Edit tour

Windows Analysis Report
zapret.exe

Overview

General Information

Sample name:	zapret.exe
Analysis ID:	1573827
MD5:	ff130e918b140be5b7a4fe668950f220
SHA1:	99a24e8d484d9b1d1b16ef535a372613ac0ca9b7
SHA256:	c5e5e5439c6d507f2614f25403ed97f90240f07bb444d13a0a63ab31f2470fef
Tags:	exeuser-sa6ta6ni6c
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected AntiVM5

AI detected suspicious sample

Contains functionality to infect the boot sector

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

zapret.exe (PID: 6048 cmdline: "C:\Users\user\Desktop\zapret.exe" MD5: FF130E918B140BE5B7A4FE668950F220)

zapret.exe (PID: 7096 cmdline: "C:\Users\user\Desktop\zapret.exe" MD5: FF130E918B140BE5B7A4FE668950F220)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
Process Memory Space: zapret.exe PID: 7096	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zapret.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.4% probability

Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE4B50 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,	2_2_61CE4B50
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8659720 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FF8A8659720
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8638970 CRYPTO_free,	2_2_00007FF8A8638970
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A865C970 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8A865C970
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	2_2_00007FF8A8631393
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864C910 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FF8A864C910
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	2_2_00007FF8A863132A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631D9D CRYPTO_THREAD_run_once,	2_2_00007FF8A8631D9D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631D5C CRYPTO_clear_free,	2_2_00007FF8A8631D5C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632464 CRYPTO_malloc,memcpy,	2_2_00007FF8A8632464
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8688AD0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8688AD0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A865CB10 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A865CB10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8670BF0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8670BF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8678BAF CRYPTO_malloc,	2_2_00007FF8A8678BAF
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632478 CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	2_2_00007FF8A8632478
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631983 CRYPTO_free,CRYPTO_memdup,memcmp,CRYPTO_memdup,	2_2_00007FF8A8631983
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8664C70 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	2_2_00007FF8A8664C70
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8668C60 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8A8668C60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A865CC00 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8A865CC00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8688CF0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8688CF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867CCF0 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A867CCF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863ECC0 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	2_2_00007FF8A863ECC0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864CCB0 CRYPTO_get_ex_new_index,	2_2_00007FF8A864CCB0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863189D CRYPTO_malloc,ERR_put_error,	2_2_00007FF8A863189D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A868AD6C CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A868AD6C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863163B CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A863163B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632207 ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	2_2_00007FF8A8632207
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867AD40 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8A867AD40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864CD10 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A864CD10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8670DE0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8670DE0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8646DD7 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8646DD7
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A865CDC0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	2_2_00007FF8A865CDC0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A869CDA0 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FF8A869CDA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631410 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	2_2_00007FF8A8631410
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632306 CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8632306
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631078 CRYPTO_free,	2_2_00007FF8A8631078
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86324F5 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A86324F5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8646EA3 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8646EA3
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863AEA0 CRYPTO_free,	2_2_00007FF8A863AEA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631E24 CRYPTO_malloc,	2_2_00007FF8A8631E24
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631802 CRYPTO_strdup,	2_2_00007FF8A8631802
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631A4B OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	2_2_00007FF8A8631A4B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863254F BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FF8A863254F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8678F1A CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8678F1A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867AF10 CRYPTO_malloc,EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FF8A867AF10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631069 CRYPTO_free,	2_2_00007FF8A8631069
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8688FB0 CRYPTO_malloc,EVP_CIPHER_CTX_new,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_iv_length,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	2_2_00007FF8A8688FB0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631A05 CRYPTO_zalloc,memcpy,memcpy,memcpy,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631A05
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631047 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A8631047
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863177B EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,_time64,EVP_MD_CTX_free,EVP_PKEY_free,EVP_MD_CTX_free,EVP_PKEY_free,	2_2_00007FF8A863177B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632383 CRYPTO_malloc,	2_2_00007FF8A8632383
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8683020 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FF8A8683020
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631398 EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_security_bits,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8A8631398
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863115E OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A863115E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A869D0B0 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FF8A869D0B0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86319FB CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A86319FB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8656270 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FF8A8656270
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8698240 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	2_2_00007FF8A8698240
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631131 CRYPTO_free,	2_2_00007FF8A8631131
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8646210 CRYPTO_free,	2_2_00007FF8A8646210
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863E200 CRYPTO_malloc,	2_2_00007FF8A863E200
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8648200 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A8648200
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864E200 CRYPTO_THREAD_run_once,	2_2_00007FF8A864E200
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631DCF CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	2_2_00007FF8A8631DCF
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631CB7 CRYPTO_clear_free,	2_2_00007FF8A8631CB7
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631B7C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A8631B7C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86321BC CRYPTO_free,_time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,	2_2_00007FF8A86321BC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632365 CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	2_2_00007FF8A8632365
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8670350 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8670350
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86315C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8A86315C8
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631E79 CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A8631E79
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631DBB BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A8631DBB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A866A3F0 CRYPTO_memcmp,	2_2_00007FF8A866A3F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86383E0 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A86383E0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631F32 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	2_2_00007FF8A8631F32
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8634473 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FF8A8634473
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8680460 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8680460
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86322C0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8A86322C0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8652410 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A8652410
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631F0F CRYPTO_free,	2_2_00007FF8A8631F0F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863240F CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	2_2_00007FF8A863240F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8638490 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	2_2_00007FF8A8638490
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8690570 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8690570
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631BC7 CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8A8631BC7
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8A8631762
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86785D7 CRYPTO_clear_free,	2_2_00007FF8A86785D7
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631FCD CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631FCD
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631C03 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FF8A8631C03
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FF8A863135C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8670620 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8670620
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631BDB EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8631BDB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8634690 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FF8A8634690
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632225 CRYPTO_free,	2_2_00007FF8A8632225
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A866A690 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A866A690
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631AC3 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A8631AC3
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863101E CRYPTO_free,CRYPTO_free,	2_2_00007FF8A863101E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8688720 CRYPTO_memcmp,	2_2_00007FF8A8688720
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8664820 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A8664820
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8682820 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FF8A8682820
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631195 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631195
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86708D0 CRYPTO_memcmp,	2_2_00007FF8A86708D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631924 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8631924
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863214E CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A863214E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A866A8B0 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A866A8B0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86779F0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A86779F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86679E0 CRYPTO_free,	2_2_00007FF8A86679E0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86579D0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A86579D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86318DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A86318DE
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631A64 CRYPTO_free,	2_2_00007FF8A8631A64
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631438 ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631438
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8681990 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8681990
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8655987 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A8655987
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863129E CRYPTO_THREAD_run_once,	2_2_00007FF8A863129E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A865FA70 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A865FA70
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86323BA CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A86323BA
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8637A20 CRYPTO_free,	2_2_00007FF8A8637A20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867BAA0 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A867BAA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667A80 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8667A80
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631122 CRYPTO_free,	2_2_00007FF8A8631122
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8647B60 CRYPTO_zalloc,	2_2_00007FF8A8647B60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632185 CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8632185
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A866FB20 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A866FB20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864FBE0 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A864FBE0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667BD0 CRYPTO_free,	2_2_00007FF8A8667BD0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631974 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8631974
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86310F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	2_2_00007FF8A86310F5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632220 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8632220
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631348 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A8631348
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863102D CRYPTO_malloc,COMP_expand_block,	2_2_00007FF8A863102D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667C40 CRYPTO_free,	2_2_00007FF8A8667C40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8663C30 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A8663C30
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86314FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A86314FB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A868DCA0 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A868DCA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8645C90 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FF8A8645C90
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A868FD40 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	2_2_00007FF8A868FD40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86313FC EVP_MD_CTX_new,CRYPTO_memcmp,memcpy,memcpy,	2_2_00007FF8A86313FC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86316D1 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A86316D1
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8683D30 CRYPTO_malloc,memcpy,	2_2_00007FF8A8683D30
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8653D00 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8653D00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8649DF0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8649DF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632216 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8632216
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86311EA CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	2_2_00007FF8A86311EA
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86311B3 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A86311B3
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631C8A CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8631C8A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8681D90 CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8681D90
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864FE40 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FF8A864FE40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8639E30 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8639E30
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863DE20 CRYPTO_free,	2_2_00007FF8A863DE20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632522 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8632522
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631FF0 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8631FF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667EE0 CRYPTO_free,	2_2_00007FF8A8667EE0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863DED0 CRYPTO_free,	2_2_00007FF8A863DED0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864DED0 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8A864DED0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863258B CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A863258B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86320B3 CRYPTO_free,CRYPTO_malloc,memcpy,	2_2_00007FF8A86320B3
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8647F60 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8647F60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A868BF40 CRYPTO_memcmp,	2_2_00007FF8A868BF40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86316F9 CRYPTO_free,	2_2_00007FF8A86316F9
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631FB9 CRYPTO_free,	2_2_00007FF8A8631FB9
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863DFE0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A863DFE0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864DFC0 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8A864DFC0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A8631523
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8690050 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	2_2_00007FF8A8690050
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A864C030 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	2_2_00007FF8A864C030
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863228E CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A863228E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631956 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	2_2_00007FF8A8631956
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86460D8 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A86460D8
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8634094 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FF8A8634094
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631114 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8A8631114
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632284 EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	2_2_00007FF8A8632284
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86391B0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A86391B0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631FFF memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,_time64,	2_2_00007FF8A8631FFF
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631A87 memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631A87
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86314B5 ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FF8A86314B5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86319EC CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A86319EC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863201D EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	2_2_00007FF8A863201D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863194C ERR_put_error,ASN1_item_free,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FF8A863194C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632293 CRYPTO_memdup,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8632293
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8663360 CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	2_2_00007FF8A8663360
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867B350 CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A867B350
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8655327 CRYPTO_memdup,ERR_put_error,	2_2_00007FF8A8655327
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631073 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FF8A8631073
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863192E CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A863192E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631461 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8631461
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667460 CRYPTO_free,	2_2_00007FF8A8667460
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863160E CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A863160E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86474D0 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,	2_2_00007FF8A86474D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86674D0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8A86674D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631C94 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	2_2_00007FF8A8631C94
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8659490 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8A8659490
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631433 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8631433
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8687530 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,EVP_PKEY_id,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FF8A8687530
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86395F0 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A86395F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631163 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8631163
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8681620 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A8681620
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86313B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A86313B6
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631235 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A8631235
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631E10 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8631E10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8677760 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A8677760
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631DCA CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	2_2_00007FF8A8631DCA
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86310FF CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FF8A86310FF
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8663730 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FF8A8663730
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867B720 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A867B720
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86320F9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	2_2_00007FF8A86320F9
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86317BD OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_memcmp,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	2_2_00007FF8A86317BD
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8651790 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A8651790
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8667860 CRYPTO_free,	2_2_00007FF8A8667860
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863205E EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A863205E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A867D840 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A867D840
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86316F4 CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FF8A86316F4
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A866F8F0 CRYPTO_realloc,	2_2_00007FF8A866F8F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863176C CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	2_2_00007FF8A863176C

Source: zapret.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099749875.00007FF8B9843000.00000002.00000001.01000000.00000011.sdmp, select.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099181701.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: zapret.exe, 00000002.00000002.2099089702.00007FF8B8B00000.00000002.00000001.01000000.0000000B.sdmp, pywintypes310.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099290555.00007FF8B8C12000.00000002.00000001.01000000.0000001B.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: zapret.exe, 00000000.00000003.2060421229.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:34:57 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: zapret.exe, 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: zapret.exe, 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: zapret.exe, 00000002.00000002.2097987965.00007FF8A8E1B000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb?? source: zapret.exe, 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099547482.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: zapret.exe, 00000002.00000002.2097636069.00007FF8A8A8C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: zapret.exe, 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099457726.00007FF8B8F73000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: zapret.exe, 00000002.00000002.2099089702.00007FF8B8B00000.00000002.00000001.01000000.0000000B.sdmp, pywintypes310.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: zapret.exe, 00000002.00000002.2098517113.00007FF8B78AD000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zapret.exe, 00000000.00000003.2050858478.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099938708.00007FF8BA4F5000.00000002.00000001.01000000.0000000C.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2098688710.00007FF8B7DE7000.00000002.00000001.01000000.00000016.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099181701.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zapret.exe, 00000000.00000003.2050707818.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099829644.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: zapret.exe, 00000002.00000002.2099667066.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: zapret.exe, 00000002.00000002.2097636069.00007FF8A8A8C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: zapret.exe, 00000002.00000002.2098998173.00007FF8B7E53000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: zapret.exe, 00000002.00000002.2098998173.00007FF8B7E53000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2098904861.00007FF8B7E28000.00000002.00000001.01000000.00000010.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090710746.00000193E0E60000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: zapret.exe, 00000000.00000003.2059827050.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr

Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF79210 FindFirstFileExW,FindClose,	0_2_00007FF6DFF79210
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF99618 FindFirstFileExW,	0_2_00007FF6DFF99618
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7D679 FindFirstFileExW,	0_2_00007FF6DFF7D679
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF79210 FindFirstFileExW,FindClose,	2_2_00007FF6DFF79210
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF99618 FindFirstFileExW,	2_2_00007FF6DFF99618
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7D679 FindFirstFileExW,	2_2_00007FF6DFF7D679

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_61CD3800 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,

