ef92cfa385cf8c34b6254568b
Opcode Fuzzy Hash: 00d1fe47f6855c3b5d42d86fbf0b7457282001a731998b6d4c743e6650992aaa
Instruction Fuzzy Hash: 00413D36B18E8286E7108F16E8402B9B361FB58FA4F5440B7DE4D93B69DF3CE4558700

Function 00007FFE1A4C1190 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1A4C11B8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1A4C120A
_RTC_Initialize.LIBCMT ref: 00007FFE1A4C1238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1A4C125E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1A4C1289

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction ID: 7291a482a635e2528ef57bb19a86f92220c5114e3a78de117f5edab36f043222
Opcode Fuzzy Hash: b57b117b731fe6fadf01a2aa5e6dfd03c7664753ee25818152bc9f2dcd8646e2
Instruction Fuzzy Hash: B0815E21F08F4386FB509B6B94412B96690AF45FA0FD481F7D90D876BEEF2CE9758600

Function 00007FFE1333A2F0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1333A318
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1333A36A
_RTC_Initialize.LIBCMT ref: 00007FFE1333A398
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1333A3BE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1333A3E9

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction ID: f43143037a2af97f04912535e28e7551c494a7f8a4de1400c6edfabb630b5a6b
Opcode Fuzzy Hash: 2eaa67de80a121e031fad50f9f59be50fff6b26d2a98fc10d8919c7430d16f7e
Instruction Fuzzy Hash: C6817021E0CE434DF654AB5794452B9A6A0AF75FA0F44C0B5E96CB73B2DE3CE4478708

Function 00007FFE13313550 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE13313578
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE133135CA
_RTC_Initialize.LIBCMT ref: 00007FFE133135F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1331361E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13313649

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction ID: b8b10102cacda8275ee5a3c3bb94186a91cfc485986e6cb90c5716a250ee066a
Opcode Fuzzy Hash: 425fd5ac1271bb133272e3ab21a2143b35eb579dd60372998353d793c77f0ddb
Instruction Fuzzy Hash: 9E81E121E0CE03CDFA609B2794412796AA1AF75BB0F4480B5E92C777B7DE7CE8058708

Function 00007FFE1A4D2A20 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1A4D2A48
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1A4D2A9A
_RTC_Initialize.LIBCMT ref: 00007FFE1A4D2AC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1A4D2AEE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1A4D2B19

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 91504536c4c753e82cdbe588412995d0809db0d3d25c664ce5a0f1fe9eeb7b4f
Instruction ID: 9425271022127b14d54fc9d797e5b70d0b6eebed08a9bb209336892adbd7116d
Opcode Fuzzy Hash: 91504536c4c753e82cdbe588412995d0809db0d3d25c664ce5a0f1fe9eeb7b4f
Instruction Fuzzy Hash: CC81AD31F08E4386FA60AB6794412B96291AFA5FB0F5440F7DA0C977B6DF7CE8658700

Function 00007FFE13333270 Relevance: 15.2, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE133332EE
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13333376
PyMem_Malloc.PYTHON312 ref: 00007FFE133333BE
memcpy.VCRUNTIME140 ref: 00007FFE133333EC
PyMem_Realloc.PYTHON312 ref: 00007FFE13333409
_Py_Dealloc.PYTHON312 ref: 00007FFE1333B81B

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Mem_memcpy$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 2377850682-0
Opcode ID: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction ID: dae0c7c2de2014b1312167120a1c26a0bab66a2500f21d63b83ce616d0b8a653
Opcode Fuzzy Hash: 41b2a13bf521d5b7757f118eec8ced83366289b083df3c13bbfcfecfc1a8147d
Instruction Fuzzy Hash: 68513732A09F8289EA149F239444279A2A4FB64FB4F18C475DEAD66764DF3CE0558309

Function 00007FFE1A4D7090 Relevance: 15.1, APIs: 10, Instructions: 60networkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON312 ref: 00007FFE1A4D70AE
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D70BD
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A4D70C8
WSADuplicateSocketW.WS2_32 ref: 00007FFE1A4D70D8
WSASocketW.WS2_32 ref: 00007FFE1A4D710B
SetHandleInformation.KERNEL32 ref: 00007FFE1A4D7125
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D7131
closesocket.WS2_32 ref: 00007FFE1A4D713A
PyLong_FromLongLong.PYTHON312 ref: 00007FFE1A4D714F
closesocket.WS2_32 ref: 00007FFE1A4D7160

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Long$Err_FromLong_Socketclosesocket$CurrentDuplicateHandleInformationOccurredProcessWindows
String ID:
API String ID: 3394293678-0
Opcode ID: 4c347251b0cb3e997720691e5f1e8047ee37cb6823bc12014edeb51918814818
Instruction ID: d87c6fb586d34dfeba6562ef7b868873682972227070a64057e262d44a30d900
Opcode Fuzzy Hash: 4c347251b0cb3e997720691e5f1e8047ee37cb6823bc12014edeb51918814818
Instruction Fuzzy Hash: 61212925B19F8241FA149B33A81877D2291AF65FB4F0407F6D86E867F5EF3CE4548600

Function 00007FFE1A4F37F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A4F3996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F39A3

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F3C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F3CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4F3CD7

Strings

csm, xrefs: 00007FFE1A4F39BF
csm, xrefs: 00007FFE1A4F38DD
csm, xrefs: 00007FFE1A4F393F

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction ID: 539e5dce937855c054775bf89cc8f801e92793dfe13add888d407c127115af89
Opcode Fuzzy Hash: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction Fuzzy Hash: 80E1AF73A08B828AE7509F3AD4802FD77A0FB45B69F1011B6DE9D57666CF38E591C700

Function 00007FFE13331ED4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1333B22A

Strings

VUUU, xrefs: 00007FFE13331F91
%d work, %d block, ratio %5.2f, xrefs: 00007FFE1333B210
too repetitive; using fallback sorting algorithm, xrefs: 00007FFE1333B233

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction ID: 900881e2a692d4f3e4be50117181fe0cf56327b900b4cdbd1cb0ce920f38f484
Opcode Fuzzy Hash: c9a2b1f2fff8b693f84e6fade5b350d543d714228db9c5a9fe61d7526b9c9b01
Instruction Fuzzy Hash: 2C41A432E08A418BE614AF26D445178B3A5FBA8F64F109376DE5E637B6DF3CD4828704

Function 00007FFE1A4C266C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON312(00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2694
PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2709
PyErr_SetString.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C278F
_Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C27A3
_Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C27B7

Strings

too many file descriptors in select(), xrefs: 00007FFE1A4C2785
arguments 1-3 must be sequences, xrefs: 00007FFE1A4C268D

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction ID: 25331bbf132676854c5c237850400e37a49ef93d979f8a3ff54f22672dbdec2a
Opcode Fuzzy Hash: 663c9d7e54148f1ae31ea019f9802c07c2ccdac2675d68113b08dfc84bed29b7
Instruction Fuzzy Hash: DF416D76B09F1285EB149F16E58417873A1FB94FB4F9042B2CA5E437A8DF78E464C300

Function 00007FFE1A4FC7F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FC9AC

Part of subcall function 00007FFE1A4F94B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9A29
Part of subcall function 00007FFE1A4F94B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F9A5E

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FC95E

Strings

void, xrefs: 00007FFE1A4FC842
std::nullptr_t , xrefs: 00007FFE1A4FC8EA
void , xrefs: 00007FFE1A4FC86A
cli::pin_ptr<, xrefs: 00007FFE1A4FC975
cli::array<, xrefs: 00007FFE1A4FC92B
std::nullptr_t, xrefs: 00007FFE1A4FC8D7

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction ID: 2e94645da66a4ae6e83184eabb20eb62a7ea2f3734a9f94829ea3183d40d1a2a
Opcode Fuzzy Hash: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction Fuzzy Hash: 8E514A62F08F5188FB118B6AE8406FC3BB0BB49B6AF4451F7DA4D12AA5DF3C9164C714

Function 00007FFE13332690 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE133326BA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE133326CA
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE133326DB
PyBuffer_Release.PYTHON312 ref: 00007FFE13332706
_PyArg_BadArgument.PYTHON312 ref: 00007FFE1333B45A

Part of subcall function 00007FFE133325FC: PyThread_acquire_lock.PYTHON312 ref: 00007FFE1333261F
Part of subcall function 00007FFE133325FC: PyThread_release_lock.PYTHON312 ref: 00007FFE1333264B

Strings

argument, xrefs: 00007FFE1333B44C
contiguous buffer, xrefs: 00007FFE1333B445
compress, xrefs: 00007FFE1333B453

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction ID: c279009ba33f63c4f6b98a457dafcedb5af50a6f5366ba24826ef42f9c98d0eb
Opcode Fuzzy Hash: 14121d2eb2f0784b8e94f491fcd0c9020d2f8b8e0951888bcb593b8e05aee52d
Instruction Fuzzy Hash: 54119322B18E4295EB10DB27E4442B9A360FF68FA4F94C171D96DA3674DF3CD649C704

Function 00007FFE133084D0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE133084FA
PyObject_GetBuffer.PYTHON312 ref: 00007FFE1330850A
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE1330851B
PyBuffer_Release.PYTHON312 ref: 00007FFE13308546
_PyArg_BadArgument.PYTHON312 ref: 00007FFE13314D8A

Part of subcall function 00007FFE13309010: PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13309036
Part of subcall function 00007FFE13309010: PyThread_release_lock.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13309068

Strings

argument, xrefs: 00007FFE13314D7C
compress, xrefs: 00007FFE13314D83
contiguous buffer, xrefs: 00007FFE13314D75

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction ID: 86d61b786d589116147827ba6a5b12a50496472530ae3c61d5ce91c0a1a80655
Opcode Fuzzy Hash: e49fcee8418d40925be70ffaeb55ce411285ea8029e7bf477f1f0c24e54d7857
Instruction Fuzzy Hash: F0119362B08E46C5EB20CF27E4402B96760FBA8B94F944171DA6D67635DF3CD54AC708

Function 00007FFE1A4D855C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

_PyTime_FromSeconds.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D8573
_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D858A
PyErr_SetString.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D85AD
_PyTime_AsTimeval.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D85CA
_PyTime_AsMilliseconds.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D85DD
PyErr_SetString.PYTHON312(?,?,?,00007FFE1A4D6E2F), ref: 00007FFE1A4D860B

Strings

timeout doesn't fit into C timeval, xrefs: 00007FFE1A4D8601
Timeout value out of range, xrefs: 00007FFE1A4D85A3

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Time_$Err_FromSecondsString$MillisecondsObjectTimeval
String ID: Timeout value out of range$timeout doesn't fit into C timeval
API String ID: 4240314503-2798848688
Opcode ID: c3110628e0ff8c45ed48e6e42bc6a9de53dce8f64d393fbe66996934f00f37bc
Instruction ID: 9ef813680980977f0758b112fab839694b55a75a80e669c05aaef59ce2a55a16
Opcode Fuzzy Hash: c3110628e0ff8c45ed48e6e42bc6a9de53dce8f64d393fbe66996934f00f37bc
Instruction Fuzzy Hash: BB113025B08E0282FB514B67D8602743352AFA5FB4F1046F6D92EC7BF1DE6CE4648340

Function 00007FFE1A4D7B9C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 32threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D7BAF
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D7BC7
getprotobyname.WS2_32 ref: 00007FFE1A4D7BD5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D7BE1
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7C02

Strings

s:getprotobyname, xrefs: 00007FFE1A4D7BA8
protocol not found, xrefs: 00007FFE1A4D7BF8

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveSizeStringTuple_getprotobyname
String ID: protocol not found$s:getprotobyname
API String ID: 862796068-630402058
Opcode ID: 5e26fb8bbdc9310467d939e6e5269e35e791270880cd3d67430df1cfafc901d3
Instruction ID: c8814c5f6f8dd41631827312299bec79876213a18f2ee12a7d2d869325aaa8a8
Opcode Fuzzy Hash: 5e26fb8bbdc9310467d939e6e5269e35e791270880cd3d67430df1cfafc901d3
Instruction Fuzzy Hash: 24011E29B18E4282DA549B23E94417963A1FBA8FA1F5404F7CA4EC3B75DF3CD0648700

Function 00007FFE1A4D8170 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D8183
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A4D8199
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1A4D81B4
inet_addr.WS2_32 ref: 00007FFE1A4D81C4
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D81E4

Strings

s:inet_aton, xrefs: 00007FFE1A4D817C
illegal IP address string passed to inet_aton, xrefs: 00007FFE1A4D81DA
255.255.255.255, xrefs: 00007FFE1A4D8192

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: SizeString$Arg_Bytes_Err_FromParseTuple_inet_addrstrcmp
String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
API String ID: 717551241-4110412280
Opcode ID: 084e9850ab497b4604530a89a794d3b40a20c62355ffc3e93d442b1fc817a547
Instruction ID: 44eca1369f662e13ab67c61c93052ce2f6fb02ab196894d5d669f993ad8d5fee
Opcode Fuzzy Hash: 084e9850ab497b4604530a89a794d3b40a20c62355ffc3e93d442b1fc817a547
Instruction Fuzzy Hash: 92011A64B08D0282FA109B26E8500792372EFA5FB4F5401F7D61DC66B5DF3DE469C740

Function 00007FFE1A4D4F14 Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4D41EC: PyErr_SetString.PYTHON312 ref: 00007FFE1A4D422F

memset.VCRUNTIME140 ref: 00007FFE1A4D4F56

Part of subcall function 00007FFE1A4D5190: WSAGetLastError.WS2_32 ref: 00007FFE1A4D5237
Part of subcall function 00007FFE1A4D5190: WSAGetLastError.WS2_32 ref: 00007FFE1A4D523F
Part of subcall function 00007FFE1A4D5190: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D5250

SetHandleInformation.KERNEL32 ref: 00007FFE1A4D4FB7
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1A4D4FC3
closesocket.WS2_32 ref: 00007FFE1A4D4FCC
PyLong_FromLongLong.PYTHON312 ref: 00007FFE1A4D4FE2
closesocket.WS2_32 ref: 00007FFE1A4D4FF3

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_$ErrorFromLastLongclosesocket$CheckHandleInformationLong_SignalsStringWindowsmemset
String ID:
API String ID: 205095079-0
Opcode ID: 7e2d04470de31f4351b15ac443bcd17531285cff5ddf6e7177ad4701d4908fb7
Instruction ID: ec9539ff2de846d03f3c656a3120c219704e74b71c32b3f9b3ae44dcb57f2539
Opcode Fuzzy Hash: 7e2d04470de31f4351b15ac443bcd17531285cff5ddf6e7177ad4701d4908fb7
Instruction Fuzzy Hash: 77415335B0CF8281EA259B22E4443B963A1FF55FA4F0440B6DA8D46B65DF3DE0618780

Function 00007FFE1A4F662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F6B60
Part of subcall function 00007FFE1A4F6B10: RaiseException.KERNEL32 ref: 00007FFE1A4F6BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F66C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A4F6723

Strings

Access violation - no RTTI data!, xrefs: 00007FFE1A4F662A, 00007FFE1A4F684B
Bad dynamic_cast!, xrefs: 00007FFE1A4F6792
Bad read pointer - no RTTI data!, xrefs: 00007FFE1A4F6828
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE1A4F6805

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: 1bd7c864fe40f243d8e0b58faaefa6600444b324015d6c24d6aa137f39a01b31
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: 3651A462B19E8692EE20CB2AE9501F9A360FF44FA5F0054B3DA4D43679EF3CE115C700

Function 00007FFE1331246C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133124B8
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133124FC
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE13312518
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE13312567

Strings

Unable to allocate output buffer., xrefs: 00007FFE133161A2

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction ID: b2d66fabada7d5e0552adacf71ce8d10482b3b87a1b2d277ddb5e592b10508cc
Opcode Fuzzy Hash: dfc50fe1e76f4b95923bb712c602e591bc04f2612fcca18cafc909a29d1c47b1
Instruction Fuzzy Hash: 0C4141B6A05E02C9EB558F57D49026977A0FB68FA4F144472CE2D67766CF3CE491C308

Function 00007FFE1331083C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON312(?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310849

Part of subcall function 00007FFE13310970: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310988
Part of subcall function 00007FFE13310970: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310999
Part of subcall function 00007FFE13310970: PyDict_SetItem.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE133109B4

PyErr_Format.PYTHON312(?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13315C50
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13315C6C

Strings

dist, xrefs: 00007FFE13315C97
Invalid filter ID: %llu, xrefs: 00007FFE13315C43
dict_size, xrefs: 00007FFE13310934
start_offset, xrefs: 00007FFE13315C87

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction ID: e39a6c2c476d7cfa532ba2a6b04c061272649d4e0f9e87cfc65fd3354af61d4d
Opcode Fuzzy Hash: 2bf5425971416fcf604516447e7ff1f6a8227c031248f9865350739be3ef4e27
Instruction Fuzzy Hash: BD412B31B08E03C9FA248F17D9501786760AF65BB4F1841B2CA3D6A6B2DF3CA4A5C708

Function 00007FFE1A4F6FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F7069
GetLastError.KERNEL32(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F7077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F7090
LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F70A2
FreeLibrary.KERNEL32(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F7110
GetProcAddress.KERNEL32(?,?,?,00007FFE1A4F71A3,?,?,00000000,00007FFE1A4F6FD4,?,?,?,?,00007FFE1A4F6D11), ref: 00007FFE1A4F711C

Strings

api-ms-, xrefs: 00007FFE1A4F7089

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: c446bb7c454f4d917a9fc4fa11935df290a90d828db8493095cb23a6a8cb403d
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: B7319E21B1AE4295EE11DB0BA8006BA2394FF48FB5F1955F6ED1D8B3A1EF3CE5548300

Function 00007FFE1333C790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE1333C7C8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1333C82B
PyList_Append.PYTHON312 ref: 00007FFE1333C83F
_Py_Dealloc.PYTHON312 ref: 00007FFE1333C85B
_Py_Dealloc.PYTHON312 ref: 00007FFE1333C874

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE1333C7BE
Unable to allocate output buffer., xrefs: 00007FFE1333C81D

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction ID: 042823891d98c357de428c0d8f64c8928bd9e705ac926ef8374489e0afe53615
Opcode Fuzzy Hash: ff338362e5abe2334e11cb080246bf7f77446c403590bc40d540ec3316304a65
Instruction Fuzzy Hash: 5D313C22A08F4289EE148B27E904269A3A1EB64FF5F14C671E93D677B4DF3DE5418304

Function 00007FFE13316380 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE13314D6B,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133163B8
PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE13314D6B,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE1331641B
PyList_Append.PYTHON312(?,?,?,00007FFE13314D6B,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE1331642F
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13314D6B,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE1331644B
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13314D6B,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE13316464

Strings

Unable to allocate output buffer., xrefs: 00007FFE1331640D
avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE133163AE

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction ID: 613aee5f22812084ce744c62640ade488a583967db60b22a704b561592795782
Opcode Fuzzy Hash: 580d003c13f45ba0d3f5d519e6676035726d1c9c5441bda9205d6986d50f6f75
Instruction Fuzzy Hash: B8313822A08F42C9EA148B67E94412863A1FB64BF4F1446B1DE3D677B6DF3CE4859308

Function 00007FFE1333222C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE13332257
PyModule_GetState.PYTHON312 ref: 00007FFE13332260
_PyLong_AsInt.PYTHON312 ref: 00007FFE13332297
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE1333B31F

Strings

BZ2Compressor, xrefs: 00007FFE1333B318, 00007FFE1333B338

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Arg_KeywordsLong_ModuleModule_StateType_
String ID: BZ2Compressor
API String ID: 694278274-1096114097
Opcode ID: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction ID: 2d5146a88e487c4e27adabe6a18d1d57cfe9352a8249a75c11fa781657f33401
Opcode Fuzzy Hash: c29017a166be628f3c043c4071bfaebd4dc5a5912452c5fe267a8d3f159135bf
Instruction Fuzzy Hash: 5F216531A0CE068DEA545B17D840279A3A0EB64FA0F4981B1DD6DE77B5DF7CE455C308

Function 00007FFE133336D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE13333705
PyThread_release_lock.PYTHON312 ref: 00007FFE13333735
PyErr_SetString.PYTHON312 ref: 00007FFE1333376A

Part of subcall function 00007FFE13333270: memcpy.VCRUNTIME140 ref: 00007FFE133332EE

PyEval_SaveThread.PYTHON312 ref: 00007FFE1333B892
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1333B8A7
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1333B8B0

Strings

End of stream already reached, xrefs: 00007FFE13333760

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemcpy
String ID: End of stream already reached
API String ID: 180092378-3466344095
Opcode ID: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction ID: cf77ede572cebcdcf23ff6f8c57de4a681a9f175f3535afa3846869db8763f43
Opcode Fuzzy Hash: 309d9335925c998c01d05fe5717c16006e6c4eec569cf43e6d0882e4142690fe
Instruction Fuzzy Hash: D0112166A08E4189EA14DB63E844269A760FB98FE0F08C071DE2E53775CF3CE4558314