2_2_61CD3800

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://9x9o.com/km121124d.txt
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E3298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlhe
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ass
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092162263.00000193E3C90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: zapret.exe, 00000002.00000003.2074469393.00000193E334A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: zapret.exe, 00000002.00000003.2074469393.00000193E334A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2073271047.00000193E31EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: zapret.exe, 00000002.00000002.2092256463.00000193E3DA0000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timgolden.me.uk/python/wmi.html
Source: zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: zapret.exe, 00000002.00000002.2091582815.00000193E37FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E37FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: zapret.exe, 00000002.00000003.2070823471.00000193E2FD1000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: zapret.exe, 00000002.00000002.2092162263.00000193E3D3C000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/mit-license.phpFN
Source: zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsl
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: zapret.exe, 00000002.00000002.2092399676.00000193E3EB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: zapret.exe, zapret.exe, 00000002.00000002.2097797881.00007FF8A8AD4000.00000002.00000001.01000000.0000000D.sdmp, zapret.exe, 00000002.00000002.2099124334.00007FF8B8B11000.00000002.00000001.01000000.0000000B.sdmp, zapret.exe, 00000002.00000002.2099033083.00007FF8B7E61000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr, pywintypes310.dll.0.dr, _win32sysloader.pyd.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: zapret.exe, 00000002.00000002.2092162263.00000193E3D24000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E3720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: zapret.exe, 00000002.00000002.2090801229.00000193E2B28000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920Z
Source: zapret.exe, 00000002.00000002.2092016712.00000193E3A90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://google.com/api/1233vU554155454
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E32CC000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: zapret.exe, 00000002.00000002.2092084223.00000193E3BC8000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: zapret.exe, 00000002.00000002.2097987965.00007FF8A8E1B000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BIOS_Serial_List.txt
Source: zapret.exe, 00000002.00000002.2090882905.00000193E2BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Serial_List.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/CPU_Serial_List.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/DiskDrive_Serial_List.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/HwProfileGuid_List.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/MachineGuid.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/gpu_list.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/ip_list.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/mac_list.txt
Source: zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/pc_platforms.txt
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092162263.00000193E3D3C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC77000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2053697074.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmp, zapret.exe, 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmp, libssl-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E32CC000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: zapret.exe, 00000000.00000003.2052645917.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070153536.00000193E2F52000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: zapret.exe, 00000002.00000002.2090801229.00000193E2AA0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/;P
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: C:\Users\user\Desktop\zapret.exe

2_2_61CD3800

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_61CD2640: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle,

2_2_61CD2640

Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7A940	0_2_00007FF6DFF7A940
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF77DB0	0_2_00007FF6DFF77DB0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF72620	0_2_00007FF6DFF72620
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7B310	0_2_00007FF6DFF7B310
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7B330	0_2_00007FF6DFF7B330
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7CF80	0_2_00007FF6DFF7CF80
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF85C1A	0_2_00007FF6DFF85C1A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF798D0	0_2_00007FF6DFF798D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7B128	0_2_00007FF6DFF7B128
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD4340	2_2_61CD4340
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC6580	2_2_61CC6580
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC7590	2_2_61CC7590
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D091D0	2_2_61D091D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D191E0	2_2_61D191E0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D41180	2_2_61D41180
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D211A0	2_2_61D211A0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD8040	2_2_61CD8040
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D02072	2_2_61D02072
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D173C0	2_2_61D173C0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE83A0	2_2_61CE83A0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D28520	2_2_61D28520
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD44C0	2_2_61CD44C0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE0490	2_2_61CE0490
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D3F450	2_2_61D3F450
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D02400	2_2_61D02400
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CEB790	2_2_61CEB790
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CEE760	2_2_61CEE760
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D186C0	2_2_61D186C0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CEE9E0	2_2_61CEE9E0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD7980	2_2_61CD7980
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CDB920	2_2_61CDB920
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D27920	2_2_61D27920
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC38D6	2_2_61CC38D6
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE98F0	2_2_61CE98F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE8890	2_2_61CE8890
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD5B60	2_2_61CD5B60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD7B20	2_2_61CD7B20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC3AC1	2_2_61CC3AC1
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC9A50	2_2_61CC9A50
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CECDD0	2_2_61CECDD0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE6DF0	2_2_61CE6DF0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC7D90	2_2_61CC7D90
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE0D50	2_2_61CE0D50
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD4D70	2_2_61CD4D70
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE9D10	2_2_61CE9D10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE4CD0	2_2_61CE4CD0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D17CA5	2_2_61D17CA5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D16C00	2_2_61D16C00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC9C10	2_2_61CC9C10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD6FC0	2_2_61CD6FC0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CD0FC2	2_2_61CD0FC2
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE7FB0	2_2_61CE7FB0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CE3EA0	2_2_61CE3EA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D19E50	2_2_61D19E50
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D27E00	2_2_61D27E00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61CC1E10	2_2_61CC1E10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7A940	2_2_00007FF6DFF7A940
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7B310	2_2_00007FF6DFF7B310
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7B330	2_2_00007FF6DFF7B330
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF85C1A	2_2_00007FF6DFF85C1A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF77DB0	2_2_00007FF6DFF77DB0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF72620	2_2_00007FF6DFF72620
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7CF80	2_2_00007FF6DFF7CF80
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF798D0	2_2_00007FF6DFF798D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7B128	2_2_00007FF6DFF7B128
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A85112F0	2_2_00007FF8A85112F0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A85118D0	2_2_00007FF8A85118D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631537	2_2_00007FF8A8631537
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8636B90	2_2_00007FF8A8636B90
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863168B	2_2_00007FF8A863168B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86315B4	2_2_00007FF8A86315B4
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631398	2_2_00007FF8A8631398
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863115E	2_2_00007FF8A863115E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86320AE	2_2_00007FF8A86320AE
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863256D	2_2_00007FF8A863256D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631BDB	2_2_00007FF8A8631BDB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631997	2_2_00007FF8A8631997
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8690050	2_2_00007FF8A8690050
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631956	2_2_00007FF8A8631956
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631A87	2_2_00007FF8A8631A87
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8641200	2_2_00007FF8A8641200
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863B360	2_2_00007FF8A863B360
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631C94	2_2_00007FF8A8631C94
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86317BD	2_2_00007FF8A86317BD
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86313F2	2_2_00007FF8A86313F2
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8697860	2_2_00007FF8A8697860
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8631451	2_2_00007FF8A8631451
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863F8E5	2_2_00007FF8A863F8E5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A863114F	2_2_00007FF8A863114F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4E49	2_2_00007FF8A86E4E49
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E23F1	2_2_00007FF8A86E23F1
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E22AC	2_2_00007FF8A86E22AC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E11CC	2_2_00007FF8A86E11CC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E275C	2_2_00007FF8A86E275C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E6D57	2_2_00007FF8A86E6D57
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E5D9E	2_2_00007FF8A86E5D9E
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A881AD50	2_2_00007FF8A881AD50
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4CFF	2_2_00007FF8A86E4CFF
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A87C2E70	2_2_00007FF8A87C2E70
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E10AA	2_2_00007FF8A86E10AA
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86FEF00	2_2_00007FF8A86FEF00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E72BB	2_2_00007FF8A86E72BB
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1B22	2_2_00007FF8A86E1B22
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E213F	2_2_00007FF8A86E213F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E144C	2_2_00007FF8A86E144C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86FF060	2_2_00007FF8A86FF060
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E43FE	2_2_00007FF8A86E43FE
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1217	2_2_00007FF8A86E1217
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8817020	2_2_00007FF8A8817020
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8896290	2_2_00007FF8A8896290
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1B31	2_2_00007FF8A86E1B31
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1424	2_2_00007FF8A86E1424
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E5E20	2_2_00007FF8A86E5E20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1A4B	2_2_00007FF8A86E1A4B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8812670	2_2_00007FF8A8812670
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E655A	2_2_00007FF8A86E655A
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4679	2_2_00007FF8A86E4679
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E6FF5	2_2_00007FF8A86E6FF5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4F39	2_2_00007FF8A86E4F39
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8897980	2_2_00007FF8A8897980
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E216C	2_2_00007FF8A86E216C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4160	2_2_00007FF8A86E4160
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A874FA00	2_2_00007FF8A874FA00
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A887FA10	2_2_00007FF8A887FA10
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A881FB40	2_2_00007FF8A881FB40
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E50A6	2_2_00007FF8A86E50A6
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E724D	2_2_00007FF8A86E724D
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86FBD60	2_2_00007FF8A86FBD60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E2289	2_2_00007FF8A86E2289
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E2D0B	2_2_00007FF8A86E2D0B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A880FE60	2_2_00007FF8A880FE60
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E266C	2_2_00007FF8A86E266C
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86FBF20	2_2_00007FF8A86FBF20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E40FC	2_2_00007FF8A86E40FC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E4741	2_2_00007FF8A86E4741
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E114F	2_2_00007FF8A86E114F
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E29CD	2_2_00007FF8A86E29CD
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A88971D0	2_2_00007FF8A88971D0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E659B	2_2_00007FF8A86E659B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E68C5	2_2_00007FF8A86E68C5
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86FF200	2_2_00007FF8A86FF200
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E1EA1	2_2_00007FF8A86E1EA1
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E6EEC	2_2_00007FF8A86E6EEC
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A870B4C0	2_2_00007FF8A870B4C0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E5F0B	2_2_00007FF8A86E5F0B
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E5164	2_2_00007FF8A86E5164
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E53A3	2_2_00007FF8A86E53A3
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E5D85	2_2_00007FF8A86E5D85
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A86E54C5	2_2_00007FF8A86E54C5

Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF6DFF72E70 appears 178 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E2A04 appears 114 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 61D62C68 appears 51 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86312EE appears 582 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 61D62C20 appears 65 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF6DFF72D90 appears 100 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E4052 appears 379 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E24B9 appears 37 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E1EF1 appears 809 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E4836 appears 58 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A869D3CF appears 218 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A869D465 appears 103 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E2734 appears 268 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF6DFF72F10 appears 32 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 61CDD820 appears 235 times
Source: C:\Users\user\Desktop\zapret.exe	Code function: String function: 00007FF8A86E6988 appears 31 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: pyarmor_runtime.pyd.0.dr	Static PE information: Number of sections : 11 > 10
Source: zapret.exe	Static PE information: Number of sections : 12 > 10

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: zapret.exe, 00000000.00000003.2058272099.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes310.dll0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2060213229.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2052279847.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2060421229.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2056736061.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2050385915.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2050858478.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs zapret.exe
Source: zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2050707818.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs zapret.exe
Source: zapret.exe, 00000000.00000003.2051254709.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2059827050.000002412CC7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2060104451.000002412CC7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs zapret.exe
Source: zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2051101427.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs zapret.exe
Source: zapret.exe, 00000000.00000003.2059827050.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs zapret.exe
Source: zapret.exe, 00000000.00000003.2057965124.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom310.dll0 vs zapret.exe
Source: zapret.exe	Binary or memory string: OriginalFilename vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099780582.00007FF8B9846000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099335623.00007FF8B8C14000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099490396.00007FF8B8F76000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099699776.00007FF8B93DB000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2097797881.00007FF8A8AD4000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamepythoncom310.dll0 vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099972460.00007FF8BA4F9000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099613166.00007FF8B8F92000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamelibsslH vs zapret.exe
Source: zapret.exe, 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs zapret.exe
Source: zapret.exe, 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099124334.00007FF8B8B11000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamepywintypes310.dll0 vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099239762.00007FF8B8B44000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2098730881.00007FF8B7DEE000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2098614940.00007FF8B78C5000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099861381.00007FF8B9F77000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs zapret.exe
Source: zapret.exe, 00000002.00000002.2090710746.00000193E0E60000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2098358754.00007FF8A8F2C000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2098941942.00007FF8B7E32000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs zapret.exe
Source: zapret.exe, 00000002.00000002.2099033083.00007FF8B7E61000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs zapret.exe

Source: classification engine

Classification label: mal64.evad.winEXE@3/34@1/1

Source: C:\Users\user\Desktop\zapret.exe

Code function: 0_2_00007FF6DFF78B30 FormatMessageW,WideCharToMultiByte,GetLastError,

0_2_00007FF6DFF78B30

Source: C:\Users\user\Desktop\zapret.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI60482

Jump to behavior

Source: zapret.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zapret.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe

File read: C:\Users\user\Desktop\zapret.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zapret.exe "C:\Users\user\Desktop\zapret.exe"
Source: C:\Users\user\Desktop\zapret.exe	Process created: C:\Users\user\Desktop\zapret.exe "C:\Users\user\Desktop\zapret.exe"
Source: C:\Users\user\Desktop\zapret.exe	Process created: C:\Users\user\Desktop\zapret.exe "C:\Users\user\Desktop\zapret.exe"	Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: zapret.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: zapret.exe

Static file information: File size 10527204 > 1048576

Source: zapret.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: zapret.exe, 00000000.00000003.2059025389.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099749875.00007FF8B9843000.00000002.00000001.01000000.00000011.sdmp, select.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099181701.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: zapret.exe, 00000002.00000002.2099089702.00007FF8B8B00000.00000002.00000001.01000000.0000000B.sdmp, pywintypes310.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: zapret.exe, 00000000.00000003.2052498873.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099290555.00007FF8B8C12000.00000002.00000001.01000000.0000001B.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: zapret.exe, 00000000.00000003.2060421229.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:34:57 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: zapret.exe, 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: zapret.exe, 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: zapret.exe, 00000002.00000002.2097987965.00007FF8A8E1B000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb?? source: zapret.exe, 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: zapret.exe, 00000000.00000003.2050965341.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099547482.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: zapret.exe, 00000002.00000002.2097636069.00007FF8A8A8C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: zapret.exe, 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: zapret.exe, 00000000.00000003.2051716130.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099457726.00007FF8B8F73000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: zapret.exe, 00000002.00000002.2099089702.00007FF8B8B00000.00000002.00000001.01000000.0000000B.sdmp, pywintypes310.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: zapret.exe, 00000002.00000002.2098517113.00007FF8B78AD000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zapret.exe, 00000000.00000003.2050858478.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099938708.00007FF8BA4F5000.00000002.00000001.01000000.0000000C.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: zapret.exe, 00000000.00000003.2051418627.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2098688710.00007FF8B7DE7000.00000002.00000001.01000000.00000016.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: zapret.exe, 00000000.00000003.2051576082.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099181701.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zapret.exe, 00000000.00000003.2050707818.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2099829644.00007FF8B9F71000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: zapret.exe, 00000002.00000002.2099667066.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: zapret.exe, 00000002.00000002.2097636069.00007FF8A8A8C000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: zapret.exe, 00000002.00000002.2098998173.00007FF8B7E53000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: zapret.exe, 00000002.00000002.2098998173.00007FF8B7E53000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: zapret.exe, 00000000.00000003.2052052832.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2098904861.00007FF8B7E28000.00000002.00000001.01000000.00000010.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: zapret.exe, 00000000.00000003.2056082784.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090710746.00000193E0E60000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: zapret.exe, 00000000.00000003.2059414462.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\_win32sysloader.pdb source: zapret.exe, 00000000.00000003.2059827050.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr

Source: C:\Users\user\Desktop\zapret.exe

Code function: 0_2_00007FF6DFF715E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6DFF715E0