Function 00007FFE133095F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE1330961D
PyThread_release_lock.PYTHON312 ref: 00007FFE13309650
PyErr_SetString.PYTHON312 ref: 00007FFE13309685
PyEval_SaveThread.PYTHON312 ref: 00007FFE133150C6
PyThread_acquire_lock.PYTHON312 ref: 00007FFE133150DB
PyEval_RestoreThread.PYTHON312 ref: 00007FFE133150E4

Strings

Already at end of stream, xrefs: 00007FFE1330967B

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction ID: 1d8aed86a155967efa4314e7d07280b5587dfb41c2224888da8900f754a31d97
Opcode Fuzzy Hash: 3eb67ee195b5bbe57a7cea297c8508a8a17e06b17122ceb0a36300f9ddcb8c56
Instruction Fuzzy Hash: DA113A22A08E81C9EA449B53E84416D7765FB98FE0F0850B1DE2E67775CF3CE455C308

Function 00007FFE133325FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE1333261F
PyThread_release_lock.PYTHON312 ref: 00007FFE1333264B
PyEval_SaveThread.PYTHON312 ref: 00007FFE1333266A
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1333267C
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13332685

Strings

Compressor has been flushed, xrefs: 00007FFE1333B42B

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction ID: ea17a204cf03968ada8436d27325be1b85ae4f0cb44c3b8d48a506f071a6bb53
Opcode Fuzzy Hash: 44824e688ac5818207e66a8fa07d8ee67426f91ffe2dff722fcdce01adc47589
Instruction Fuzzy Hash: 4C113A32A08E4286EA14DB13F844179A360FB98FE0B049072DE6EA7B74CF3CE491C344

Function 00007FFE13309010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13309036
PyThread_release_lock.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13309068
PyErr_SetString.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13309098

Part of subcall function 00007FFE13308564: PyType_GetModuleState.PYTHON312 ref: 00007FFE1330859D
Part of subcall function 00007FFE13308564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133085B1
Part of subcall function 00007FFE13308564: PyList_New.PYTHON312 ref: 00007FFE133085C8
Part of subcall function 00007FFE13308564: PyEval_SaveThread.PYTHON312 ref: 00007FFE13308619
Part of subcall function 00007FFE13308564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13308633

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13314F44
PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13314F59
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE13308536), ref: 00007FFE13314F62

Strings

Compressor has been flushed, xrefs: 00007FFE1330908E

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction ID: 9bc30374faf22082f8e206b77cd53400ad900c129e192c9e8b939437f5f71c46
Opcode Fuzzy Hash: 7a7077e9134b2479d70bc0b55754877c5396126443336fd8736004c065fe7fd0
Instruction Fuzzy Hash: 56112E21A08E81C9E694CB13E9442697765FB98FD0F045071DE6D67B35CF3CD055C308

Function 00007FFE1333200C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE13332026
PyThread_release_lock.PYTHON312 ref: 00007FFE1333205E
PyEval_SaveThread.PYTHON312 ref: 00007FFE1333B250
PyThread_acquire_lock.PYTHON312 ref: 00007FFE1333B262
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1333B26B
PyErr_SetString.PYTHON312 ref: 00007FFE1333B288

Part of subcall function 00007FFE13332C08: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13332C47
Part of subcall function 00007FFE13332C08: PyList_New.PYTHON312 ref: 00007FFE13332C5E
Part of subcall function 00007FFE13332C08: PyEval_SaveThread.PYTHON312 ref: 00007FFE13332CCC
Part of subcall function 00007FFE13332C08: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13332CE6

Strings

Repeated call to flush(), xrefs: 00007FFE1333B27E

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction ID: 1ccbc46e978591721fcee3fe06fef01014cf7ae60b9a36aba74806e11618cb28
Opcode Fuzzy Hash: 5871bef96599481079b609c1d245c472c7a68676c479b15d6616a7a45fe64ed0
Instruction Fuzzy Hash: 1E114F32A0CE5286EA149B13E544179A360FB98FA0F048171DE2DA3B74CF3CE496C344

Function 00007FFE13312F1C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE13312F41
PyThread_release_lock.PYTHON312 ref: 00007FFE13312F7E
PyErr_SetString.PYTHON312 ref: 00007FFE13312FA8

Part of subcall function 00007FFE13308564: PyType_GetModuleState.PYTHON312 ref: 00007FFE1330859D
Part of subcall function 00007FFE13308564: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133085B1
Part of subcall function 00007FFE13308564: PyList_New.PYTHON312 ref: 00007FFE133085C8
Part of subcall function 00007FFE13308564: PyEval_SaveThread.PYTHON312 ref: 00007FFE13308619
Part of subcall function 00007FFE13308564: PyEval_RestoreThread.PYTHON312 ref: 00007FFE13308633

PyEval_SaveThread.PYTHON312 ref: 00007FFE13316274
PyThread_acquire_lock.PYTHON312 ref: 00007FFE13316289
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13316292

Strings

Repeated call to flush(), xrefs: 00007FFE13312F9E

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction ID: 9b8b9c5cc5e53b9b74b9d880165f011aa39cbffe92a0e6a13de9f6fab673ce5d
Opcode Fuzzy Hash: a4197e1cdbd251bead5eb9b1989463c00a4a401fc08ccf7e864d5c68d6b91325
Instruction Fuzzy Hash: A0114221A08E82CAEA548B17E8442797761FB98FA0F045170DE2D67775CF3CE056C708

Function 00007FFE1A4D7E48 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D7E5B
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D7E7E
htons.WS2_32 ref: 00007FFE1A4D7E99
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1A4D7EA2

Strings

i:htons, xrefs: 00007FFE1A4D7E54
htons: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE1A4D7E90
htons: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE1A4D7E6D

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: htons: Python int too large to convert to C 16-bit unsigned integer$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
API String ID: 1102113319-997571130
Opcode ID: 6fe04cd82cc3000d18dcf2e81bb2daf4d1c2563f8a0b84c539f7a4416ede929e
Instruction ID: 13ddb64e20c050f83a5bbdc147ae0dc0d6bd29f0bcfc3aca50c20b718dac5019
Opcode Fuzzy Hash: 6fe04cd82cc3000d18dcf2e81bb2daf4d1c2563f8a0b84c539f7a4416ede929e
Instruction Fuzzy Hash: 0FF0E765B08E8391EA648B17E8911782362AFA5F65F9044F7C54EC69B1CF2CE828C310

Function 00007FFE1A4F2C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2D0E
__AdjustPointer.LIBCMT ref: 00007FFE1A4F2D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2D5C
__AdjustPointer.LIBCMT ref: 00007FFE1A4F2D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2DF9

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction ID: 2bd58ecf0a99183ac0ad73353b5a0a8f8b2ccf9d8525686b023c6fa2ed292352
Opcode Fuzzy Hash: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction Fuzzy Hash: 2B51C131B0EF8281FAA59B1A95446BD6394AF54FB2B0550F7CE4E067B5DF3CE4628300

Function 00007FFE1A4F2E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2EF5
__AdjustPointer.LIBCMT ref: 00007FFE1A4F2F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2F43
__AdjustPointer.LIBCMT ref: 00007FFE1A4F2F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2FE0

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction ID: 48e8fae50e63722f0a3b787569287ca0146316ff1a0b7334992c846f67b42db1
Opcode Fuzzy Hash: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction Fuzzy Hash: 83511321B1EE4281EAA5CB0BD5406BD6394AF48FB2F1960F7DA4D063B8CF3CE4618710

Function 00007FFE1A4FEB88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FEBFC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FEC0B

Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE4D
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE86
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FECAB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FECBB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FED67

Strings

{for , xrefs: 00007FFE1A4FEC34

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction ID: 5865eaca803ed4b5c6a88e36361268ca3e59d928ae09a6687cba9ff7607c4890
Opcode Fuzzy Hash: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction Fuzzy Hash: 95514972B09E86A9E7119F2AD4413F837A0EB45F5AF8090F2EA4C47AA5DF7CD565C300

Function 00007FFE13308564 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE1330859D
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE133085B1
PyList_New.PYTHON312 ref: 00007FFE133085C8
PyEval_SaveThread.PYTHON312 ref: 00007FFE13308619
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13308633
_Py_Dealloc.PYTHON312 ref: 00007FFE13314DB2
_Py_Dealloc.PYTHON312 ref: 00007FFE13314E04

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction ID: 0fa44b54b0eb671ba7fa1db58ab0edb24a9481b6e4f3889621957987290698e7
Opcode Fuzzy Hash: cae30496bc2a9274937e9c345c6c18388f66ce03b5df9a1d955108f12d730ff2
Instruction Fuzzy Hash: D3519222A09F46CAEA608B16D44016D67A4FB68B70F550275DFAD277A2DF3CE451C308

Function 00007FFE13339C6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FFE13339CC8
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13339D03
memcpy.VCRUNTIME140 ref: 00007FFE13339D47
_Py_Dealloc.PYTHON312 ref: 00007FFE13339D63

Strings

Unable to allocate output buffer., xrefs: 00007FFE1333C6EA

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction ID: 5dcdcfe626ade5830eb2d65e81b4aeae2ca155f2328a81523a802b2c1a80795e
Opcode Fuzzy Hash: 192d9c9cdf7fb7c81c0bae171a6cbb097aeaf5356c6e4851a41644aa9c401917
Instruction Fuzzy Hash: 71410A76A09E06C9EB198F17C440369A7A0FB69FA4F188472DE2D67764CF3DE491C308

Function 00007FFE1A4FE174 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE1A4FD86D), ref: 00007FFE1A4FE238
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FE257

Strings

void, xrefs: 00007FFE1A4FE1BA
`template-parameter, xrefs: 00007FFE1A4FE265

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction ID: bf5fb68153274147986fdef6d1e806d4c82b8d4ec1e8a382c973a853d9afc0ae
Opcode Fuzzy Hash: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction Fuzzy Hash: 3B416B61F08F5188FB108BAAD9512FD3370BB48FA9F5511B6CE0C56669EF7C91558340

Function 00007FFE1A4F8EC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F8D3C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4F8DFD

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4F8F72

Strings

,..., xrefs: 00007FFE1A4F8F40
void, xrefs: 00007FFE1A4F8FE4
<ellipsis>, xrefs: 00007FFE1A4F8FBF
..., xrefs: 00007FFE1A4F8FAF
,<ellipsis>, xrefs: 00007FFE1A4F8F50

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction ID: 4fc201280fbf2c8c59e5ec4e4d027463f11c6f6ca47708178dcee27fa55ae43e
Opcode Fuzzy Hash: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction Fuzzy Hash: 4B414871B08E528CF7028B2AE8402FC3BA0BB49B69F8455F2CA4C1A365DF7CA550C350

Function 00007FFE1A4FACC4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FADA7

Strings

char , xrefs: 00007FFE1A4FAD4D
long , xrefs: 00007FFE1A4FAD26
short , xrefs: 00007FFE1A4FAD44
int , xrefs: 00007FFE1A4FAD35
unsigned , xrefs: 00007FFE1A4FAD7B

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction ID: ee595df804db83f18933e903a3e5ac204c1a878a8e4430cd0a516e289bd1b7e1
Opcode Fuzzy Hash: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction Fuzzy Hash: A1314A32B19E5188E7168B6ED8501FC3BB2BB09B6AF4491F2DA4D46B79DF3C9514C700

Function 00007FFE133322D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,00000009,00007FFE133322B2), ref: 00007FFE133322FC
_Py_Dealloc.PYTHON312(?,?,00000009,00007FFE133322B2), ref: 00007FFE1333B378

Part of subcall function 00007FFE13332078: memset.VCRUNTIME140 ref: 00007FFE133321CD

_Py_Dealloc.PYTHON312 ref: 00007FFE1333B3A4
PyErr_SetString.PYTHON312(?,?,00000009,00007FFE133322B2), ref: 00007FFE1333B3C1

Strings

compresslevel must be between 1 and 9, xrefs: 00007FFE1333B3B7
Unable to allocate lock, xrefs: 00007FFE1333B385

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Dealloc$Err_StringThread_allocate_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 451674277-2500606449
Opcode ID: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction ID: b7d9655c3df2dbcb61d302ded6c5a60d7c3edbf8a3734c19d13f2c9a886903c1
Opcode Fuzzy Hash: 3dccc7cd2452e4a8ba701b6261aeff0617572921f18deb801f63fe5c7fd59db8
Instruction Fuzzy Hash: F8213E32A0DE0389EB199B26D444278A3A4AF64F75F14C1B1C52D922B5DF3CE445C319

Function 00007FFE13333838 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON312(?,?,?,00007FFE13333810), ref: 00007FFE1333384E
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13333881
_Py_Dealloc.PYTHON312(?,?,?,00007FFE13333810), ref: 00007FFE1333B8EC
PyErr_SetString.PYTHON312(?,?,?,00007FFE13333810), ref: 00007FFE1333B903
_Py_Dealloc.PYTHON312 ref: 00007FFE1333B925

Strings

Unable to allocate lock, xrefs: 00007FFE1333B8F9

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: DeallocString$Bytes_Err_FromSizeThread_allocate_lock
String ID: Unable to allocate lock
API String ID: 553681934-3516605728
Opcode ID: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction ID: d2bd3e70df279f62ad03ab62098a728af375724da17085fc55ca2250f414f335
Opcode Fuzzy Hash: 759680a25ddd07c6aa1ccb4943ed979172cd353d0607e0d9c42c479e1e040031
Instruction Fuzzy Hash: 4C212E22E09F4289FB195F32D405378A2A4EF68F7AF04C0B4C92D593B5DF3CA4488318

Function 00007FFE13311F4C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13311F88
PyMem_Calloc.PYTHON312 ref: 00007FFE13311F9A
PyErr_SetString.PYTHON312 ref: 00007FFE13311FCB
PyErr_NoMemory.PYTHON312 ref: 00007FFE13311FD5

Strings

|OO&, xrefs: 00007FFE13311F79
Invalid filter specifier for delta filter, xrefs: 00007FFE13311FC1

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction ID: 1dbea32b10329719012b0f45159ce071f82e9c90d2b44a15023e93dd0e069672
Opcode Fuzzy Hash: 8f6d3e53a03bcdfc1a1c4549eb233bcc7dd316073f513c0d7cf3946cf18a22e7
Instruction Fuzzy Hash: 69113976A09E02CAEB008B12E8481A977B4FB64B64F504271C92D27372DF7DE40AC748

Function 00007FFE13311EC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE13311EF9
PyMem_Calloc.PYTHON312 ref: 00007FFE13311F0B
PyErr_SetString.PYTHON312 ref: 00007FFE13311F38
PyErr_NoMemory.PYTHON312 ref: 00007FFE13311F42

Strings

|OO&, xrefs: 00007FFE13311EDF
Invalid filter specifier for BCJ filter, xrefs: 00007FFE13311F2E

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction ID: 94e3836e799db1b6a130e85a5ccce4fdb99ee5afd9afd42d8c2ccacaeee86efc
Opcode Fuzzy Hash: c99a539e3f84903be04565e407b851ab502a56b26a5fb183a3bd791a404fbe6a
Instruction Fuzzy Hash: B9011775A08F02C9EB01CF22E8441A873A4FB68B60F5002B1CA2D67372DF3CE40AC758

Function 00007FFE1A4D8484 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE1A4D84A1
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D84AE
htonl.WS2_32 ref: 00007FFE1A4D84C7
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1A4D84CF
PyErr_Format.PYTHON312 ref: 00007FFE1A4D84EC

Strings

expected int, %s found, xrefs: 00007FFE1A4D84DE

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: 1cbb25d059c373463275cb9141ec41ce007bb3d03350516039de7c41e169b97a
Instruction ID: 4f1ad4963ba6d53d4e1f432dd2c5f56be6d12f09b64eed0dacd6bb5cc6344b46
Opcode Fuzzy Hash: 1cbb25d059c373463275cb9141ec41ce007bb3d03350516039de7c41e169b97a
Instruction Fuzzy Hash: 41F01D65B08E4282FA559B33A89417D2761BF69F65F2406F7D50EC26B1DF3CE468C300

Function 00007FFE1A4D7DD8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE1A4D7DF5
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D7E02
htonl.WS2_32 ref: 00007FFE1A4D7E1B
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1A4D7E23
PyErr_Format.PYTHON312 ref: 00007FFE1A4D7E40

Strings

expected int, %s found, xrefs: 00007FFE1A4D7E32

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: b2daa29250e1f6628aa8a96a2420fefb0829875c2a9b427d46b77ebb6b88cbc8
Instruction ID: 25a1fe1b9a15faaae631c1bcdb1ff8e09e9868ffc53f6df83a1078c10bcba030
Opcode Fuzzy Hash: b2daa29250e1f6628aa8a96a2420fefb0829875c2a9b427d46b77ebb6b88cbc8
Instruction Fuzzy Hash: 45F01265B08E4282EA949B22A85517823A1BF69FA5F1409F7D90EC36B1DF3CD874C300

Function 00007FFE1333C8E4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1333C8F1

Part of subcall function 00007FFE1333C8A0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FFE1333B152), ref: 00007FFE1333C8D6

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1333C91D
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1333C937

Strings

bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFE1333C904
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFE1333C926
1.0.8, 13-Jul-2019, xrefs: 00007FFE1333C8F7

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction ID: 2b11f0b0bf84bae4d37bd8142429f2750a3419611058e56df1ca9f0bef00dac2
Opcode Fuzzy Hash: 836efcf6b23a4585cd62e76ace601ecc2435689098995399630fc0c516941a58
Instruction Fuzzy Hash: 40E06D24E18D064AFA185763E8952B8D315EF74F71F8080B9C96E2A3B29E6C25498359

Function 00007FFE1A4FADEC Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FAE9E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAEAE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAECB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAF3E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FAF67

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction ID: ec3c7013daceebf60053cbf13e531c57c49ff3bb6daa6fc9aacdd6b7df0581cc
Opcode Fuzzy Hash: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction Fuzzy Hash: 5A717972F18E428DE711CB6AE8806FC37A1BB41B65F5490F6DA0D5B6A9CF7CA461C300

Function 00007FFE13332C08 Relevance: 9.1, APIs: 6, Instructions: 114threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE13332C47
PyList_New.PYTHON312 ref: 00007FFE13332C5E
PyEval_SaveThread.PYTHON312 ref: 00007FFE13332CCC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE13332CE6
_Py_Dealloc.PYTHON312 ref: 00007FFE1333B5CD
_Py_Dealloc.PYTHON312 ref: 00007FFE1333B61C

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction ID: 4b46c3a4e38851e863db882ce150b2e43e78de5a579cd56dee9e824c2e921bc8
Opcode Fuzzy Hash: 299e1a11eefcece535b48eefa17f910425dba9180d5bd0db985f057c361aac7e
Instruction Fuzzy Hash: 7C414B32E08F028AFA258B22D400279A2A0FF64F74F148675DE6DA77A1DF3CE551C748

Function 00007FFE1A4F69F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE1A4F6A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4F6A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A4F6AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE1A4F6ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4F6AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A4F6AE2

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction ID: 77ad9b163f09b682942e3882cb7557f32ce96d55780825e9537816d26815e387
Opcode Fuzzy Hash: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction Fuzzy Hash: 0131A122B1AB9150EA11CB2A99045BA63A0FB4AFF1B5995B3DD2D033A0EE7DD451C300

Function 00007FFE13310970 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310988
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13310999
PyDict_SetItem.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE133109B4
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13315CBE
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1331086D,?,?,?,00007FFE1331081A,?,?,?,?,?,00007FFE133107A5), ref: 00007FFE13315CD7

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction ID: c175a87a815b28744a3b720d3b8b2257beff9c8681e788d0aa6ac107de7ebd0b
Opcode Fuzzy Hash: 4407cb7e2ae5907235722564fec9c5a3f52f4cf3bc80c1b274a729e09646330d
Instruction Fuzzy Hash: 7C114631E0CE42C9FA154F23D924239B690AF6ABF5F0850B1D92D667B6DF3CE8558308

Function 00007FFE1A4D46B0 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE1A4D446A), ref: 00007FFE1A4D46C4
ioctlsocket.WS2_32 ref: 00007FFE1A4D46E9
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE1A4D446A), ref: 00007FFE1A4D46F6
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE1A4D446A), ref: 00007FFE1A4D4700
WSAGetLastError.WS2_32(?,?,?,00007FFE1A4D446A), ref: 00007FFE1A4D4706
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFE1A4D446A), ref: 00007FFE1A4D4718

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
String ID:
API String ID: 863680558-0
Opcode ID: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction ID: ec2217df0d79cbb5b1034c0e2ed2b9edc6be4b8e740c67fdfe08188d33a4a81b
Opcode Fuzzy Hash: 964070f957597cead12d681d8d9d4b975f1a861eb6e29b6fc22a496edc13ce25
Instruction Fuzzy Hash: 43012135B19E4282E7509B67E44407967A1EF98FA1B5040B2D95EC3B76CE3CD4A58700