Source: pywintypes310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e17c
Source: md__mypyc.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x280fa
Source: _win32sysloader.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xae0c
Source: win32trace.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x10555
Source: pyarmor_runtime.pyd.0.dr	Static PE information: real checksum: 0x9d5c4 should be: 0xa2e8e
Source: win32api.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x25ee7
Source: pythoncom310.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0dfd
Source: _psutil_windows.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x1f645
Source: md.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xf357
Source: win32ui.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x120653

Source: zapret.exe	Static PE information: section name: /4
Source: zapret.exe	Static PE information: section name: .xdata
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: mfc140u.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: pyarmor_runtime.pyd.0.dr	Static PE information: section name: .xdata

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\zapret.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		2_2_61CD2640
Source: C:\Users\user\Desktop\zapret.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		2_2_61CD29F0

Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\zapret.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		2_2_61CD2640
Source: C:\Users\user\Desktop\zapret.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		2_2_61CD29F0

Source: C:\Users\user\Desktop\zapret.exe

Code function: 0_2_00007FF6DFF75810 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6DFF75810

Source: C:\Users\user\Desktop\zapret.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM5

Source: Yara match	File source: 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zapret.exe PID: 7096, type: MEMORYSTR

Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\zapret.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\_win32sysloader.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\zapret.exe

API coverage: 2.0 %

Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF79210 FindFirstFileExW,FindClose,	0_2_00007FF6DFF79210
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF99618 FindFirstFileExW,	0_2_00007FF6DFF99618
Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF7D679 FindFirstFileExW,	0_2_00007FF6DFF7D679
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF79210 FindFirstFileExW,FindClose,	2_2_00007FF6DFF79210
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF99618 FindFirstFileExW,	2_2_00007FF6DFF99618
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF7D679 FindFirstFileExW,	2_2_00007FF6DFF7D679

Source: zapret.exe, 00000000.00000003.2052952618.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: zapret.exe, 00000002.00000003.2073172319.00000193E325E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2073027661.00000193E327B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWfmtr%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_61CC2C80 PyEval_GetGlobals,PyFunction_NewWithQualName,_PyObject_CallFunction_SizeT,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,GetProcAddress,strlen,IsDebuggerPresent,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_SystemExit,PyExc_SystemExit,PyExc_SystemExit,_errno,_errno,_errno,PyExc_SystemExit,_errno,_errno,_Py_Dealloc,_Py_Dealloc,

2_2_61CC2C80

Source: C:\Users\user\Desktop\zapret.exe

Code function: 0_2_00007FF6DFF715E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6DFF715E0

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_61CD2170 GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,memcpy,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,

2_2_61CD2170

Source: C:\Users\user\Desktop\zapret.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe	Code function: 0_2_00007FF6DFF71154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,	0_2_00007FF6DFF71154
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_61D3FF20 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	2_2_61D3FF20
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF6DFF71154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,	2_2_00007FF6DFF71154
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8512AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8512AA0
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8513068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8513068
Source: C:\Users\user\Desktop\zapret.exe	Code function: 2_2_00007FF8A8632004 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8632004

Source: C:\Users\user\Desktop\zapret.exe

Process created: C:\Users\user\Desktop\zapret.exe "C:\Users\user\Desktop\zapret.exe"

Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pywintypes310.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pythoncom310.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\beaj0xj6 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmpghbk2ivq VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\psutil\_psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmpghbk2ivq VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmpghbk2ivq\gen_py\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmpghbk2ivq\gen_py\dicts.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zapret.exe	Queries volume information: C:\Users\user\Desktop\zapret.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_61D3FE40 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_61D3FE40

Source: C:\Users\user\Desktop\zapret.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\zapret.exe

Code function: 2_2_00007FF8A86E2B5D bind,WSAGetLastError,

2_2_00007FF8A86E2B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Bootkit	11 Process Injection	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Bootkit	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zapret.exe	100%	Avira	HEUR/AGEN.1354936

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\psutil\_psutil_windows.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pythoncom310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pywintypes310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\win32\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32trace.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wwww.certigna.fr/autorites/;P	0%	Avira URL Cloud	safe
http://www.opensource.org/licenses/mit-license.phpFN	0%	Avira URL Cloud	safe
http://json.org	0%	Avira URL Cloud	safe
http://9x9o.com/km121124d.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/giampaolo/psutil/issues/875.	zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	zapret.exe, zapret.exe, 00000002.00000002.2097797881.00007FF8A8AD4000.00000002.00000001.01000000.0000000D.sdmp, zapret.exe, 00000002.00000002.2099124334.00007FF8B8B11000.00000002.00000001.01000000.0000000B.sdmp, zapret.exe, 00000002.00000002.2099033083.00007FF8B7E61000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr, pywintypes310.dll.0.dr, _win32sysloader.pyd.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	zapret.exe, 00000002.00000002.2097987965.00007FF8A8E1B000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl.	zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.opensource.org/licenses/mit-license.php	zapret.exe, 00000002.00000002.2092162263.00000193E3D3C000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092162263.00000193E3C90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/pc_platforms.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://google.com/api/1233vU554155454	zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://json.org	zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	zapret.exe, 00000002.00000002.2090801229.00000193E2B28000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/get	zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/mac_list.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2073271047.00000193E31EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txt	zapret.exe, 00000002.00000002.2090882905.00000193E2BA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	zapret.exe, 00000002.00000002.2090590744.00000193E0C5C000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064068300.00000193E2661000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/DiskDrive_Serial_List.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	zapret.exe, 00000002.00000002.2091582815.00000193E37FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	zapret.exe, 00000002.00000002.2092084223.00000193E3BC8000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091582815.00000193E37FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	zapret.exe, 00000002.00000003.2064010729.00000193E2665000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	zapret.exe, 00000002.00000003.2074469393.00000193E334A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E32CC000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/;P	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl	zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	zapret.exe, 00000002.00000002.2092084223.00000193E3B90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	zapret.exe, 00000002.00000002.2090801229.00000193E2AA0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://httpbin.org/post	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/ip_list.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	zapret.exe, 00000002.00000002.2091582815.00000193E3867000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cpsl	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/BIOS_Serial_List.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crlhe	zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	zapret.exe, 00000002.00000002.2091190653.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	zapret.exe, 00000002.00000002.2091190653.00000193E3298000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	zapret.exe, 00000002.00000002.2091419809.00000193E3400000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/MachineGuid.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/time-zones/repository/tz-link.html	zapret.exe, 00000002.00000003.2070823471.00000193E2FD1000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070767831.00000193E31F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/HwProfileGuid_List.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2092162263.00000193E3D3C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	zapret.exe, 00000002.00000002.2091582815.00000193E380A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/	zapret.exe, 00000002.00000002.2092399676.00000193E3EB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/CPU_Serial_List.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	zapret.exe, 00000002.00000002.2090952969.00000193E2F94000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm0U	zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.opensource.org/licenses/mit-license.phpFN	zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.accv.es0	zapret.exe, 00000002.00000002.2091582815.00000193E379F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	zapret.exe, 00000000.00000003.2054637257.000002412CC71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	zapret.exe, 00000002.00000003.2074469393.00000193E3375000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E32CC000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E32CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	zapret.exe, 00000000.00000003.2052645917.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2070153536.00000193E2F52000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://twitter.com/	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/4457745#4457745.	zapret.exe, 00000002.00000002.2091045470.00000193E2FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	zapret.exe, 00000002.00000002.2091190653.00000193E31FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/	zapret.exe, 00000002.00000003.2074469393.00000193E33C8000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000003.2074683175.00000193E33D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail/	zapret.exe, 00000002.00000002.2090952969.00000193E2EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Serial_List.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://google.com/mail/	zapret.exe, 00000002.00000003.2074469393.00000193E334A000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091190653.00000193E332A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/3290	zapret.exe, 00000002.00000002.2092016712.00000193E3A90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920Z	zapret.exe, 00000002.00000002.2091503008.00000193E3590000.00000004.00001000.00020000.00000000.sdmp	false		high
http://timgolden.me.uk/python/wmi.html	zapret.exe, 00000002.00000002.2092256463.00000193E3DA0000.00000004.00001000.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2091852857.00000193E38B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/gabjohn3/nb/main/gpu_list.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	zapret.exe, 00000000.00000003.2054810615.000002412CC71000.00000004.00000020.00020000.00000000.sdmp, zapret.exe, 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmp, zapret.exe, 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmp, libssl-1_1.dll.0.dr	false		high
http://9x9o.com/km121124d.txt	zapret.exe, 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573827
Start date and time:	2024-12-12 16:18:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zapret.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@3/34@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 74 Number of non-executed functions: 245
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: zapret.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Rockwool-Msg-S9039587897.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	RFQ-004282A.Teknolojileri A.S.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	discord.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	QUOTATION#08670.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	INVOICE NO. USF23-24072 IGR23110.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	EEMsLiXoiTzoaDd.scr	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Statement 2024-11-29 (K07234).exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://forms.office.com/e/YpaL2Dw0r2	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://connect-velocity-33392.my.salesforce-sites.com/help	Get hash	malicious	Unknown	Browse	104.26.10.50
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	162.159.140.237
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	104.23.145.205
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	ZzS8KjNjr7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.50.161
	Szi2WJUKmv.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.50.161
	aYxpioi6G3.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	New xlsx docs074252657723824 - Tuesday, December 3, 2024 at 03_42_05 PM_html	Get hash	malicious	Unknown	Browse	172.67.142.245
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.50.161