Function 00007FFE1A4D701C Relevance: 9.0, APIs: 6, Instructions: 32threadnetworkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON312 ref: 00007FFE1A4D7025
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D7034
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D7048
closesocket.WS2_32 ref: 00007FFE1A4D7054
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D705F
WSAGetLastError.WS2_32 ref: 00007FFE1A4D706E

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_LongThread$Err_ErrorLastLong_OccurredRestoreSaveclosesocket
String ID:
API String ID: 586723380-0
Opcode ID: 88cad95bcb5dfa4951526296af0bf2ff21b88eb4dabe66cc17352eaa9c495d40
Instruction ID: e188f5cc13ad1f5ae5a85228bcd20478dc5338c4cf3e2ee320e4649e3501274f
Opcode Fuzzy Hash: 88cad95bcb5dfa4951526296af0bf2ff21b88eb4dabe66cc17352eaa9c495d40
Instruction Fuzzy Hash: 9DF04424F1CE4781FA55ABA365480782256AF34FB4F0416F7C92EC27F2DF3CA0A48210

Function 00007FFE1A4F3F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

EncodePointer.KERNEL32 ref: 00007FFE1A4F3FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A4F401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F424E

Strings

MOC, xrefs: 00007FFE1A4F3FE4
RCC, xrefs: 00007FFE1A4F3FEC

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction ID: 3734e9741784082b9895b2efe5ae357516d9a3407412230662db386299ba482c
Opcode Fuzzy Hash: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction Fuzzy Hash: CC91A273B08B918AE711CB6AE8402FD77A0F744B99F1051BAEA8D07B69DF38D165C700

Function 00007FFE1A4FC540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FC7E0

Strings

std::nullptr_t , xrefs: 00007FFE1A4FC770
volatile , xrefs: 00007FFE1A4FC5A7, 00007FFE1A4FC6D8
volatile, xrefs: 00007FFE1A4FC5B6, 00007FFE1A4FC6E7
std::nullptr_t, xrefs: 00007FFE1A4FC799

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction ID: 3b24928131af71a05f308fff43716c98538411ea1109be9ddfd6de6b50a9553d
Opcode Fuzzy Hash: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction Fuzzy Hash: 0A713772B0CE5288FB148F2A99500FC76A4BB05BA5F8465F7DA4D52AB9DF3CE160C304

Function 00007FFE1A4F3CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

EncodePointer.KERNEL32 ref: 00007FFE1A4F3D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A4F3D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F3F57

Strings

MOC, xrefs: 00007FFE1A4F3D63
RCC, xrefs: 00007FFE1A4F3D6B

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction ID: 4130a6ff55cf03074c5af9e561c25df2f6344b5d67ce2f542439a4589731c3ba
Opcode Fuzzy Hash: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction Fuzzy Hash: 50617432A08FC581D7619B16E4403FAB7A0FB85BA5F4452A6EB9D03765DF7CE1A4CB00

Function 00007FFE1A4F5C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F5D22

Strings

csm, xrefs: 00007FFE1A4F5DDF
RCC, xrefs: 00007FFE1A4F5C9C
MOC, xrefs: 00007FFE1A4F5C90
csm, xrefs: 00007FFE1A4F5CB2

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction ID: 303d154d326cc8939f0f7f8cd752f8dece136ec73d9267d54bd7a1b8e6771b1c
Opcode Fuzzy Hash: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction Fuzzy Hash: E6519132B0AA4286EAA09B3A91401BE76A0FF45F65F1460F3DE4D47765DF3CE4718782

Function 00007FFE133339F4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFE1333BA31
{0x%08x, 0x%08x}, xrefs: 00007FFE1333B9DD

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction ID: fd2f32864a7a4fbb25a344d41ea37e03c789ea95cd7087acff5caf0e31002769
Opcode Fuzzy Hash: beca674fd8db362ae3c326a262006269a39a6cc495ac54829b8af714453b82f3
Instruction Fuzzy Hash: CF418331E0DD428EEB648F369040278E290EB65F74F14D275D92E6B3E5DF3CA8818718

Function 00007FFE13310A68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON312(00000000,?,00000000,00007FFE13310A18), ref: 00007FFE13310A94
PySequence_GetItem.PYTHON312(?,00000000,00007FFE13310A18), ref: 00007FFE13310AC7

Part of subcall function 00007FFE13310B5C: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310B81
Part of subcall function 00007FFE13310B5C: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310B9B
Part of subcall function 00007FFE13310B5C: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310BB0
Part of subcall function 00007FFE13310B5C: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE13310AE3,?,00000000,00007FFE13310A18), ref: 00007FFE13310BC7

PyErr_Format.PYTHON312(?,00000000,00007FFE13310A18), ref: 00007FFE13315D09

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFE13315CF9

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction ID: 6260ca680aabfabc89097b8668c1f7380ba316829b3f4975c156cae17c313414
Opcode Fuzzy Hash: ccf5a64d07049f618c25ab74cbb4974c3106e7c7554985af56aab865a0a260af
Instruction Fuzzy Hash: 63318F21B08E02C9EA259F27A800139A650AB65FF8F184371DE3D277F6DE7CE0468308

Function 00007FFE133120DC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FFE13312132
PyErr_Format.PYTHON312 ref: 00007FFE133160C4

Strings

Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFE13316117
Invalid compression preset: %u, xrefs: 00007FFE133160BA

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction ID: f28e73db6ca243e421454ce39aebb87fede9a6b4cda448153cb7753fd421adda
Opcode Fuzzy Hash: 42de15237a213d44223ebd833c4df5f098df34b0787ac9d39a2d3eb57667bed4
Instruction Fuzzy Hash: 8421A551B1CE46C9EA609B22E8403796360BFA9BB4F401271DA7E672F3DF6CE4458708

Function 00007FFE13333774 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE133337A3
PyModule_GetState.PYTHON312 ref: 00007FFE133337AC
_PyArg_NoPositional.PYTHON312 ref: 00007FFE133337DC
_PyArg_NoKeywords.PYTHON312 ref: 00007FFE133337FE

Strings

BZ2Decompressor, xrefs: 00007FFE133337D5, 00007FFE133337F7

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Arg_$KeywordsModuleModule_PositionalStateType_
String ID: BZ2Decompressor
API String ID: 2980520244-1337346095
Opcode ID: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction ID: 72f79bc3be63cd1bd285b63444c597f4f6439e607c076924f46c6820679a88d6
Opcode Fuzzy Hash: f57c856a1eaa85dad08e037339d259dc31bffbd300076d52cdc827e69f7ac027
Instruction Fuzzy Hash: 91215E22A09E4288EA509B13D8001B9A7A0FB64FF5F48C4B2DE6D67374DF3CE485C704

Function 00007FFE1A4D1060 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON312 ref: 00007FFE1A4D106D
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4D10AD

Strings

_socket.CAPI, xrefs: 00007FFE1A4D1066

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Capsule_DeallocPointer
String ID: _socket.CAPI
API String ID: 898671391-3774308389
Opcode ID: 147324779042020adf52fa7f054c0f0e2125f6212a673ba3a80a163640bf1b1a
Instruction ID: 4368175c6071018665ef95f85d43f710d1fe1b6bf1ee99e6e106355a922667da
Opcode Fuzzy Hash: 147324779042020adf52fa7f054c0f0e2125f6212a673ba3a80a163640bf1b1a
Instruction Fuzzy Hash: CA01DA36F49E42C5E6165F3AC85427833A5AB6AF35F5840F2CA5D819B2CF3DA5A1C310

Function 00007FFE1A4C10E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE1A4C10ED
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE1A4C10FD
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1A4C111F

Strings

close, xrefs: 00007FFE1A4C10F3
error, xrefs: 00007FFE1A4C1112

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction ID: a3cf0f78a89f6d584ca29192d27178f01c37e0a6e0d404d0aa28f3dfb3b5c36b
Opcode Fuzzy Hash: 0a630f88c3fb29b6303c131d10015d5f25b4110c9ff69da5c0eced729275bb56
Instruction Fuzzy Hash: 33F01D21B09F4795EB008B6AF4440B9A360BF09FA4B8441B7D91D473B8DE2CE5698300

Function 00007FFE1A4D4ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,00000002,00007FFE1A4D4E84), ref: 00007FFE1A4D4AD7
PyErr_SetObject.PYTHON312(?,?,00000002,00007FFE1A4D4E84), ref: 00007FFE1A4D4AEC
_Py_Dealloc.PYTHON312(?,?,00000002,00007FFE1A4D4E84), ref: 00007FFE1A4D4B00

Strings

getaddrinfo failed, xrefs: 00007FFE1A4D4AC9
(is), xrefs: 00007FFE1A4D4AD0

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$getaddrinfo failed
API String ID: 3413694139-582941868
Opcode ID: c34809af6fe48c3d98dc105baad316adadc833bdd741b3991c46394a393d3a53
Instruction ID: e87ffa6162daa69c64bc67b8293de4492f9412fc82782d65a07e4822d51bd464
Opcode Fuzzy Hash: c34809af6fe48c3d98dc105baad316adadc833bdd741b3991c46394a393d3a53
Instruction Fuzzy Hash: EEF01935B05E4392EB05CB63F9541B523A1EF69F65F4844F2C95D86A75EE3CD4A4C300

Function 00007FFE1A4D4B14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B2F
PyErr_SetObject.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B44
_Py_Dealloc.PYTHON312(?,?,?,00007FFE1A4D3B5A), ref: 00007FFE1A4D4B58

Strings

(is), xrefs: 00007FFE1A4D4B28
host not found, xrefs: 00007FFE1A4D4B21

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$host not found
API String ID: 3413694139-3306034047
Opcode ID: e90ec528a1d937703f33ea49ca5fade7d46b30f37fbc55b9918f483f3cce63c4
Instruction ID: 7d4e00c5e81103fad0a77ee37e0f3b54458948b87fa1f6e90a4a50bbe990d406
Opcode Fuzzy Hash: e90ec528a1d937703f33ea49ca5fade7d46b30f37fbc55b9918f483f3cce63c4
Instruction Fuzzy Hash: 7BF0FE35B09E4292EB158B63E8582B463A1EF68FA5F4444F2CA6D86A75DE3CD4A58300

Function 00007FFE1A4FA920 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FA99B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA9BD
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FA9CC
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FAA03
DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FAA0E

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction ID: fb470d5505ae2a55ee1f765c05356ea8e2827a17c9c68d4b1b464989831c4c5a
Opcode Fuzzy Hash: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction Fuzzy Hash: CB415822B18E5288EB10CB2AE9905FC37A4BB55FA1F9464F3DA4D537A5DF38E465C300

Function 00007FFE1A4C27F8 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FFE1A4C281E
PyList_New.PYTHON312(00007FFDFAC4D290,?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C2844
__WSAFDIsSet.WS2_32 ref: 00007FFE1A4C2870
PyList_SetItem.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C288A
_Py_Dealloc.PYTHON312(?,?,00007FFE1A4C22E5), ref: 00007FFE1A4C28D1

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction ID: 9400e0b9f90bcf7f757d6a2a49f691db257057826c4f059e80b623d315a01d4a
Opcode Fuzzy Hash: a3b86cd28f5a00db1039b6b37618db01fe58124a87f1d68f694451c2dc2a1ca4
Instruction Fuzzy Hash: 3B218C32B08B4296EB149F13A4442B9B3A0FB08FA4F8445B6CB4D43368DF7CE665C350

Function 00007FFE1A4C1070 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE1A4C1086
_Py_Dealloc.PYTHON312 ref: 00007FFE1A4C2196

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction ID: 9b49c707ce68f4ccc81777b8ba1b420bf0f09cddce23eaaf0510a8778cb8a135
Opcode Fuzzy Hash: 2ce0c8c7188e7a3beb229335f2cd0a6251314470689c624f0e1d13b771884af1
Instruction Fuzzy Hash: 79212E31F4AF82D9FB554F7B881437832A4AB55F2AF9440F2C60E425A9CF7EA5648301

Function 00007FFE1331314C Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE1331315A
_Py_Dealloc.PYTHON312 ref: 00007FFE133131CF
_Py_Dealloc.PYTHON312 ref: 00007FFE133131D7
_Py_Dealloc.PYTHON312 ref: 00007FFE1331629E

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction ID: ca490cbfcf4ee5293de1d3575b0f00e1f0ec06c5e1d9ba4483ec425e78e2733c
Opcode Fuzzy Hash: db67306de73857620c4aba995a460db50807d40a919903c7b44c58eb7544d94b
Instruction Fuzzy Hash: FC21D036D1AD02CDFB9A6F77C85833832A0AF65B39F1844B0C92E655A6CF7DA4458318

Function 00007FFE13339F74 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE13339F86
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13339F9C
PyModule_AddType.PYTHON312 ref: 00007FFE13339FB2
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE13339FC9
PyModule_AddType.PYTHON312 ref: 00007FFE13339FDE

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction ID: bea4a3690119810ce71da7b185bca59c2958f587881ae32e118ac1f70fe35a39
Opcode Fuzzy Hash: 385c81540caf7594d2d79f420c7c64eb9f9f90bd2783a20cd1ed782b2f8c24c0
Instruction Fuzzy Hash: ED015232B19F5285FB108B17E584639E394AF58FE0B449574EA6E66BB4DF3CE0448704

Function 00007FFE1A4D6E64 Relevance: 7.5, APIs: 5, Instructions: 39threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1A4D6E94
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D6EAA
WSADuplicateSocketW.WS2_32 ref: 00007FFE1A4D6EC0
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D6ECB

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Arg_DuplicateParseRestoreSaveSizeSocketTuple_
String ID:
API String ID: 3898289384-0
Opcode ID: c8e2bad8f66a6fb79bb8ed3b2e5e97b1d887adf2b3fc17a41d9c2dd7865fadd9
Instruction ID: 97223a16dd31e26e1def5190d5e236b91de8d9440d4d12d7a839c162d8edc76d
Opcode Fuzzy Hash: c8e2bad8f66a6fb79bb8ed3b2e5e97b1d887adf2b3fc17a41d9c2dd7865fadd9
Instruction Fuzzy Hash: 40111665B1CFC182EA609B62E4483B96361FF68FA4F4001F7D95D47BA5DF3CD0658640

Function 00007FFE1A4D6F10 Relevance: 7.5, APIs: 5, Instructions: 33threadCOMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON312 ref: 00007FFE1A4D6F20
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D6F2D
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D6F41
shutdown.WS2_32 ref: 00007FFE1A4D6F50
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D6F5B

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_Long_OccurredRestoreSaveshutdown
String ID:
API String ID: 24305128-0
Opcode ID: 6516a418a14a859acfa3d73bcf82298d2a1ff85a94d003fe5974aec2db2ce4ef
Instruction ID: b7299085048d83ba38972df68ace24b210283bc5fbcbe998dce61254624d2524
Opcode Fuzzy Hash: 6516a418a14a859acfa3d73bcf82298d2a1ff85a94d003fe5974aec2db2ce4ef
Instruction Fuzzy Hash: D9013625F2CF4282EA505B73B5440796361AF68FB0B1449F6DA5EC3B75DF3CE4658210

Function 00007FFE1A4D7EB0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE1A4D7ECE
PyErr_Occurred.PYTHON312 ref: 00007FFE1A4D7EDB
if_indextoname.IPHLPAPI ref: 00007FFE1A4D7EED
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE1A4D7F02
PyUnicode_DecodeFSDefault.PYTHON312 ref: 00007FFE1A4D7F11

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_$DecodeDefaultErrnoFromLongLong_OccurredUnicode_Unsignedif_indextoname
String ID:
API String ID: 2382930745-0
Opcode ID: 3cc25d69238de96e231579351c1bec566e97787018e5fdd4677d39b8f471e047
Instruction ID: 59bbe50753a121f1b2c8d43788dd1417fc56ca541f6aae9b269f5bc95c2d2e94
Opcode Fuzzy Hash: 3cc25d69238de96e231579351c1bec566e97787018e5fdd4677d39b8f471e047
Instruction Fuzzy Hash: BB01FF25B18E4181EA219B32E8943B92391AFACF75F4009F6C94EC67B1DF3CE5648600

Function 00007FFE13332358 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1333B3D3

Strings

block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFE1333B3DE
final combined CRC = 0x%08x , xrefs: 00007FFE1333B40F

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction ID: 290325488ecaa76797ec3ad6931cb64e6a870fb6e517f556c8b71da44cbfeaa3
Opcode Fuzzy Hash: bae728a6bf01b28945588ec33f57403ca6373a91784663bbbb4fd72b5314d822
Instruction Fuzzy Hash: 08613636B59A168AE620EF1BE4002B9B350EB95FA4F54C075CE2E57366CF7DE402CB44

Function 00007FFE1A4F470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F488B

Strings

csm, xrefs: 00007FFE1A4F475B
, xrefs: 00007FFE1A4F47DC
csm, xrefs: 00007FFE1A4F48C5

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction ID: 44a5525744c80b5172d7caf067bfbb876628c2f409c6de67acdaee75ac11a819
Opcode Fuzzy Hash: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction Fuzzy Hash: 1771C832B08A8186D7618F2AD4407BD7B90FB45FAAF1491B6DA8D077AACF3CD561C740

Function 00007FFE1A4F44E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F45DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A4F45EB

Strings

csm, xrefs: 00007FFE1A4F463D
csm, xrefs: 00007FFE1A4F452E

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction ID: 314cf33741e6f4aa7160f582d7cda0e80afcbec9e681453efb47c40312928ec8
Opcode Fuzzy Hash: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction Fuzzy Hash: D151B472B08A4186EB649B1A95402B876A0FB54FA6F1461F7DB4C47BA6CF3CE570CB00

Function 00007FFE1A4FB118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A4FB172

Strings

%lf, xrefs: 00007FFE1A4FB1AD, 00007FFE1A4FB1E1, 00007FFE1A4FB211

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction ID: 72106c7f523f846f2463d873bd76f7d8014bd895190ab2ccba2bd894a9661ca9
Opcode Fuzzy Hash: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction Fuzzy Hash: 0931B021B0CF4689EA119B17A9500FE77A0BF56FA1B4491F3EA8E83771DE2CE5128300

Function 00007FFE1A4D5450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4D3DD0: PyErr_Format.PYTHON312 ref: 00007FFE1A4D4154

PySys_Audit.PYTHON312 ref: 00007FFE1A4D54A8

Part of subcall function 00007FFE1A4D4484: PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D44A2
Part of subcall function 00007FFE1A4D4484: connect.WS2_32 ref: 00007FFE1A4D44B5
Part of subcall function 00007FFE1A4D4484: PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D44C0
Part of subcall function 00007FFE1A4D4484: WSAGetLastError.WS2_32 ref: 00007FFE1A4D44CE
Part of subcall function 00007FFE1A4D4484: WSAGetLastError.WS2_32 ref: 00007FFE1A4D44DA
Part of subcall function 00007FFE1A4D4484: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1A4D44E7
Part of subcall function 00007FFE1A4D4484: WSASetLastError.WS2_32 ref: 00007FFE1A4D4501

PyLong_FromLong.PYTHON312 ref: 00007FFE1A4D54CD

Strings

socket.connect, xrefs: 00007FFE1A4D54A1
connect_ex, xrefs: 00007FFE1A4D546F

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatFromLongLong_RestoreSaveSignalsSys_connect
String ID: connect_ex$socket.connect
API String ID: 3879675179-935070752
Opcode ID: 414937b2a6d92fbc3da88fc1208311d46d9418bcea39934cf64ea2bb9134626d
Instruction ID: ba19899ddf11308ec15c3c332612a7abe9b5f2d1b3d03f37e09b85635407ba74
Opcode Fuzzy Hash: 414937b2a6d92fbc3da88fc1208311d46d9418bcea39934cf64ea2bb9134626d
Instruction Fuzzy Hash: 93115E21B48E8291EB208B62F4107FA7760FF68BE4F5001F3DA4D87A65EE2CE124C740

Function 00007FFE1A4F2A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F2A8E

Strings

csm, xrefs: 00007FFE1A4F2A70
RCC, xrefs: 00007FFE1A4F2A60
MOC, xrefs: 00007FFE1A4F2A68

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: 66f70d33db7c32e538173b8dfe4b5abe47ced20681d6c3e601c2b39b7834db2b
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: 02F03C37A18A46C5E7646B6AE1810BE7664EF4CF62F1960F3DB4806266CF7CD4A0CB01

Function 00007FFE13311E7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE13310CFC), ref: 00007FFE13311E89
PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE13310CFC), ref: 00007FFE13311E92
PyErr_SetString.PYTHON312(?,?,00000006,00007FFE13310CFC), ref: 00007FFE1331607B

Strings

Value too large for uint32_t type, xrefs: 00007FFE13316071

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction ID: fbb8cb595badaa2cc7c95a1adf9274d79953f272587b6f58649cad9efbc65e69
Opcode Fuzzy Hash: beb8bb3f21a158d48b7ae8f5362e1cc07ff4e792364f621d751ee79adeb98e45
Instruction Fuzzy Hash: 87F05E21F08E02C9EF105B67E4801786361AB68BA4F049070C92D5A372DE3CE485830C