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll	discord.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.FileRepMalware.25861.18393.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.25861.18393.exe	Get hash	malicious	Unknown	Browse
	oconsole.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: discord.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.25861.18393.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.25861.18393.exe, Detection: malicious, Browse Filename: oconsole.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	6.044159301267025
Encrypted:	false
SSDEEP:	12288:ETqIp0hPXIZSPzQ5u0j1Sn1w0vhYvSZav8pqR4aPFTP86:ETqImIN5pA1BlZZcyal
MD5:	79FF2A54A88364617450A95224BAAFFD
SHA1:	BDF9B430C6DC1CC83E4572761A19C0FEC65E7362
SHA-256:	18D37C6FEE55515F9242D31A627671EC4413A428B08A14EA329D8D9B2A54D57F
SHA-512:	7A97A7F0044E74FD6A05451F6CEB68D5E08E1ECE6D6E9BEDAA7D0C4AA2009834C5374E2ADAF66990AD3D7C1BFD21716DAA0AE77412E85532288CFFFEB08169C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.K.............d].....-i......#i.......d.......i.......i.......i...............i......-i......-i......-i1.....-i......Rich....................PE..d......g.........." .........p......T.....................................................`..............................................T...q..h...............................`\..@...T.......................(.......8................0...........................text............................... ..`.rdata..............................@..@.data...............................@....pdata...............`..............@..@.rsrc...............................@..@.reloc..`\.......^..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97168
Entropy (8bit):	6.424686954579329
Encrypted:	false
SSDEEP:	1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
MD5:	A87575E7CF8967E481241F13940EE4F7
SHA1:	879098B8A353A39E16C79E6479195D43CE98629E
SHA-256:	DED5ADAA94341E6C62AEA03845762591666381DCA30EB7C17261DD154121B83E
SHA-512:	E112F267AE4C9A592D0DD2A19B50187EB13E25F23DED74C2E6CCDE458BCDAEE99F4E3E0A00BAF0E3362167AE7B7FE4F96ECBCD265CC584C1C3A4D1AC316E92F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...Y.-a.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37240
Entropy (8bit):	6.3017272133584585
Encrypted:	false
SSDEEP:	384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
MD5:	37C372DA4B1ADB96DC995ECB7E68E465
SHA1:	6C1B6CB92FF76C40C77F86EA9A917A5F854397E2
SHA-256:	1554B5802968FDB2705A67CBB61585E9560B9E429D043A5AA742EF3C9BBFB6BF
SHA-512:	926F081B1678C15DC649D7E53BFBE98E4983C9AD6CCDF11C9383CA1D85F2A7353D5C52BEBF867D6E155FF897F4702FC4DA36A8F4CF76B00CB842152935E319A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d...^.-a.........." .....:...6......`A..............................................7]....`A.........................................l.......m..x....................n..x#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80112
Entropy (8bit):	6.430958049258642
Encrypted:	false
SSDEEP:	1536:/wz7h8B7BjhJCZePYgl/YS8xh2Nv0BIjMVHy:/wz18BrJCJglwlxINv0BIjMV
MD5:	E877E39CC3C42ED1F5461E2D5E62FC0F
SHA1:	156F62A163ACA4C5C5F6E8F846A1EDD9B073ED7E
SHA-256:	4B1D29F19ADAF856727FA4A1F50EEE0A86C893038DFBA2E52F26C11AB5B3672F
SHA-512:	D6579D07EDE093676CDCA0FB15AA2DE9FCD10FF4675919AB689D961DE113F6543EDBCEECF29430DA3F7121549F5450F4FE43D67B9EAB117E2A7D403F88501D51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>;.m;.m;.m2.=m1.mi..l9.m].Sm8.mi..l7.mi..l3.mi..l?.m...l8.m/..l9.m;.md.m...l3.m...l:.m..Qm:.m...l:.mRich;.m................PE..d....`.a.........." .........^...............................................P......Q.....`.........................................@...H............0....... ..,............@......`...T...............................8............................................text...U........................... ..`.rdata...>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119024
Entropy (8bit):	5.950384810500538
Encrypted:	false
SSDEEP:	3072:1W66GKh4hqyIVQoavMSutBSfrS94eU9x3FIjBPl:86QKtkSubSfrSX4
MD5:	C8F57695AF24A4F71DAFA887CE731EBC
SHA1:	CC393263BAFCE2A37500E071ACB44F78E3729939
SHA-256:	E3B69285F27A8AD97555BEBEA29628A93333DE203EE2FAE95B73B6B6D6C162B1
SHA-512:	44A1FB805D9EF1A2D39B8C7D80F3545E527AB3B6BFC7ABD2F4B610F17C3E6AF2AE1FED3688A7CC93DA06938AE94E5E865B75937352D12F6B3C45E2D24B6AB731
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........S..D2a.D2a.D2a.MJ.B2a..G`.F2a..Gd.O2a..Ge.L2a..Gb.@2a..G`.F2a.PYe.E2a.PY`.B2a..[`.G2a.D2`..2a..Gl.B2a..Ga.E2a..G..E2a..Gc.E2a.RichD2a.........................PE..d....`.a.........." ................ [...................................................`..........................................Q.......Q..........................................T........................... ...8...............@............................text............................... ..`.rdata...k.......l..................@..@.data...T>...p...8...\..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247024
Entropy (8bit):	6.507382866512779
Encrypted:	false
SSDEEP:	6144:KPEw6l3ZY3ipYnIq3Ur5gShoaMp9qWMa3pLW1AAl4h2w:lw6lKipSurHhOemh2w
MD5:	95F1BE8C2D46AA4B5AD13F4FBB228C31
SHA1:	0B520B00E4FC9347094FCB687C812D01B903E70C
SHA-256:	F7864B8B37715A87F4F11D5CBFEFD5F1489399E064F7662FA0E0D7C5DF59D5E4
SHA-512:	B3F6E94B7B4646954AF51DA36A80E0DE3E40C0B674C1ABFE735177635582A33492DAF14F39383644751618C2B1ECF05FF0877EB86BF6C9D5F197A951D596FDDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.<.$.R.$.R.$.R.-....R.v.S.&.R.v.W.(.R.v.V.,.R.v.Q. .R...S.'.R.0.S.&.R.$.S...R...Q.%.R..._.+.R...R.%.R....%.R...P.%.R.Rich$.R.................PE..d....`.a.........." .....n...<......\...............................................U.....`..........................................E..P....E..................\(..............<...0...T...............................8............................................text....m.......n.................. ..`.rdata...............r..............@..@.data....)...`...$...J..............@....pdata..\(..........n..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59120
Entropy (8bit):	6.086945167584943
Encrypted:	false
SSDEEP:	768:33RNYlTw3glkdw/b2nVnzYtnqLBfVCpYthafS90UZIjYI7vDG4yth:wTRidw/b26nOBfV5hafS7ZIjYIFy
MD5:	4FB84E5D3F58453D7CCBF7BCC06266A0
SHA1:	15FD2D345EC3A7F4D337450D4F55D1997FAE0694
SHA-256:	DF47255C100D9CC033A14C7D60051ABE89C24DA9C60362FE33CDF24C19651F7C
SHA-512:	1CA574E9E58CED8D4B2A87A119A2DB9874CD1F6CEDEF5D7CBF49ABF324FB0D9FB89D8AAC7E7DFEFBEB00F6834719ED55110BCB36056E0DF08B36576FFD4DB84C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@...I.m.D.......B.......K.......H.......C.......B...T...B.......C...@...........A.......A.......A.......A...Rich@...........PE..d....`.a.........." .....R...z......`>..............................................\.....`.............................................P...`........................................y..T............................y..8............p..x............................text....P.......R.................. ..`.rdata..BM...p...N...V..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153328
Entropy (8bit):	6.798408534093874
Encrypted:	false
SSDEEP:	3072:FD6xBrqs+vs0H0q8bnpbVZbXsAIcznfo9mNof5vSpFpBIjD1:FD63rcRLCV+SwYOf507
MD5:	80DA699F55CA8ED4DF2D154F17A08583
SHA1:	FBD6C7F3C72A6BA4185394209E80373177C2F8D7
SHA-256:	2E3FD65C4E02C99A61344CE59E09EC7FDE74C671DB5F82A891732E1140910F20
SHA-512:	15EA7CD4075940096A4AB66778A0320964562AA4AE2F6E1ACBE173CD5DA8855977C66F019FD343CFE8DACC3E410EDF933BCE117A4E9B542182BAD3023805FD44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l..h...h...h.......h......h......h......h......h..o....h.......h...h..h..o....h..o....h..o....h..o....h..Rich.h..................PE..d....`.a.........." .....^...........2...............................................O....`.............................................L...,...x....`.......@.......:.......p..D...H{..T............................{..8............p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..D....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26856
Entropy (8bit):	6.1823978416668455
Encrypted:	false
SSDEEP:	384:ysfqkQfdUCUFYS9F6X06rE7SSVYptnHbFIjmUvDG4y8OZZ4h7n:yzdUC+F6rE7SSVY7FIjmUvDG4yf6h7
MD5:	7E7D6DA688789AA48094EDA82BE671B7
SHA1:	7BF245F638E549D32957A91E17FCB66DA5B00A31
SHA-256:	9AD5BCF2A88E1FFFF3B8EE29235DC92CE48B7FCA4655E87CB6E4D71BD1150AFB
SHA-512:	D4C722E741474FE430DD6B6BD5C76367CC01AE4331720D17ED37074AD10493CC96EB717F64E1451E856C863FBB886BDC761D5A2767548874BA67EABF57AC89BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.a..~...~...~.......~..T....~..T....~..T....~..T....~......~.......~...~..N~......~......~......~......~..Rich.~..........................PE..d....`.a.........." .........6......................................................z.....`.........................................@C..L....C..d....p.......`.......L...............3..T...........................p3..8............0.. ............................text...*........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74480
Entropy (8bit):	6.115609697426734
Encrypted:	false
SSDEEP:	1536:7mtvsZWgzruIAt9/s+S+pz6c/+lVFIjBwYyV:a5IJzrAt9/sT+pz6c/SVFIjBw
MD5:	7F25AB4019E6C759FC77383F523EF9AF
SHA1:	5E6748CE7F6753195117FDC2820996B49FD8D3AF
SHA-256:	D0497B79345B2C255F6274BAEA6AC44B74F345E111AB25BF6C91AF9B2A3F3B95
SHA-512:	A179B22C61F661E4D9B17F56B6A7F66F2D8D8E1D2A9A8ACA3C4D6A9CB7755CE6D223BFBCA817C1098692A39B6FC20FFBDACEFD9BFB47FF02FFA47BADCA437514
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rV..67..67..67..?Og.07..dB..47..dB.:7..dB.>7..dB..57...B..47.."\..17..67...7...B..77...B..77...B..77...B..77..Rich67..........PE..d....`.a.........." .....l...........%.......................................P......I.....`.............................................P............0....... ..<............@..........T..............................8............................................text...Vj.......l.................. ..`.rdata..Ts.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155888
Entropy (8bit):	5.9267866538347596
Encrypted:	false
SSDEEP:	3072:3MYNRsSzeOfeC1uHv8MmTuzBTvh8VGH70NmHh4kwooSLteSdo9dBIjM7:3MYjPzeOfeYMvuuzcVADtho9d
MD5:	CF2F95ECF1A72F8670177C081EEDEB04
SHA1:	6652F432C86718FED9A83BE93E66EA5755986709
SHA-256:	BA6025AB22D8E6C5AD53C66DC919F219A542E87540502905609B33DC0A8DDDD8
SHA-512:	7E5DF920F6ACB671E78078E9C4FA3278AE838EA6BEF49C0AE44DE6A79923A3D7BCCF0FB3F0E477CA5092E23450494DEE265D8735B24D8026456E1328F6FE8B2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..w&..w&..w&......w&..'..w&..#..w&.."..w&..%..w&.q.'..w&..'..w&...'..w&..w'.Ev&.q.+..w&.q.&..w&.q....w&.q.$..w&.Rich.w&.........PE..d....`.a.........." ................l*..............................................Xv....`.............................................d............`.......P.......D.......p..8.......T...............................8...............x............................text...T........................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20720
Entropy (8bit):	6.176378811651125
Encrypted:	false
SSDEEP:	192:2D/FdzSA+BW0aNBE/NDyPHFK0HDLlXKgOBIjDwJPDWpH4yhS/97HJv5pyBZH8ZX:kvEaNKFDyNnlXK5BIjDwJPDG4y8zUh
MD5:	E40FD3E717AC6EDBB4238BBF9AFA7362
SHA1:	C4AE109B8CB3DC91CFB7DA8E33BB0EF4B1C07A93
SHA-256:	FE822F84185005B2F84189B51226A3591693EC7C936C2FC009139C36493F4CD8
SHA-512:	730BD359A04F3BAE3BE70B5833AD8147F91DF9071B007BD9BFBD09EA332C685C1CE886B955FFC4801FF1AB7FA3354EEE3159A9D8ED0D6466E713992BE1327C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<I.R]'.R]'.R]'.[%..P]'..(&.P]'..(".Y]'..(#.Z]'..($.Q]'..(&.P]'.F6&.W]'.R]&.{]'..(/.S]'..('.S]'..(..S]'..(%.S]'.RichR]'.........PE..d....`.a.........." .........&...... ........................................p......F.....`......................................... )..L...l)..x....P.......@.......4.......`..<...."..T...........................`"..8............ ..0............................text...X........................... ..`.rdata..f.... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..<....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	879278
Entropy (8bit):	5.683530651321781
Encrypted:	false
SSDEEP:	12288:OVghgApCWymC6Shc1TBA4a2YcsduVwOsfJEw4W0SaMNN:OVghoVmhLa2PLVwOsfJEw4vMNN
MD5:	5E0227944397E9075E254FE03249E61A
SHA1:	01C3AB9740C31ED29A09B29F1EA3A0FCC6B3B08B
SHA-256:	94085E85495CC0FDF278071BB80B230F8D1CFCAC87189FE0A85581B77E876D95
SHA-512:	1ACBC098A89602C5D851F9421DC616F15B2026A78F78E7215C121FEFB5A815A6CE89914ECDBD4330E04158B008D34B295B2CF1E3666D7878E5BEBD4DCD76CEB3
Malicious:	false
Preview:	PK..........!.<L.{............_collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI60482\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.82516630102953
Encrypted:	false
SSDEEP:	96:700fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFOCQAASmHcX6g8H4ao:QFCk2z1/t12iwU5usJFqCyVcqgg
MD5:	F4F7F634791F26FC62973350D5F89D9A
SHA1:	6BE643BD21C74ED055B5A1B939B1F64B055D4673
SHA-256:	45A043C4B7C6556F2ACFC827F2FF379365088C3479E8EE80C7F0A2CEB858DCC6
SHA-512:	4325807865A76427D05039A2922F853287D420BCEBDA81F63A95BF58502E7DA0489060C4B6F6FFD65AA294E1E1C1F64560ADD5F024355922103C88B2CF1FD79B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122368
Entropy (8bit):	5.903697891709302
Encrypted:	false
SSDEEP:	1536:5ewkbk74PoxchHGTm/SCtg5MbfFPjPNoSLn2dkp2A/2pQKP:5endPox6HGTOLtg6bfFhDLkkCpQK
MD5:	47EE4516407B6DE6593A4996C3AE35E0
SHA1:	293224606B31E45B10FB67E997420844AE3FE904
SHA-256:	F646C3B72B5E7C085A66B4844B5AD7A9A4511D61B2D74153479B32C7AE0B1A4C
SHA-512:	EFA245C6DB2AEE2D9DB7F99E33339420E54F371A17AF0CF7694DAF51D45AEBFBAC91FC52DDB7C53E9FC73B43C67D8D0A2CAA15104318E392C8987A0DAD647B81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).6...........7.......................................0............`......................................... ...d.................................... ......@...................................@............P...............................text...(4.......6.................. ..`.rdata...Y...P...Z...:..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3429624
Entropy (8bit):	6.093870626224665
Encrypted:	false
SSDEEP:	49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
MD5:	63C4F445B6998E63A1414F5765C18217
SHA1:	8C1AC1B4290B122E62F706F7434517077974F40E
SHA-256:	664C3E52F914E351BB8A66CE2465EE0D40ACAB1D2A6B3167AE6ACF6F1D1724D2
SHA-512:	AA7BDB3C5BC8AEEFBAD70D785F2468ACBB88EF6E6CAC175DA765647030734453A2836F9658DC7CE33F6FFF0DE85CB701C825EF5C04018D79FA1953C8EF946AFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.>y..P..P..Pv..m.P-.Q+}.P-.U+t.P-.T+w.P-.S+{.Pk.Q+t.P..Q..P).S+b.P).T+..P).P+~.P).~.P).R+~.PRich..P*........PE..d.....'a.........." ......$...................................................4.......4...`.........................................@Q/..h....4.@....@4.\|....@2......84......P4..O....,.8...........................P.,.8.............4..............................text...4.$.......$................. ..`.rdata..V.....$.......$.............@..@.data....z....1..,....1.............@....pdata.. ....@2.......1.............@..@.idata..^#....4..$....3.............@..@.00cfg..Q....04.......3.............@..@.rsrc...\|....@4.......3.............@..@.reloc...x...P4..z....3.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	695032
Entropy (8bit):	5.528361289023932
Encrypted:	false
SSDEEP:	12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
MD5:	BD857F444EBBF147A8FCD1215EFE79FC
SHA1:	1550E0D241C27F41C63F197B1BD669591A20C15B
SHA-256:	B7C0E42C1A60A2A062B899C8D4EBD0C50EF956177BA21785CE07C517C143AEAF
SHA-512:	2B85C1521EDEADF7E118610D6546FAFBBAD43C288A7F0F9D38D97C4423A541DFAC686634CDE956812916830FBB4AAD8351A23D95CD490C4A5C0F628244D30F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&v..G.^.G.^.G.^.?.^.G.^.2._.G.^.,._.G.^.2._.G.^.2._.G.^.2._.G.^.2._.G.^.G.^HF.^.2._.G.^.2._.G.^.2.^.G.^.2._.G.^Rich.G.^........................PE..d.....'a.........." .....8...L......<.....................................................`.........................................p+...N..HE..........s........K...~..........l.......8...............................8............0..H............................text....6.......8.................. ..`.rdata..z)...P...*...<..............@..@.data...QM.......D...f..............@....pdata...T.......V..................@..@.idata..PW...0...X..................@..@.00cfg..Q............X..............@..@.rsrc...s............Z..............@..@.reloc..]............b..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\pyarmor_runtime_000000\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	632832
Entropy (8bit):	6.201081085978214
Encrypted:	false
SSDEEP:	12288:o324+uMvAgD0Tctjdcg7fUoPJpmm7nEQKDI4L:WXctjdcg7fUoPJpmm7nR
MD5:	1364D866424B52AA63B19361A5FC1900
SHA1:	295ED5DBDB19C5753879190CE23414F0D7C9492D
SHA-256:	9061EB7E964FF55DDAD25689A207A4CD99E60ADEB734D3665664FB1CA5972C92
SHA-512:	C9BE2D592BB2F3248BB229233997A9604319C8021B99CB19D88B27D7D95814EBEAFBB916105F3845D89E719A6A25D82D0AA31D253C0A0AA4C39939703F7CD613
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".............h..0..........a.............................................. .........................................].... ..D3...........@...$..............................................(...................(+...............................text...............................`.P`.data...0F... ...H..................@.`..rdata..`....p.......X..............@.`@.pdata...$...@...$..................@.0@.xdata...&...p...(...B..............@.0@.bss.....f............................`..edata..]............j..............@.0@.idata..D3... ...4...l..............@.0..CRT....X....`......................@.@..tls.........p......................@.@..reloc..............................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\python3.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61680
Entropy (8bit):	5.923125956498207
Encrypted:	false
SSDEEP:	768:ub8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqj:ubwewnvtjnsfwQFIjB0Sy
MD5:	64A9384C6B329FB089E4D1657A06B175
SHA1:	BA0E6FCC3B1406356A40B9D8577B2E7CE69C4AEA
SHA-256:	EC655CC34819D6A9677C0541FD7E7B2B8A92804E8BF73AEE692A9C44D1A24B5D
SHA-512:	9593D38ABFD46BB94409838DD9CBE603FBE154FA0043959512AFC264DCEEC50D846EEFA409BCF9936EE1A7C7313604A578B4051EB6FD6918F2BEB0DA6C8EE532
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.P.l...d.P.d...d.P.....d.P.f...d.Rich..d.........PE..d....`.a.........." ......................................................................`.........................................`...`...............................................T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\python310.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4471024
Entropy (8bit):	6.4570242533143904
Encrypted:	false
SSDEEP:	49152:ap5nee18PwNpD10kamVxr3L8rVcTVNs8lPmARWnhF8eI/21eN7ocLlIk80HLBMZZ:ameTRdFLUS2AlFWkJHNMZINh
MD5:	316CE972B0104D68847AB38ABA3DE06A
SHA1:	CA1E227FD7F1CFB1382102320DADEF683213024B
SHA-256:	34F0E44A0D089587E1EA48C1CC4C3164A1819C6DB27A7C1B746AF46D6388C26E
SHA-512:	A11DA6590A71D977C62B1C26C275763413F6A455E6D85FA052654D05D845DBBE8122BBD8E0A23887F9873D4291382EBBD5DF19674AD2DDA1CF0FF3206054939B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................~....................................................b............\|............Rich....................PE..d....`.a.........." ......#..R!..............................................PE.....(.D...`...........................................=.....X.=.\|.....D.......B.4.....D.......D..t...M%.T...........................`M%.8.............#.(............................text.....#.......#................. ..`.rdata...#....#..$....#.............@..@.data.........>.......=.............@....pdata..4.....B.......A.............@..@PyRuntim`.....D.......C.............@....rsrc.........D.......C.............@..@.reloc...t....D..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pythoncom310.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	669184
Entropy (8bit):	6.038501106256027
Encrypted:	false
SSDEEP:	12288:Z0t/kfQ/Uylo3H6J6vEGOIWGe3PVpdYqWMA:6t/kf1ylo33vp9KPFP
MD5:	3B8B8691D5E5E80F54548A7E210D4339
SHA1:	064C6BCDFAEF6662F3C1B243C1AA9AA8DAB520BB
SHA-256:	007DF83330975B9A70F1700CC6DF11286D14D06987BE75D4B0B05452CB7B84F1
SHA-512:	BA67915000A00B4A56F34A5035863228F3253004BB8B669DFF08848483D8D05CCE41E535A7142C18620E4F9F7BA85DA19F965D1B67DEC2B64F6296F34DD06638
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.~.T.-.T.-.T.-.,.-.T.-.!.,.T.-.!.,.T.-.!.,.T.-.!.,.T.-p!.,.T.-.,.,.T.-~!.,.T.-.,.,.T.-.T.-.U.-p!.,.T.-p!.,.T.-p!.,.T.-Rich.T.-........................PE..d...9..g.........." ................T.....................................................`..........................................U...c..(...........l....@...z............... ..P...T...............................8............................................text...C........................... ..`.rdata..x$.......&..................@..@.data....I..........................@....pdata...z...@...\|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.995301814533339
Encrypted:	false
SSDEEP:	3072:MBdf5t5cspEpc/1utS9DNbtt1Y/r06Yrmu30mpEGNwX9iuu:MBdf5t5c/pW7nY/rk6y0mpEowX9i
MD5:	C873CF87068A45FB47993AF23D8A3E12
SHA1:	96A26436F22E3431D25661CEA7E5C2BCF3C7EE51
SHA-256:	3813FC39304F64101E99F2C5378C0A72B784EFCAEA695FFEEDE5FF6EA06F097B
SHA-512:	95975E39ECD6C60FFE0B973BAB9B5AE8C7B129EEDCEBCFE142EE2550C11385388CBCAFBF3CAA055E0A521D322948476C736FEDD473EB0C9BB5B3FCF4CEF311BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ZI+.;'x.;'x.;'x.C.x.;'x.N&y.;'x.T.x.;'x.N"y.;'x.N#y.;'x.N$y.;'x.C#y.;'x1N&y.;'x.C&y.;'x.;&x.;'x?N.y.;'x?N'y.;'x?N%y.;'xRich.;'x........................PE..d......g.........." .........................................................P............`..........................................u..lB......,....0..l.......L............@..0....Q..T............................R..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\select.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25320
Entropy (8bit):	6.263553120406061
Encrypted:	false
SSDEEP:	384:OPjk/7e12hwheC9HqzYBsVhzFIjmGWDG4y8DiVhFC:kUC2hwhJHqsYpFIjmGWDG4ybVh4
MD5:	589F030C0BAA8C47F7F8082A92B834F5
SHA1:	6C0F575C0556B41E35E7272F0F858DCF90C192A7
SHA-256:	B9EF1709ED4CD0FD72E4C4BA9B7702CB79D1619C11554EA06277F3DAC21BD010
SHA-512:	6761C0E191795F504FC2D63FD866654869D8819C101DE51DF78FF071A8985541EEC9A9659626DFCB31024D25FD47EFF42CAA2AE85CC0DEB8A11113675FAC8500
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f ...N...N...N.......N..rO...N..rK...N..rJ...N..rM...N.[rO...N..lO...N...O...N.[rC...N.[rN...N.[r....N.[rL...N.Rich..N.................PE..d....`.a.........." .........0............................................................`.........................................`@..L....@..x....p.......`.......F..........H....2..T............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..H............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1117936
Entropy (8bit):	5.373590441522219
Encrypted:	false
SSDEEP:	12288:zrlBMmuZ63NIQCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOL:vlBuzZV0m81MMREtV6Vo4uYOL
MD5:	ABABF276D726328CA9A289F612F6904C
SHA1:	32E6FC81F1D0CD3B7D2459E0AA053C0711466F84
SHA-256:	89C93A672B649CD1E296499333DF5B3D9BA2FD28F9280233B56441C69C126631
SHA-512:	6D18B28FB53FFE2EEBD2C5487B61F5586D693D69DD1693D3B14FB47CA0CD830E2BD60F8118693C2FF2DCB3995BBFCC703B6E3067E6B80E82B6F4666CA2A9C2CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......hQ$z,0J),0J),0J)%H.)0J)~EK(.0J)~EO( 0J)~EN($0J)~EI(/0J).EK(/0J)8[K(.0J),0K)}0J).EG(-0J).EJ(-0J).E.)-0J).EH(-0J)Rich,0J)........PE..d....`.a.........." .....B..........`.......................................@...........`.............................................X...(........ .......................0......0L..T............................L..8............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.113940315233747
Encrypted:	false
SSDEEP:	192:RCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPQRD015dHvcqvn7ycIt/F/:RardA0Bzx14r6nDqCdhv+N/
MD5:	587C3A0118B8F7C92C6D66639A6D6815
SHA1:	4BF1F9B0F66BF0C9814B8355675E305959FFDE78
SHA-256:	8776152A8BC78F7D241788C2E31172814604ED88DC5FA7D10F7A5F649EF2AAAF
SHA-512:	0325611B4C17DFB4FC3E77D7CF4C0F394C1AA9420E70A6F8F0605D9B7C3FA3C34CE9142479A73FA111946D18ED1E0A9EE00E1378DDDED34D32F9CBDB2E0D738D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.f.............'...,...\|...,...e...,...\|...%...\|...&...\|...-......-............../....../....../...Rich....................PE..d......g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	132608
Entropy (8bit):	5.862449818315769
Encrypted:	false
SSDEEP:	3072:z3/yGM9FDwORzlpKHiG4jNvZNWlRVFhLaNzvqqQvmuquXRPDwle:D6J9pNRznKCG6NRIlRVgvqqQ4uXRP
MD5:	70F81DEC61A66E7656916034EEB53654
SHA1:	8739E1BF230B9834649F4DC45C4C42B49F96E5E2
SHA-256:	250CAC5963EB40FC9DFCB1205D9D3CA3E7A0E49C5863B7736D8D4DCB75E3E45E
SHA-512:	39C72DAACECB54BE8E8088038CA9A1629356C6E4B5D723CC2C01E987C848AF97A762A5B16E5020D8BD0FC0B98D0B899621EE9DC3B86A99A45FA537FE1D3AC117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.p...p...p.......p.......p.......p.......p.......p.......p.......p.......p...p...q.......p.......p.......p..Rich.p..........................PE..d......g.........." .........................................................P............`.........................................P...............0..\....................@..X....v..T............................;..8............0.........@....................text............................... ..`.rdata..b....0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60482\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.278083154463425
Encrypted:	false
SSDEEP:	384:4eeH8ZmV+zknwMswDuVQO0T8Dmwel2/QE9BfEA45yn9uku1B+:E+zi/uVQZQ/QE9dcUiB
MD5:	A9FA0D374A60D11D2C787A2E6BFC975D
SHA1:	1D085C6242C9E56ED05E27355B4444979A2C56CD
SHA-256:	48F49C4B575042A5BE98A7291CE91FE56B89B368608E6B12DACA3A6F9CB2DD55
SHA-512:	52EF5B9D9AAC9D511A2DDF87F4E213877A7C01241A67A09FDC8AE572DB2BCFAC86692D1EF22D29D1ED469A1251F139B74FAF998A1D801925099F296C8368B2A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)(U.HF..HF..HF..0...HF..=G..HF..=C..HF..=B..HF..=E..HF.(=G..HF.&=G..HF..0G..HF..HG..HF.(=O..HF.(=F..HF.(=D..HF.Rich.HF.........PE..d......g.........." .....,...,.......(....................................................`......................................... Q..T...tQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\beaj0xj6

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\tmpghbk2ivq\gen_py\init.py

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:	3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\tmpghbk2ivq\gen_py\dicts.dat

Download File

Process:	C:\Users\user\Desktop\zapret.exe
File Type:	data
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:qW6:qW6
MD5:	2C7344F3031A5107275CE84AED227411
SHA1:	68ACAD72A154CBE8B2D597655FF84FD31D57C43B
SHA-256:	83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
SHA-512:	F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
Malicious:	false
Preview:	..K....}..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.996235926827306
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	zapret.exe
File size:	10'527'204 bytes
MD5:	ff130e918b140be5b7a4fe668950f220
SHA1:	99a24e8d484d9b1d1b16ef535a372613ac0ca9b7
SHA256:	c5e5e5439c6d507f2614f25403ed97f90240f07bb444d13a0a63ab31f2470fef
SHA512:	76b41a6618f8f1d47bd38bf3fc17e45b0664d8672e20bd889f21b9c6d1a92f77f5d77782f37c072fc7e0edf493e60f1a4443f7fecbddb35b00a48e8f341e9b83
SSDEEP:	196608:YV1Z2azjvj8p5drY+1LaWVh2ZqICteEroXxyNE+sKsXXgfntkKleX8FwGhUL:YVlj87duGInEroXesKkXgGspB
TLSH:	0AB63320D3E1508DE5AB6A34C1B5CAA03870FC765BA1D46D475D83B97BCB6E1AFF1880
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...56Zg.L.............(.....>... .............@....................................$D....`................................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x1400010f6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x675A3635 [Thu Dec 12 01:02:45 2024 UTC]
TLS Callbacks:	0x4000d900, 0x1, 0x4000d9c0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cf8ad0ecdb3ba4aa29003f793248ec72