Function 00007FFE13316490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE1331649D
PyErr_Occurred.PYTHON312 ref: 00007FFE133164A6
PyErr_SetString.PYTHON312 ref: 00007FFE133164CE

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFE133164C4

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction ID: 3473f73ea5437d4010e3fcfece73d0ffbc152a189e52c75df7f74cd45790c218
Opcode Fuzzy Hash: 9914e4eca75eb01d789d50a663b97705113751f3ba4ec09a09449ef1f848119f
Instruction Fuzzy Hash: C2F08221B08E47C9EF104F53F9801386360AF68BA4F0850B4CE2D1A372DE3CE4C5A308

Function 00007FFE133164E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE133164F5
PyErr_Occurred.PYTHON312 ref: 00007FFE133164FE
PyErr_SetString.PYTHON312 ref: 00007FFE13316526

Strings

Value too large for lzma_mode type, xrefs: 00007FFE1331651C

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction ID: 61b70ef8baa48a13f8b6fc6498bdc7b7c83052d4986adf1ee5eee02dd441b63b
Opcode Fuzzy Hash: c75928b8bcefc147294998117d43192376e487e7008253cef88493b04ebec458
Instruction Fuzzy Hash: 05F08221B08E43C9EF504F53F4841386760AF68BB4F586074CD2E1A77ACE3CE4959308

Function 00007FFE1A4D678C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1A4D67B0
PyErr_SetString.PYTHON312 ref: 00007FFE1A4D67D5

Strings

no printf formatter to display the socket descriptor in decimal, xrefs: 00007FFE1A4D67CB
<socket object, fd=%ld, family=%d, type=%d, proto=%d>, xrefs: 00007FFE1A4D67A5

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_FormatFromStringUnicode_
String ID: <socket object, fd=%ld, family=%d, type=%d, proto=%d>$no printf formatter to display the socket descriptor in decimal
API String ID: 1884982852-285600062
Opcode ID: adbad624c4c56f29da8e25935a1100d7f970daaacfccf8b58daafbc43e48176e
Instruction ID: e90388308e7eaa9183f3c90542f472d524421740f70f832a436b65b486a9a893
Opcode Fuzzy Hash: adbad624c4c56f29da8e25935a1100d7f970daaacfccf8b58daafbc43e48176e
Instruction Fuzzy Hash: 6EF0BD65B1890686DA109B1AD4404783362FB65FB8F6047B2C96D876F4DE2DE426C700

Function 00007FFE1A4FA638 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE4D
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE86
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA793
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA7F2
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA824
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA834

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction ID: 4f67f457aa477286eb6c93e42a50ad92d1fa9469fc403eb35bae7658dd9bf534
Opcode Fuzzy Hash: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction Fuzzy Hash: C9915762F08E5289FB118B6AD8403FC37B0BB44B69F5490F7DA4D276A5DF78A856C340

Function 00007FFE1330838C Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133083C1

Part of subcall function 00007FFE13312574: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE133083DB,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133125AB
Part of subcall function 00007FFE13312574: PyList_New.PYTHON312(?,?,?,00007FFE133083DB,?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133125BE

PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133083E8
PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE13308401
_Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FFE13308041), ref: 00007FFE133084C1

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction ID: 8dc1581ff08ef56c680e9e84df5f02bedb9745d17fe177140a682b1a0f6e2fca
Opcode Fuzzy Hash: 00cfe97c0164a270be03c1d104ab45d7f8779960225675756503997d0fd06301
Instruction Fuzzy Hash: 7F41A626A09F42CDEA648F27D4401BD2BA4FFA4BA8F540175DA2D6B765DF3CE485C308

Function 00007FFE1A4FD274 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4FED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4FEDEE

Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE4D
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FCE86
Part of subcall function 00007FFE1A4FCDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD2F4
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD303
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD380
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FD38F

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction ID: b7ae8fc743ac3ca1ce1a2f65493b606ac16f162767ed55032384d6bc01e66fbc
Opcode Fuzzy Hash: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction Fuzzy Hash: 8C416272B08B8289FB01CF6AD8403FC37A0BB49B69F9490A6CE8C57769DF789455C350

Function 00007FFE1A4D4594 Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON

Download Yara Rule

APIs

_PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE1A4D45E9
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D4628
select.WS2_32 ref: 00007FFE1A4D465C
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D4667

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
String ID:
API String ID: 3905867726-0
Opcode ID: 12a889711c2c2e54b49b1f454469c8620633830652707fbfba1c602784efdac5
Instruction ID: afd13bd1669da828c4361c9894095fd0fa4e7e4d077223ea68080346c69adcf7
Opcode Fuzzy Hash: 12a889711c2c2e54b49b1f454469c8620633830652707fbfba1c602784efdac5
Instruction Fuzzy Hash: 35318872708F8186D7608F26A8543B963A0FB98BB4F5406B6DB6E83BA5DF3DD4158700

Function 00007FFE1A4D5790 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4D41EC: PyErr_SetString.PYTHON312 ref: 00007FFE1A4D422F

memset.VCRUNTIME140 ref: 00007FFE1A4D57DC
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D57E1
getsockname.WS2_32 ref: 00007FFE1A4D57F8
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5803

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetsocknamememset
String ID:
API String ID: 772546412-0
Opcode ID: bb4860f722e20605b845678caae1940802489a0c30753b108cbd7cf2fc4f76aa
Instruction ID: a1a868acaaa6273b0c56ca094b6cf689f16a954805f041d9ba5420d10d3e5d3b
Opcode Fuzzy Hash: bb4860f722e20605b845678caae1940802489a0c30753b108cbd7cf2fc4f76aa
Instruction Fuzzy Hash: 66111225B18FC281EA709B62F4443BEA361FB94B94F4041B3DA8D57A59DF3CE1158740

Function 00007FFE1A4D56D0 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4D41EC: PyErr_SetString.PYTHON312 ref: 00007FFE1A4D422F

memset.VCRUNTIME140 ref: 00007FFE1A4D571C
PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D5721
getpeername.WS2_32 ref: 00007FFE1A4D5738
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5743

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetpeernamememset
String ID:
API String ID: 1387529023-0
Opcode ID: 6217d1f52f68499da46158bc7b5de8f19134ea31d65d8230de025008c52050e8
Instruction ID: 1b9889ab2b367d20643b59f52d626d90c2f1992ebbd9a5fb47323864b848de79
Opcode Fuzzy Hash: 6217d1f52f68499da46158bc7b5de8f19134ea31d65d8230de025008c52050e8
Instruction Fuzzy Hash: 75112125B1CFC282EA709B62F5443BE6361FB98B94F4041B3DA8D57A69DF3CE1158B40

Function 00007FFE133076FC Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON312 ref: 00007FFE13307749
PyMem_Free.PYTHON312 ref: 00007FFE13307776
_Py_Dealloc.PYTHON312 ref: 00007FFE1330777E

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction ID: 7b1c077dbb9c7dbed4377e95a56cdd92f5df45551785b81c50e6b4e54c8c0f92
Opcode Fuzzy Hash: 01b42428c534275dc39dda495b1f2b4eedd2e9a3cd2baa85ec5288ad07ab9b92
Instruction Fuzzy Hash: 85111222A09D42D9EA5A4F67D55437C3360EF64FE4F184070DA2E56575CF3CA455C308

Function 00007FFE1A4C165C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1A4C1688
GetCurrentThreadId.KERNEL32 ref: 00007FFE1A4C1696
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A4C16A2
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1A4C16B2

Memory Dump Source

Source File: 00000006.00000002.2151941670.00007FFE1A4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFE1A4C0000, based on PE: true

Associated: 00000006.00000002.2151926520.00007FFE1A4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151958048.00007FFE1A4C3000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151973270.00007FFE1A4C5000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.2151987843.00007FFE1A4C6000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4c0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction ID: 8437e8c92d52eafcf875f049bc0806379e3b763e548aec0330b49ce8833a0bc2
Opcode Fuzzy Hash: 7f6b854855521a5eeb54a69c346efd32b0b439a43f7217cfd0872cc224e201bb
Instruction Fuzzy Hash: 19113326B14F019AEB00CF72E8543B833A4F759B68F840D72DA5D86768DF7CE1648380

Function 00007FFE1A5009FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1A500A28
GetCurrentThreadId.KERNEL32 ref: 00007FFE1A500A36
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A500A42
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1A500A52

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction ID: 9b89a2fee2db3e07bb7bd55a0ea09912b8ad82ee58104a6a7ba4e751ef64a16b
Opcode Fuzzy Hash: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction Fuzzy Hash: 8C113022B19F018AEB00CF61E9642BD33A4F71AB68F441E72DE6D467A4DF7CD1588340

Function 00007FFDFA898960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFA89898C
GetCurrentThreadId.KERNEL32 ref: 00007FFDFA89899A
GetCurrentProcessId.KERNEL32 ref: 00007FFDFA8989A6
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFA8989B6

Memory Dump Source

Source File: 00000006.00000002.2150862915.00007FFDFA6F1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFA6F0000, based on PE: true

Associated: 00000006.00000002.2150846102.00007FFDFA6F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151114828.00007FFDFA972000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151114828.00007FFDFA992000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151114828.00007FFDFA9A1000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151114828.00007FFDFAA17000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151114828.00007FFDFAAE2000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151360650.00007FFDFABE6000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151412682.00007FFDFAC53000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151427857.00007FFDFAC55000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151441174.00007FFDFAC56000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151453720.00007FFDFAC57000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151469981.00007FFDFAC59000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151517450.00007FFDFACDF000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151530847.00007FFDFACE1000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151544274.00007FFDFACEB000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151571866.00007FFDFAD10000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151590450.00007FFDFAD11000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151604600.00007FFDFAD12000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151617465.00007FFDFAD13000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151631754.00007FFDFAD15000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151649873.00007FFDFAD21000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151664478.00007FFDFAD22000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151692228.00007FFDFAD64000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000006.00000002.2151708830.00007FFDFAD81000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffdfa6f0000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction ID: c0b829474d34cae4ad171429073f47a1c4c618125793e53b43667ba4d1d838ae
Opcode Fuzzy Hash: d2285d0ca78b08e9284e6539fe4cd286835083a25521d89012cfe7de672bd859
Instruction Fuzzy Hash: 6E115226B14F058AEB04CF60E8A46B833A4FB19B58F440E31DA6E877E8DF7CD5548350

Function 00007FFE1333A640 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1333A66C
GetCurrentThreadId.KERNEL32 ref: 00007FFE1333A67A
GetCurrentProcessId.KERNEL32 ref: 00007FFE1333A686
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1333A696