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [00020734h]
mov dword ptr [eax], 00000001h
call 00007F5DED0720E2h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [00020705h]
mov dword ptr [eax], 00000000h
call 00007F5DED0720B3h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 70h
dec eax
mov dword ptr [ebp-10h], 00000000h
mov dword ptr [ebp-1Ch], 00000030h
mov eax, dword ptr [ebp-1Ch]
dec eax
mov eax, dword ptr [eax]
dec eax
mov dword ptr [ebp-28h], eax
dec eax
mov eax, dword ptr [ebp-28h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007F5DED0720C3h
dec eax
mov eax, dword ptr [ebp-10h]
dec eax
cmp eax, dword ptr [ebp-18h]
jne 00007F5DED0720ABh
mov dword ptr [ebp-04h], 00000001h
jmp 00007F5DED0720E7h
mov ecx, 000003E8h
dec eax
mov eax, dword ptr [0002853Eh]
call eax
dec eax
mov eax, dword ptr [000206DDh]
dec eax
mov dword ptr [ebp-30h], eax
dec eax
mov eax, dword ptr [ebp-18h]
dec eax
mov dword ptr [ebp+00h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29000	0x15fc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2d000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x25000	0xf84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x13c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29580	0x4f0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18288	0x18400	9c2596c0592ccc58164011da4a9a4dcb	False	0.4415572648195876	data	6.157251229623974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x1a000	0x150	0x200	1f4507ce14f5b191ac58401f2a214607	False	0.189453125	data	1.3808733002905107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b000	0x8240	0x8400	794cad6ae32dc4a21569ba42e251687c	False	0.47502367424242425	data	6.53189637069924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
/4	0x24000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x25000	0xf84	0x1000	a3f39c632cda478403b28117d90d55ac	False	0.472900390625	data	5.053753639531579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x26000	0xfd4	0x1000	a79bae400f768025896b6ae65f75d76f	False	0.253173828125	shared library	4.373062033181509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x27000	0x1ed0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x29000	0x15fc	0x1600	784cf13538071a0d21100682f50e9e8d	False	0.33203125	data	4.563031060063162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x2b000	0x60	0x200	b2a3077f13c238ee9d4c75195b625433	False	0.06640625	data	0.26625055731160896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2c000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2d000	0xf41c	0xf600	4c8f6d330806f9f4616d141f80690999	False	0.8030678353658537	data	7.55489091318796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d000	0x13c	0x200	484e5780829af3e901d85f83ce6155e3	False	0.490234375	data	3.5778946471700066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x2d208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x2e0b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x2e958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x2eec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x383ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x3a994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x3ba3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x3bea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x3bf0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
ADVAPI32.dll	ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
COMCTL32.dll	LoadIconMetric
GDI32.dll	CreateFontIndirectW, DeleteObject, SelectObject
KERNEL32.dll	CloseHandle, CreateDirectoryW, CreateProcessW, CreateSymbolicLinkW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, __C_specific_handler
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __argc, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _filelengthi64, _fileno, _findclose, _fileno, _fmode, _get_osfhandle, _getpid, _initterm, _lock, _onexit, _snwprintf, _stat64, _strdup, _unlock, _wcmdln, _wcsdup, _wcsdup, _wfindfirst64, _wfindnext64, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wstat64, _wtempnam, abort, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwprintf, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, strtoul, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs
USER32.dll	CreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongPtrW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongPtrW, SystemParametersInfoW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 16:19:03.973503113 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:03.973548889 CET	443	49705	104.26.12.205	192.168.2.5
Dec 12, 2024 16:19:03.973633051 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:03.974443913 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:03.974457026 CET	443	49705	104.26.12.205	192.168.2.5
Dec 12, 2024 16:19:05.200443983 CET	443	49705	104.26.12.205	192.168.2.5
Dec 12, 2024 16:19:05.201116085 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:05.201154947 CET	443	49705	104.26.12.205	192.168.2.5
Dec 12, 2024 16:19:05.202312946 CET	443	49705	104.26.12.205	192.168.2.5
Dec 12, 2024 16:19:05.202393055 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:05.202972889 CET	49705	443	192.168.2.5	104.26.12.205
Dec 12, 2024 16:19:05.203116894 CET	49705	443	192.168.2.5	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 16:19:03.830439091 CET	63180	53	192.168.2.5	1.1.1.1
Dec 12, 2024 16:19:03.969192028 CET	53	63180	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 16:19:03.830439091 CET	192.168.2.5	1.1.1.1	0xca31	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 16:19:03.969192028 CET	1.1.1.1	192.168.2.5	0xca31	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:19:03.969192028 CET	1.1.1.1	192.168.2.5	0xca31	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 12, 2024 16:19:03.969192028 CET	1.1.1.1	192.168.2.5	0xca31	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:19:00
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\zapret.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zapret.exe"
Imagebase:	0x7ff6dff70000
File size:	10'527'204 bytes
MD5 hash:	FF130E918B140BE5B7A4FE668950F220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:19:01
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\zapret.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zapret.exe"
Imagebase:	0x7ff6dff70000
File size:	10'527'204 bytes
MD5 hash:	FF130E918B140BE5B7A4FE668950F220
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 00000002.00000002.2091115283.00000193E30E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.9%
Total number of Nodes:	1170
Total number of Limit Nodes:	11

Executed Functions

Function 00007FF6DFF77DB0 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6DFF77E11
free.MSVCRT ref: 00007FF6DFF77E1C

Part of subcall function 00007FF6DFF79280: wcslen.MSVCRT ref: 00007FF6DFF79289

_wfullpath.MSVCRT ref: 00007FF6DFF77E44
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77EAD
wcschr.MSVCRT(?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77EB8
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77ECA
_wputenv_s.MSVCRT ref: 00007FF6DFF77ED6
free.MSVCRT ref: 00007FF6DFF77EE1
GetTempPathW.KERNEL32 ref: 00007FF6DFF77EFB
_getpid.MSVCRT(?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77F01
_wtempnam.MSVCRT ref: 00007FF6DFF77F2A
free.MSVCRT ref: 00007FF6DFF77F3F
free.MSVCRT ref: 00007FF6DFF77F69

Part of subcall function 00007FF6DFF77C80: GetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77CAC

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

_wcsdup.MSVCRT ref: 00007FF6DFF77F8B

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6DFF78071
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6DFF78060
TMP, xrefs: 00007FF6DFF77ECC
_MEI%d, xrefs: 00007FF6DFF77F06
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6DFF78030
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6DFF78048
TMP, xrefs: 00007FF6DFF77DD8, 00007FF6DFF77F57, 00007FF6DFF77FDF, 00007FF6DFF78005, 00007FF6DFF78087
_MEIPASS2, xrefs: 00007FF6DFF77DB9

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$CreateDirectoryEnvironment$ByteCharExpandMultiPathStringsTempVariableWide_getpid_wcsdup_wfullpath_wputenv_s_wtempnamwcschrwcslen
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d$_MEIPASS2
API String ID: 2274789544-3119237222
Opcode ID: 117cb1d8d2409357a02db56dd994dc834686c95f098a240ee8fe3759c3df1cf8
Instruction ID: c271e22c152e286cb6793e196d0d99da6559543f42e01823f082908f65814ba2
Opcode Fuzzy Hash: 117cb1d8d2409357a02db56dd994dc834686c95f098a240ee8fe3759c3df1cf8
Instruction Fuzzy Hash: 7861AB52F1D64240FA64AB23A9112FE8391AF49BC4F948437EC3EC77C6EE2CE425C240

Function 00007FF6DFF71154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_amsg_exit.MSVCRT ref: 00007FF6DFF711F6
_initterm.MSVCRT ref: 00007FF6DFF7122B
_initterm.MSVCRT ref: 00007FF6DFF7125E
exit.MSVCRT ref: 00007FF6DFF71358
_cexit.MSVCRT ref: 00007FF6DFF71367

Strings

0, xrefs: 00007FF6DFF71164

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _initterm$_amsg_exit_cexitexit
String ID: 0
API String ID: 602970348-4108050209
Opcode ID: 9905e89fe877ea847ce878e57ecea80b115fcac03c0dbd49d2c840cd9bbea999
Instruction ID: 1096287b07b8139a3d7d187a53bc78fa1d6aa9ed2c783f792b60a51c742898dd
Opcode Fuzzy Hash: 9905e89fe877ea847ce878e57ecea80b115fcac03c0dbd49d2c840cd9bbea999
Instruction Fuzzy Hash: 3761B176E19B0699FB509FA6E88036C23A4BB48B84F404436DE6CD73A5DF7CE464C700

Function 00007FF6DFF7A940 Relevance: 6.9, Strings: 5, Instructions: 602
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

invalid stored block lengths, xrefs: 00007FF6DFF7AC3E
incorrect data check, xrefs: 00007FF6DFF7AA81
invalid block type, xrefs: 00007FF6DFF7BEB0
too many length or distance symbols, xrefs: 00007FF6DFF7B6AE
invalid literal/length code, xrefs: 00007FF6DFF7C04C

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
API String ID: 0-817236767
Opcode ID: 430c0e31359795c6af589a39dbb94035080cdf7c7e86497c090ee549743ec8ff
Instruction ID: 9d9fd35e2c2b75d73786ae319bed5320037ee42f556f7161b1fcf893a99af45c
Opcode Fuzzy Hash: 430c0e31359795c6af589a39dbb94035080cdf7c7e86497c090ee549743ec8ff
Instruction Fuzzy Hash: 4842D373E186928BE3608F25D48893EBBA5FB44784F124136DB6AC7794DF38E914DB00

Function 00007FF6DFF7B128 Relevance: 5.4, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

invalid literal/lengths set, xrefs: 00007FF6DFF7C4E6
invalid distances set, xrefs: 00007FF6DFF7C61A
invalid bit length repeat, xrefs: 00007FF6DFF7C531
invalid code -- missing end-of-block, xrefs: 00007FF6DFF7BB7D

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
API String ID: 0-1153561608
Opcode ID: a3d972cd1c7d583099c7879db60d45b8728866e57429499bfca41c4872f57655
Instruction ID: a79ebceec3bec8b80e9e8084df4f33e6846ad356d82f893f3b1c2b60bf26562a
Opcode Fuzzy Hash: a3d972cd1c7d583099c7879db60d45b8728866e57429499bfca41c4872f57655
Instruction Fuzzy Hash: D6F1D173E186928BD7508F24D488A2EB7E5FB44784F42413ADB6E87794DF38E964CB00

Function 00007FF6DFF79210 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6DFF79235
FindClose.KERNEL32 ref: 00007FF6DFF79244

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: eb7c6a06989ddef4747f29b0012c5ad72be63177b8c3b5e749435939b28fbb88
Instruction ID: 817d1abeeec61d806c726f68d4419839b79ab8c19db1ec34bcc5740c3048348f
Opcode Fuzzy Hash: eb7c6a06989ddef4747f29b0012c5ad72be63177b8c3b5e749435939b28fbb88
Instruction Fuzzy Hash: E4F03929A2D68182F7B0AB60E4083AE6790A784778F804735DA7982AD4CFBCC159CB00

Function 00007FF6DFF71CD0 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6DFF71D5B
fread.MSVCRT ref: 00007FF6DFF71DC1
free.MSVCRT ref: 00007FF6DFF71DE9
fclose.MSVCRT ref: 00007FF6DFF71E26
fclose.MSVCRT ref: 00007FF6DFF71E2E

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6DFF71F01
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6DFF71EB3
fread, xrefs: 00007FF6DFF71DD5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6DFF71DCE
fopen, xrefs: 00007FF6DFF71EF0
Failed to create symbolic link %s!, xrefs: 00007FF6DFF71E4C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6DFF71E63
fwrite, xrefs: 00007FF6DFF71E9A
fseek, xrefs: 00007FF6DFF71EBA
malloc, xrefs: 00007FF6DFF71F08
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6DFF71E93
pyi_arch_extract2fs was called before temporary directory was C7Dlwp4kd!, xrefs: 00007FF6DFF71ED0
Failed to extract %s: failed to open target file!, xrefs: 00007FF6DFF71EE9

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fclose$_wfopenfreadfreemalloc
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was C7Dlwp4kd!
API String ID: 414440483-498630463
Opcode ID: b6782f39934aa82cc09c84a776b5880bbadf23083a6aeb53fc693f201ec675a6
Instruction ID: 05246da2006250e099fa28456880935e3c98904ff6c2c717346b15934599d74d
Opcode Fuzzy Hash: b6782f39934aa82cc09c84a776b5880bbadf23083a6aeb53fc693f201ec675a6
Instruction Fuzzy Hash: AB518F61F0D54361FA259726A8506FE9341AF05BD8F980137DE3D8B3D6EE2CF9698380

Function 00007FF6DFF7F220 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strdup.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F256
setlocale.MSVCRT ref: 00007FF6DFF7F26E
mbstowcs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F2A5
mbstowcs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F316
setlocale.MSVCRT ref: 00007FF6DFF7F381
free.MSVCRT ref: 00007FF6DFF7F38D
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F5C1
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F635
realloc.MSVCRT ref: 00007FF6DFF7F650
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F679
setlocale.MSVCRT ref: 00007FF6DFF7F68A
free.MSVCRT ref: 00007FF6DFF7F696
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F6C0
realloc.MSVCRT ref: 00007FF6DFF7F6DB
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F6FF
setlocale.MSVCRT ref: 00007FF6DFF7F710
free.MSVCRT ref: 00007FF6DFF7F71C

Strings

_MEIPASS2, xrefs: 00007FF6DFF7F221

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
String ID: _MEIPASS2
API String ID: 918573998-3944641314
Opcode ID: 41934e68198dc64b29bdac14bfe1299ce3e94d695daf7b770437fea874cab5dc
Instruction ID: b0bb3eca46c73ec4c6d61e9800e3e5428c6877fb6b3873fdff2a6a2fd9eaa479
Opcode Fuzzy Hash: 41934e68198dc64b29bdac14bfe1299ce3e94d695daf7b770437fea874cab5dc
Instruction Fuzzy Hash: 7DF13E66F04B5688EB508FAAC8412BD77B1FB48B98F804436DE5DA7798DF38D461C390

Function 00007FF6DFF79070 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6DFF790A7
OpenProcessToken.ADVAPI32 ref: 00007FF6DFF790B8
free.MSVCRT ref: 00007FF6DFF790D0
CloseHandle.KERNEL32 ref: 00007FF6DFF790E0
_snwprintf.MSVCRT ref: 00007FF6DFF79108
LocalFree.KERNEL32 ref: 00007FF6DFF79111
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6DFF79137
CreateDirectoryW.KERNEL32 ref: 00007FF6DFF7914B
GetTokenInformation.KERNELBASE(?,?,?,00000000,?,00000012,00007FF6DFF7459C,00000000,00007FF6DFF783B5,?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000), ref: 00007FF6DFF79191
GetLastError.KERNEL32 ref: 00007FF6DFF79197
calloc.MSVCRT ref: 00007FF6DFF791B2
GetTokenInformation.KERNELBASE(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF791D8
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6DFF791ED

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6DFF790FA
S-1-3-4, xrefs: 00007FF6DFF790EB

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 1339360106-2855260032
Opcode ID: b8eb4d04586bf25c80075f4567351d1e3d5eb130d62a4fb9c3eb98d3ad1adc22
Instruction ID: 48a51b509f4d847f11b596faf44128210a837b704dd3b94994606d07f91fbb39
Opcode Fuzzy Hash: b8eb4d04586bf25c80075f4567351d1e3d5eb130d62a4fb9c3eb98d3ad1adc22
Instruction Fuzzy Hash: DE315021A08A4242E7209F62B8047AE6361FB85BA8F544236EE7D87BD4DF7DE419C700

Function 00007FF6DFF71710 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF7A7C0: malloc.MSVCRT ref: 00007FF6DFF7A729

malloc.MSVCRT ref: 00007FF6DFF71788
malloc.MSVCRT ref: 00007FF6DFF7179E
fread.MSVCRT ref: 00007FF6DFF717CD
ferror.MSVCRT ref: 00007FF6DFF717DE
fwrite.MSVCRT ref: 00007FF6DFF71867
ferror.MSVCRT ref: 00007FF6DFF71882
free.MSVCRT ref: 00007FF6DFF71905
free.MSVCRT ref: 00007FF6DFF7190D

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6DFF71A5E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6DFF71A3F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6DFF718E9
malloc, xrefs: 00007FF6DFF71A46, 00007FF6DFF71A65
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6DFF71A07
1.2.13, xrefs: 00007FF6DFF7173F