Memory Dump Source

Source File: 00000006.00000002.2151850239.00007FFE13331000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000006.00000002.2151831070.00007FFE13330000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151874793.00007FFE1333E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151891417.00007FFE13342000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000006.00000002.2151905929.00007FFE13343000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13330000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction ID: 1a82c6f6aad00f007e15f9f98bbbb7af18562526b6eb503e2f64ae8ee4817bf0
Opcode Fuzzy Hash: c9d2bc6b1f4b90143cfcf8b72833dd591a01bb31496536103f8e1994dd480a1d
Instruction Fuzzy Hash: AE112E22B15F018AFB00CF62E8552B833A4FB29B68F440E31DA6D967A4DF7CD1548350

Function 00007FF74709D6F4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF74709D720
GetCurrentThreadId.KERNEL32 ref: 00007FF74709D72E
GetCurrentProcessId.KERNEL32 ref: 00007FF74709D73A
QueryPerformanceCounter.KERNEL32 ref: 00007FF74709D74A

Memory Dump Source

Source File: 00000006.00000002.2150419088.00007FF747071000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF747070000, based on PE: true

Associated: 00000006.00000002.2150403054.00007FF747070000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2150451826.00007FF7470BC000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2150472259.00007FF7470D6000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000006.00000002.2150489983.00007FF7470E1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff747070000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3e9bf284f51a014416bd2e884015404433c55462ee1280fbdb526b963edf0727
Instruction ID: 8fdc3765a4fe91a8d6014c9a1d929ddb96a0eaa8753b4a59bcfc56cbf1658b64
Opcode Fuzzy Hash: 3e9bf284f51a014416bd2e884015404433c55462ee1280fbdb526b963edf0727
Instruction Fuzzy Hash: 5A115222B19F01CAEB00EFA4E8542B973A4FB59758F840E31EA6D867B4DF7CD1598350

Function 00007FFE13313A1C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE13313A48
GetCurrentThreadId.KERNEL32 ref: 00007FFE13313A56
GetCurrentProcessId.KERNEL32 ref: 00007FFE13313A62
QueryPerformanceCounter.KERNEL32 ref: 00007FFE13313A72

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction ID: 8604af2c1082f06f0d81ae416735c9648299c207c0f89ca6427ceed3f992f561
Opcode Fuzzy Hash: e14f81335c7f0e89c555c48fc70369245093cfa0888173eb1084b591f0c493ce
Instruction Fuzzy Hash: 5A112726B14F058EEB00CF61E8542B833B4FB29768F441E31EA6DA67A5DF7CD1988344

Function 00007FFE1A4D5338 Relevance: 6.0, APIs: 4, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1A4D535C
closesocket.WS2_32 ref: 00007FFE1A4D5368
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1A4D5373
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4D5382

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Eval_Thread$RestoreSave_errnoclosesocket
String ID:
API String ID: 1624953543-0
Opcode ID: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction ID: cd0464c3e851e1b38ef3907d3346d238db2b679e1199ae93ca7fbe28ccbd0f1c
Opcode Fuzzy Hash: 469834960f5fb333051253006ecc6c4dbb46e8df025279c03e012d890aa341a8
Instruction Fuzzy Hash: E9F06D66B08F4182E6545B67A4440783365AB29FB0B1807F2DA7A83BF1CF7CD4A18640

Function 00007FFE1A4FF670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A4FF732
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A4FF435), ref: 00007FFE1A4FF78C

Strings

csm, xrefs: 00007FFE1A4FF719

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction ID: a541653dac02a44c5630e85e40913ae860e53c8b08d2531a224e636785a290ba
Opcode Fuzzy Hash: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction Fuzzy Hash: C751C032B19A028BDB148F1AE444ABD6791EB44FA9F1091B6DA4D437A8DF3DE851C740

Function 00007FFE1A4F4E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE1A4F4F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4F4F74

Strings

csm, xrefs: 00007FFE1A4F501A

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction ID: 7192c136b3aabd4b77d1aa8f174ecadbe2f3b96a5fc83f6f505dd778695bf64c
Opcode Fuzzy Hash: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction Fuzzy Hash: 15511E37718B8186D6609B2AE4402BE77A4F789BA1F1411B6EF8D07B65CF3CD461CB01

Function 00007FFE1A4FA524 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4FA622

Strings

void, xrefs: 00007FFE1A4FA584
void , xrefs: 00007FFE1A4FA5AC

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction ID: 8f5d18470d8f755c23bcff267121aa79eb92f86e3510708954ac81c6716ad90f
Opcode Fuzzy Hash: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction Fuzzy Hash: 4F312562F18E658CFB01CBA9E8400FC37B0BB49B59F4425B6EA8E52B69DF3C9154C740

Function 00007FFE1A4D4B6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4D8654: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1A4D8698

PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A4D3FC0), ref: 00007FFE1A4D4C47

Strings

%X:%X:%X:%X:%X:%X%c, xrefs: 00007FFE1A4D4B97
bad bluetooth address, xrefs: 00007FFE1A4D4C3D

Memory Dump Source

Source File: 00000006.00000002.2152018428.00007FFE1A4D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE1A4D0000, based on PE: true

Associated: 00000006.00000002.2152002914.00007FFE1A4D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152039306.00007FFE1A4D9000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152056586.00007FFE1A4E1000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000006.00000002.2152071527.00007FFE1A4E3000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4d0000_l4.jbxd

Similarity

API ID: Err_String__stdio_common_vsscanf
String ID: %X:%X:%X:%X:%X:%X%c$bad bluetooth address
API String ID: 3283897942-3956635471
Opcode ID: 82460378f9390543d5d03a976a5082cfe22b1e135c935a62461cff4db5ddd525
Instruction ID: a91677eba158356650fef66a78625e09f50e1d469e8bc7d9dca90febb1462929
Opcode Fuzzy Hash: 82460378f9390543d5d03a976a5082cfe22b1e135c935a62461cff4db5ddd525
Instruction Fuzzy Hash: 9221BD71718A8592DB10CB02E8880BC73A2F754BA0F418176EAAC47B64DF3DD868C710

Function 00007FFE1A4F676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F6B60
Part of subcall function 00007FFE1A4F6B10: RaiseException.KERNEL32 ref: 00007FFE1A4F6BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F67DF

Strings

Access violation - no RTTI data!, xrefs: 00007FFE1A4F676F
Bad dynamic_cast!, xrefs: 00007FFE1A4F6792

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: 2d52890e27266e1045717feb7ea625f81b4544dc45a95d281e64930c9e93b385
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: 8A015E61B1EE86A1EE00DB2AE9511B9A360EF90F65F4064F3E50E07679EF6CD518C710

Function 00007FFE1A4F6B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4F6B60
RaiseException.KERNEL32 ref: 00007FFE1A4F6BA1

Strings

csm, xrefs: 00007FFE1A4F6B8E

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: c2a3ced317b128a22cf1c9eb84be2f7bf9c8049709dcc53c1a6f43edb3c91313
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: 55115132608F8082EB508F25E40026AB7E4FB88FA5F1842B2DF8C07765DF3CC5518700

Function 00007FFE1A4FF420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4F6E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4F29EE), ref: 00007FFE1A4F6E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4FF45A

Strings

csm, xrefs: 00007FFE1A4FF43B
f, xrefs: 00007FFE1A4FF435

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction ID: 1bf685561e05bfe03a1b44826482ad423b8cbd36fa7dfb036f7154093da9f454
Opcode Fuzzy Hash: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction Fuzzy Hash: 8AE06C36E08B5141E7505B36B1401BD6654AF59F76F1490F6DB4806666CE3CD4B04B41

Function 00007FFE13309D80 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE13309DDD
memmove.VCRUNTIME140 ref: 00007FFE133152D1
memcpy.VCRUNTIME140 ref: 00007FFE133152E8

Memory Dump Source

Source File: 00000006.00000002.2151746856.00007FFE13301000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000006.00000002.2151730827.00007FFE13300000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE13318000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151769773.00007FFE1331C000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151800672.00007FFE13324000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000006.00000002.2151816130.00007FFE13325000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe13300000_l4.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction ID: 8f1cecf0f8250f88e5fe64a0572f77b7c1ece38095aadb386f220196bac04045
Opcode Fuzzy Hash: eee6edfa71bb2dedfcc37b73b2f55b6b239783ac4416e26ed470dd15ede7d960
Instruction Fuzzy Hash: FC31F632708A45CBD6149F2BA40407DF761F768BA0B580139DBAE67BB5DE3CE852C704

Function 00007FFE1A4F6E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A4F6CE9,?,?,?,?,00007FFE1A500582,?,?,?,?,?), ref: 00007FFE1A4F6E83
SetLastError.KERNEL32(?,?,?,00007FFE1A4F6CE9,?,?,?,?,00007FFE1A500582,?,?,?,?,?), ref: 00007FFE1A4F6F0C

Memory Dump Source

Source File: 00000006.00000002.2152103347.00007FFE1A4F1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFE1A4F0000, based on PE: true

Associated: 00000006.00000002.2152086161.00007FFE1A4F0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152127914.00007FFE1A503000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152144427.00007FFE1A508000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000006.00000002.2152160274.00007FFE1A509000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffe1a4f0000_l4.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: 6c989468e135db99a66ca2bf1d3a623f8e718ed8844c1e459e8576c483cc362a
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: 30116021F0DE8282FA51873BA9102B96291AF49FB1F0456F6E92E067F5DE2CA8518710

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\l4.exe

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_bz2.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_decimal.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_lzma.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_socket.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\_wmi.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\l4.exe

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\libcrypto-3.dll

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\python312.dll

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\select.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\unicodedata.pyd

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140.dll

C:\Users\user\AppData\Local\Temp\onefile_6672_133789942081684851\vcruntime140_1.dll

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_bz2.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_decimal.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_lzma.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_socket.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\_wmi.pyd

C:\Users\user\AppData\Local\Temp\onefile_7148_133789942223114390\l4.exe

Windows Analysis Report
l4.exe

Function 00007FFE133862B4 Relevance: 1.5, APIs: 1, Instructions: 19
networkCOMMON

Function 00007FFE13385AFC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234
threadnetworkCOMMON

Function 00007FFE13385190 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114
networkthreadCOMMON

Function 00007FFE13386C9C Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82
COMMON

Function 00007FFE13384484 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
networkthreadCOMMON

Function 00007FFE13386198 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
COMMON

Function 00007FFE1338599C Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Function 00007FFE133867E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40
COMMON

Function 00007FFE133853A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39
COMMON