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: malloc$ferrorfree$freadfwrite
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 1635854594-1655038675
Opcode ID: 33d0d6e286a1a718a14d17b4aa2d4f26cd3c2b2ee0e01d4c7f97d097f8584ac6
Instruction ID: c0a2989b2f348435a473791c0552fceb6c917691929fc3a3497eed9a5517a961
Opcode Fuzzy Hash: 33d0d6e286a1a718a14d17b4aa2d4f26cd3c2b2ee0e01d4c7f97d097f8584ac6
Instruction Fuzzy Hash: D581A572E0C68291E7608B26E8403BEA3A0FB44BA8F544132DEAD877D5DF7CD559C740

Function 00007FF6DFF78680 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6DFF786CA
GetStartupInfoW.KERNEL32 ref: 00007FF6DFF786EC
_get_osfhandle.MSVCRT ref: 00007FF6DFF7873F
_fileno.MSVCRT ref: 00007FF6DFF7875C
_get_osfhandle.MSVCRT ref: 00007FF6DFF78763
_fileno.MSVCRT ref: 00007FF6DFF78780
_get_osfhandle.MSVCRT ref: 00007FF6DFF78787
GetCommandLineW.KERNEL32 ref: 00007FF6DFF78799
CreateProcessW.KERNEL32 ref: 00007FF6DFF787E1
WaitForSingleObject.KERNEL32 ref: 00007FF6DFF787F8
GetExitCodeProcess.KERNEL32 ref: 00007FF6DFF7880B

Strings

Error creating child process!, xrefs: 00007FF6DFF78828
CreateProcessW, xrefs: 00007FF6DFF7882F

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _get_osfhandle$Process_fileno$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2399235724-3524285272
Opcode ID: 3b0030d9226d0a67f6fd8a2a69a505053b30f609f3f5ca2460bb49168f4bcb83
Instruction ID: 7497dc90e2b607b2816a67bf43f3d738e048929d37efd09c1e4e18974d51fb92
Opcode Fuzzy Hash: 3b0030d9226d0a67f6fd8a2a69a505053b30f609f3f5ca2460bb49168f4bcb83
Instruction Fuzzy Hash: A8415E32A08B8245EB209B65F8147AEB360EB857A4F404736EABD877D4DF7CD094CB40

Function 00007FF6DFF71F20 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

Part of subcall function 00007FF6DFF78A10: malloc.MSVCRT ref: 00007FF6DFF78A2E
Part of subcall function 00007FF6DFF78A10: free.MSVCRT ref: 00007FF6DFF78B05

fclose.MSVCRT ref: 00007FF6DFF71F83
fread.MSVCRT ref: 00007FF6DFF71FBF
malloc.MSVCRT ref: 00007FF6DFF7201D
fread.MSVCRT ref: 00007FF6DFF7203E

Strings

Could not read full TOC!, xrefs: 00007FF6DFF720B0
fread, xrefs: 00007FF6DFF720B7, 00007FF6DFF720F7
Could not allocate buffer for TOC!, xrefs: 00007FF6DFF7212B
fseek, xrefs: 00007FF6DFF720D7
malloc, xrefs: 00007FF6DFF72132
Error on file., xrefs: 00007FF6DFF72110
Failed to read cookie!, xrefs: 00007FF6DFF720F0
Failed to seek to cookie position!, xrefs: 00007FF6DFF720D0

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freadmalloc$_wfopenfclosefree
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
API String ID: 2617120823-2084260460
Opcode ID: 221ca51adac32cd6e4dbaad49c459d1e072569c441f1db1919a3c8223de0b9bf
Instruction ID: 043cdda40fdb1ef1b9a809d076d468cc2834f1fe66f82b4f194839115f8b96cc
Opcode Fuzzy Hash: 221ca51adac32cd6e4dbaad49c459d1e072569c441f1db1919a3c8223de0b9bf
Instruction Fuzzy Hash: 0651ACA1F0964282EB148B25D4402BCA7A1EF88B98F648137DE2D877D9DF3CE525C744

Function 00007FF6DFF716D0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 298
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF78E40: free.MSVCRT ref: 00007FF6DFF78EA7
Part of subcall function 00007FF6DFF78E40: free.MSVCRT ref: 00007FF6DFF78EB4

Part of subcall function 00007FF6DFF72160: calloc.MSVCRT ref: 00007FF6DFF7216E

Part of subcall function 00007FF6DFF74420: GetModuleFileNameW.KERNEL32 ref: 00007FF6DFF74442

Part of subcall function 00007FF6DFF77C80: GetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77CAC

SetDllDirectoryW.KERNEL32 ref: 00007FF6DFF73D98
strcmp.MSVCRT ref: 00007FF6DFF73DC5
strcpy.MSVCRT ref: 00007FF6DFF73E0B

Part of subcall function 00007FF6DFF72250: strcpy.MSVCRT ref: 00007FF6DFF7231E

free.MSVCRT ref: 00007FF6DFF73CF5

Part of subcall function 00007FF6DFF77D70: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77D8B
Part of subcall function 00007FF6DFF77D70: free.MSVCRT ref: 00007FF6DFF77D96

Strings

Failed to convert DLL search path!, xrefs: 00007FF6DFF74110
Error opening archive IrNk6XIbAZ from executable (%s) or external archive (%s), xrefs: 00007FF6DFF74124
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6DFF740BE
_PYI_ONEDIR_MODE, xrefs: 00007FF6DFF73CC8, 00007FF6DFF73CFA
_MEIPASS2, xrefs: 00007FF6DFF73CAD

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$EnvironmentVariablestrcpy$DirectoryFileModuleNamecallocstrcmp
String ID: Cannot side-load external archive %s (code %d)!$Error opening archive IrNk6XIbAZ from executable (%s) or external archive (%s)$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2787634916-3664968274
Opcode ID: d114abf2a6c0286cb0fce2ebc2cb0a65d087e8d562d0e5fb766c471fbb74f5e1
Instruction ID: 83aba9533eaca010ce55228cc880f2d050f975e536582eeb88061daeff42b67a
Opcode Fuzzy Hash: d114abf2a6c0286cb0fce2ebc2cb0a65d087e8d562d0e5fb766c471fbb74f5e1
Instruction Fuzzy Hash: F6C19D21E1C64390FA54AF22A8112BED790AF44BC0F544533EE6EC77E6EE3CF5658641

Function 00007FF6DFF780B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

wcslen.MSVCRT ref: 00007FF6DFF78100
wcscat.MSVCRT ref: 00007FF6DFF7812E
_wrmdir.MSVCRT ref: 00007FF6DFF7814C
wcscat.MSVCRT ref: 00007FF6DFF7817E

Strings

_MEIPASS2, xrefs: 00007FF6DFF780B9

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
String ID: _MEIPASS2
API String ID: 3789554339-3944641314
Opcode ID: b80c098a62a51ddb5917d45d678bd9e6a4253acbeb3c395510a388e241dafa2d
Instruction ID: 3a79807f60ce151809273daf3a539580d4314bc22d292cbdff9c23e7b4075070
Opcode Fuzzy Hash: b80c098a62a51ddb5917d45d678bd9e6a4253acbeb3c395510a388e241dafa2d
Instruction Fuzzy Hash: 8D21DD51F0854244EA60AA13AC056BE9751BB85FE5FD88933EE2E877C6DE7CE461C304

Function 00007FF6DFF783E0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ERROR: file already exists but should not: %s, xrefs: 00007FF6DFF784D3
WARNING: file already exists but should not: %s, xrefs: 00007FF6DFF78472
%s%c%s, xrefs: 00007FF6DFF783F1
\, xrefs: 00007FF6DFF78408
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6DFF78498

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$_wfopenstrcpystrtok
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 1482442392-3501660386
Opcode ID: 99c8d790e39b5d19d5d809cd0c3d35328fcb743185708074d8d197c13bb0777c
Instruction ID: 66986095362532970fccddaa31adabbbff24812e6ffd96b8422ebce680953f0d
Opcode Fuzzy Hash: 99c8d790e39b5d19d5d809cd0c3d35328fcb743185708074d8d197c13bb0777c
Instruction Fuzzy Hash: CE219461E0C60354F6209F23A9402BEA7919F447D5F648933ED3EC72D5EE6CE535C250

Function 00007FF6DFF781F0 Relevance: 9.1, APIs: 6, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscmp.MSVCRT ref: 00007FF6DFF7823A
wcscat.MSVCRT ref: 00007FF6DFF78250

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcscatwcscmp
String ID:
API String ID: 3846154227-0
Opcode ID: 89696ce61c69354e3eaa71e8a504126c42e2b2199c98373d144019cef2373950
Instruction ID: aa7d4edda39be45c0bbf673dc59b7a66e14ec0891eec208b7a0d38cf84aaa781
Opcode Fuzzy Hash: 89696ce61c69354e3eaa71e8a504126c42e2b2199c98373d144019cef2373950
Instruction Fuzzy Hash: CE116650F4CA4244FA64AB62AC106FD97805F44FCAF688933ED2ED7682EE6CF565C200

Function 00007FF6DFF782D0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF6DFF78341
strlen.MSVCRT ref: 00007FF6DFF78363
strlen.MSVCRT ref: 00007FF6DFF78379
strcpy.MSVCRT(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF7838A
strtok.MSVCRT(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF78394

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$strcpystrtok
String ID:
API String ID: 3698421117-0
Opcode ID: 55a2033995f978e84d72f3aa462143611717ee05cc370c98b581bb1d74bbe295
Instruction ID: b8475b2591d12c133d246253e671aff8f744a5e5112a542897883eb47202bfdb
Opcode Fuzzy Hash: 55a2033995f978e84d72f3aa462143611717ee05cc370c98b581bb1d74bbe295
Instruction Fuzzy Hash: BD21AE61F0960341FA21A616A8153FE97819F45FE5F884533ED2EDB782EE2CE565C240

Function 00007FF6DFF7A390 Relevance: 5.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF6DFF7A3EE
malloc.MSVCRT ref: 00007FF6DFF7A464

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: mallocmemcpy
String ID:
API String ID: 4276657696-0
Opcode ID: fa80a0da89eec8e07f185bf2c0ac5f95c12a23c4aa8b502b2d1dbc2e35804dd2
Instruction ID: 9ad26311ad2896df59047a370d1d04b18e08fdbab5e734bf02d5da2d2f8f4a33
Opcode Fuzzy Hash: fa80a0da89eec8e07f185bf2c0ac5f95c12a23c4aa8b502b2d1dbc2e35804dd2
Instruction Fuzzy Hash: 0131A173B255418BD7609E26E88866EE7A1FB84B84F145135DB4ACBF50DE3DF4508B00

Function 00007FF6DFF78A10 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6DFF78A2E
free.MSVCRT ref: 00007FF6DFF78B05

Strings

_MEIPASS2, xrefs: 00007FF6DFF78A14

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freemalloc
String ID: _MEIPASS2
API String ID: 3061335427-3944641314
Opcode ID: ca3332ee52e91b29ec7af119983718dbd2e66a66b775adcc654abdd1ac31d42e
Instruction ID: bd066e40b249c5803f80c6c65fa401b7f2a4824d1a5a8010002be6c37174075a
Opcode Fuzzy Hash: ca3332ee52e91b29ec7af119983718dbd2e66a66b775adcc654abdd1ac31d42e
Instruction Fuzzy Hash: F521F152F0915210FE109A2799197FECB41AF45BC8F984832DE1D8B392EE3CE152C200

Function 00007FF6DFF72250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF6DFF7231E

Strings

pyi-contents-directory option not found in onedir bundle archive!, xrefs: 00007FF6DFF72338
pyi-contents-directory, xrefs: 00007FF6DFF722CB

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strcpy
String ID: pyi-contents-directory$pyi-contents-directory option not found in onedir bundle archive!
API String ID: 3177657795-1958350669
Opcode ID: 144c37537c1f78c3223557a0433869cfc476ad927a52626deb4d2883448216f2
Instruction ID: 98332f0639dfc2f6523e0c0d467c83d8dbd001778be503606b5d6fd081819779
Opcode Fuzzy Hash: 144c37537c1f78c3223557a0433869cfc476ad927a52626deb4d2883448216f2
Instruction Fuzzy Hash: FC218E51F0868394FB61AA62AC053FD9340AF54BC4F844033ED2DC77DAEE6CE62AC650

Function 00007FF6DFF76E70 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF76E7E

Strings

calloc, xrefs: 00007FF6DFF76E94
Cannot allocate memory for SPLASH_STATUS., xrefs: 00007FF6DFF76E8D

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: calloc
String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
API String ID: 2635317215-799113134
Opcode ID: 942f8fe5890305979e7b23bd6c61b12b378b7291ddffaf8757f4366481b4c106
Instruction ID: 167647614fc9035ebad04c5e0a32e68d695ae085befdb3ef582847a3ffa897c2
Opcode Fuzzy Hash: 942f8fe5890305979e7b23bd6c61b12b378b7291ddffaf8757f4366481b4c106
Instruction Fuzzy Hash: A7E0ECA1F08A0780EA245711E4511AE5761DB84344F940437DA6D877A5EE2CE5318754

Function 00007FF6DFF7FEF0 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fsetpos.MSVCRT ref: 00007FF6DFF7FF95

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fsetpos
String ID:
API String ID: 850078086-0
Opcode ID: 494cfbfd0869b4bd86ec742704f25e9796c654e056705adcf2f762cf5b6a1ee1
Instruction ID: ba8272c1e2f4161f1bfb219e5db670d3cf4165b3be4ac2ab6d83ee38dc78ba83
Opcode Fuzzy Hash: 494cfbfd0869b4bd86ec742704f25e9796c654e056705adcf2f762cf5b6a1ee1
Instruction Fuzzy Hash: 32115CB2E05B829AEB209F7584411EC67A1EB0979CF504A36EA7D877D9DF38D070C280

Function 00007FF6DFF7FDAB Relevance: 2.6, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF7FBC0: wcslen.MSVCRT ref: 00007FF6DFF7FBF6

free.MSVCRT ref: 00007FF6DFF7FDEF
memset.MSVCRT ref: 00007FF6DFF7FE0C

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freememsetwcslen
String ID:
API String ID: 2332356550-0
Opcode ID: 9254918a96c0558d798f128c280d19f15fb0fbea07505cc5abc60daef984cd3a
Instruction ID: e4d162cb836cd76cdf3d0085fbfe1ff703bbc7296ca6173950c48b4b4476b6f8
Opcode Fuzzy Hash: 9254918a96c0558d798f128c280d19f15fb0fbea07505cc5abc60daef984cd3a
Instruction Fuzzy Hash: 8331C866F04B1489EB10CF7AD48109C3BB1FB58BA8B108526EE5C57B68EF34C5A1C790

Function 00007FF6DFF7FA00 Relevance: 2.5, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DFF7FA57
memcpy.MSVCRT ref: 00007FF6DFF7FACA

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 0971891e58b24c16fc6abcad1ae3b9205ef6e35853942e98c1a0541e49a3549f
Instruction ID: 8748bb9cae115a2ae64bbe913ef693d207692c8a21b3d3887e8acd05c147bbda
Opcode Fuzzy Hash: 0971891e58b24c16fc6abcad1ae3b9205ef6e35853942e98c1a0541e49a3549f
Instruction Fuzzy Hash: FE21E576B44B8688DB70CF6AD8843ED27A1F748BACF514226CE3C5BB98DE34C2518340

Function 00007FF6DFF7FAE0 Relevance: 2.5, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DFF7FB35
memcpy.MSVCRT ref: 00007FF6DFF7FBA6

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 96b3a7c0620df57f1d0fdad8c4352fe79f9300c682b0a9666d0fc7615ee7acae
Instruction ID: a2264e5bffa85e710355bf57dd81141e9b01d1dd480cd37bc4726ce170502624
Opcode Fuzzy Hash: 96b3a7c0620df57f1d0fdad8c4352fe79f9300c682b0a9666d0fc7615ee7acae
Instruction Fuzzy Hash: D021E576B44B8689DB30CF6AD8843ED37A1F749BACF518126CE2C5BB98DE34C6518740

Function 00007FF6DFF744D0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

_wfopen.MSVCRT ref: 00007FF6DFF74515

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide_wfopen
String ID:
API String ID: 372205238-0
Opcode ID: 460021445462d38f751c38bff17167d13b53ccdfd410499e5b587a202733885b
Instruction ID: 9d83d13d86bbd2136fd3f6e93965e452c138be5e61d9ed3a67b67243d88186e1
Opcode Fuzzy Hash: 460021445462d38f751c38bff17167d13b53ccdfd410499e5b587a202733885b
Instruction Fuzzy Hash: 51E09A91B0825001FA246216AA047EE8312AF4AFC4E408032EE1C9BB8ACE2CD2638708

Function 00007FF6DFF7B000 Relevance: 1.4, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6DFF7B03E

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd203ca4d0c538de12a393ad53275e35b5330f7b63c24e692d8044f3bafcd684
Instruction ID: c4c7ceb4252f7a611cdb0587370cbbca4b79d6cbde95263094745c9ebd1e5730
Opcode Fuzzy Hash: cd203ca4d0c538de12a393ad53275e35b5330f7b63c24e692d8044f3bafcd684
Instruction Fuzzy Hash: CD51C737E192428BE7618E29E08892FB7E5FB44794F168036DF6687A94DF3CD850CB00

Function 00007FF6DFF7D7E0 Relevance: 1.3, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DFF7D89A

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 4a3cd53f5ab6c9f56d3a5cf8db0897558940d4d2ad38b878033855946d3f594a
Instruction ID: 56a6df174f2534fca10e9255a24ee1bc4e19a63f972ccb56a52b0519f40624f3
Opcode Fuzzy Hash: 4a3cd53f5ab6c9f56d3a5cf8db0897558940d4d2ad38b878033855946d3f594a
Instruction Fuzzy Hash: 65311726F0471599FB108BA6D4403BC77B0A704B88F94407ADEAC97B98DF3CD6A9C714

Function 00007FF6DFF7A7C0 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6DFF7A729

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 9987054de5803aed25a161aa3056a03c8c9cc54020f4b5dfe5d10db294219541
Instruction ID: de8926d9168b498c74f959f3d84e44df250679ca5e4a50a590881565ab16663f
Opcode Fuzzy Hash: 9987054de5803aed25a161aa3056a03c8c9cc54020f4b5dfe5d10db294219541
Instruction Fuzzy Hash: 87217427E09B0282FB654F19A44073D67A5AB85B94F2A5136C92D8F3E0EF39D8938300

Non-executed Functions

Function 00007FF6DFF75810 Relevance: 233.2, APIs: 44, Strings: 89, Instructions: 451libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00000000,?,?,00007FF6DFF73B9D), ref: 00007FF6DFF75827
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75843
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7585F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7587B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75897
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758B3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758CF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758EB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75907
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75923
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7593F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7595B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75977
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75993
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759AF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759CB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759E7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A03
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A1F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A3B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A57
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A73
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A8F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AAB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AC7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AE3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AFF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B1B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B37
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B53
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B6F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B8B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BA7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BC3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BDF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BFB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C17
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C33
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C4F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C6B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C87
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CA3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CBF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CDB

Strings

GetProcAddress, xrefs: 00007FF6DFF75CFD, 00007FF6DFF75D1E, 00007FF6DFF75D33, 00007FF6DFF75D48, 00007FF6DFF75D5D, 00007FF6DFF75D72, 00007FF6DFF75D87, 00007FF6DFF75D9F, 00007FF6DFF75DB7, 00007FF6DFF75DCF, 00007FF6DFF75DE7, 00007FF6DFF75DFF, 00007FF6DFF75E17, 00007FF6DFF75E2F, 00007FF6DFF75E47, 00007FF6DFF75E5F, 00007FF6DFF75E77, 00007FF6DFF75E8F, 00007FF6DFF75EA7, 00007FF6DFF75EBF, 00007FF6DFF75ED7, 00007FF6DFF75EEF, 00007FF6DFF75F07, 00007FF6DFF75F1F, 00007FF6DFF75F37, 00007FF6DFF75F4F, 00007FF6DFF75F67, 00007FF6DFF75F7F, 00007FF6DFF75F97, 00007FF6DFF75FAF, 00007FF6DFF75FC7, 00007FF6DFF75FDF, 00007FF6DFF75FF7, 00007FF6DFF7600F, 00007FF6DFF76027, 00007FF6DFF7603F, 00007FF6DFF76057, 00007FF6DFF7606F, 00007FF6DFF76087, 00007FF6DFF7609F, 00007FF6DFF760B7, 00007FF6DFF760CF, 00007FF6DFF760E7, 00007FF6DFF760FF
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF6DFF75DF8
Py_Finalize, xrefs: 00007FF6DFF75871
Failed to get address for PyList_Append, xrefs: 00007FF6DFF75EE8
Failed to get address for Py_ExitStatusException, xrefs: 00007FF6DFF75D17
PyErr_NormalizeException, xrefs: 00007FF6DFF759C1
Failed to get address for PyErr_Occurred, xrefs: 00007FF6DFF75E28
PySys_GetObject, xrefs: 00007FF6DFF75BF1
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6DFF75FD8
PyConfig_SetString, xrefs: 00007FF6DFF75951
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6DFF760B0
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6DFF75F18
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75FA8
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6DFF75F30
Py_DecRef, xrefs: 00007FF6DFF7581D
Failed to get address for PyErr_Clear, xrefs: 00007FF6DFF75E70
PyObject_CallFunctionObjArgs, xrefs: 00007FF6DFF75B2D
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6DFF76098
PyImport_ImportModule, xrefs: 00007FF6DFF75A85
Py_InitializeFromConfig, xrefs: 00007FF6DFF7588D
Py_ExitStatusException, xrefs: 00007FF6DFF75855
Py_DecodeLocale, xrefs: 00007FF6DFF75839
Failed to get address for Py_PreInitialize, xrefs: 00007FF6DFF75D80
Failed to get address for Py_IsInitialized, xrefs: 00007FF6DFF75D98
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6DFF75FF0
PyErr_Fetch, xrefs: 00007FF6DFF759A5
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6DFF75D2C
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6DFF75ED0
PyObject_Str, xrefs: 00007FF6DFF75B81
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6DFF75E40
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF6DFF75DC8
PyUnicode_AsUTF8, xrefs: 00007FF6DFF75C29
Failed to get address for PyImport_AddModule, xrefs: 00007FF6DFF75EB8
PyMarshal_ReadObjectFromString, xrefs: 00007FF6DFF75ABD
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6DFF76068
PyImport_AddModule, xrefs: 00007FF6DFF75A4D
Failed to get address for Py_DecRef, xrefs: 00007FF6DFF75CF6
PyUnicode_FromString, xrefs: 00007FF6DFF75C99
PyConfig_SetBytesString, xrefs: 00007FF6DFF75935
PyEval_EvalCode, xrefs: 00007FF6DFF75A31
PyConfig_InitIsolatedConfig, xrefs: 00007FF6DFF758FD
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6DFF75F48
PyList_Append, xrefs: 00007FF6DFF75AA1
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75B9D
PyUnicode_Decode, xrefs: 00007FF6DFF75C45
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6DFF760F8
Failed to get address for Py_Finalize, xrefs: 00007FF6DFF75D56
Failed to get address for PyStatus_Exception, xrefs: 00007FF6DFF76008
PyUnicode_Join, xrefs: 00007FF6DFF75CB5
Failed to get address for PyErr_Restore, xrefs: 00007FF6DFF75EA0
PyConfig_Clear, xrefs: 00007FF6DFF758E1
PyConfig_Read, xrefs: 00007FF6DFF75919
PyErr_Occurred, xrefs: 00007FF6DFF759DD
PyUnicode_DecodeFSDefault, xrefs: 00007FF6DFF75C61
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6DFF75F00
PyMem_RawFree, xrefs: 00007FF6DFF75AD9
PyErr_Restore, xrefs: 00007FF6DFF75A15
Failed to get address for PyModule_GetDict, xrefs: 00007FF6DFF75F78
PyConfig_SetWideStringList, xrefs: 00007FF6DFF7596D
Failed to get address for PyErr_Fetch, xrefs: 00007FF6DFF75E58
Failed to get address for PyErr_Print, xrefs: 00007FF6DFF75E88
PyImport_ExecCodeModule, xrefs: 00007FF6DFF75A69
PyUnicode_FromFormat, xrefs: 00007FF6DFF75C7D
PyObject_GetAttrString, xrefs: 00007FF6DFF75B49
PyModule_GetDict, xrefs: 00007FF6DFF75AF5
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75DB0
Failed to get address for PyMem_RawFree, xrefs: 00007FF6DFF75F90
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6DFF760E0
Failed to get address for PyConfig_SetString, xrefs: 00007FF6DFF75DE0
Failed to get address for PyObject_Str, xrefs: 00007FF6DFF75FC0
PyStatus_Exception, xrefs: 00007FF6DFF75BD5
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6DFF76080
PyErr_Clear, xrefs: 00007FF6DFF75989
Failed to get address for PyConfig_Clear, xrefs: 00007FF6DFF75D6B
Failed to get address for PySys_GetObject, xrefs: 00007FF6DFF76050
Py_PreInitialize, xrefs: 00007FF6DFF758C5
PySys_SetObject, xrefs: 00007FF6DFF75C0D
PyRun_SimpleStringFlags, xrefs: 00007FF6DFF75BB9
Failed to get address for PyConfig_Read, xrefs: 00007FF6DFF75E10
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF6DFF75D41
PyErr_Print, xrefs: 00007FF6DFF759F9
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6DFF75F60
Failed to get address for PySys_SetObject, xrefs: 00007FF6DFF76038
Failed to get address for PyUnicode_Join, xrefs: 00007FF6DFF760C8
PyObject_CallFunction, xrefs: 00007FF6DFF75B11
PyUnicode_Replace, xrefs: 00007FF6DFF75CD1
PyObject_SetAttrString, xrefs: 00007FF6DFF75B65
Py_IsInitialized, xrefs: 00007FF6DFF758A9
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6DFF76020

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: af163ddc85bf2b883ecff41c15d72a41c989fd972fde24fa4a0f8e3ace152156
Instruction ID: 305803e4dfb3c5e1c7bec2880f0f9c039351baa635088c4661c820f3203d7628
Opcode Fuzzy Hash: af163ddc85bf2b883ecff41c15d72a41c989fd972fde24fa4a0f8e3ace152156
Instruction Fuzzy Hash: EE3290A0E6DB0B90EE15DB16F8500BCA396AF45380F985437C92EC72B5EE6CF5368354

Function 00007FF6DFF72620 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF6DFF72653
MulDiv.KERNEL32 ref: 00007FF6DFF72670
MulDiv.KERNEL32 ref: 00007FF6DFF72689
SystemParametersInfoW.USER32 ref: 00007FF6DFF726CF
LoadIconMetric.COMCTL32 ref: 00007FF6DFF72703
CreateWindowExW.USER32 ref: 00007FF6DFF72761
CreateWindowExW.USER32 ref: 00007FF6DFF727BB
CreateWindowExW.USER32 ref: 00007FF6DFF7281C
CreateWindowExW.USER32 ref: 00007FF6DFF7287E
SendMessageW.USER32 ref: 00007FF6DFF728A1
SendMessageW.USER32 ref: 00007FF6DFF728B9
SendMessageW.USER32 ref: 00007FF6DFF728D4
SendMessageW.USER32 ref: 00007FF6DFF728F1
SendMessageW.USER32 ref: 00007FF6DFF7290C
SendMessageW.USER32 ref: 00007FF6DFF72927
SendMessageW.USER32 ref: 00007FF6DFF72942
SendMessageW.USER32 ref: 00007FF6DFF72956
SendMessageW.USER32 ref: 00007FF6DFF7296B
GetClientRect.USER32 ref: 00007FF6DFF72976
CreateFontIndirectW.GDI32 ref: 00007FF6DFF72998

Strings

BUTTON, xrefs: 00007FF6DFF72834
STATIC, xrefs: 00007FF6DFF726FC
Failed to gA7WkD6n script '%ls' due to unhandled exception: %ls, xrefs: 00007FF6DFF7262B
EDIT, xrefs: 00007FF6DFF727D2
Close, xrefs: 00007FF6DFF72824
, xrefs: 00007FF6DFF726BD

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
String ID: $BUTTON$Close$EDIT$Failed to gA7WkD6n script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 3223904152-4231048771
Opcode ID: 9bcbd0ae487ad773c65203090edb47d8bd9997bfcb6fad77826f5d4dd51fc8b3
Instruction ID: 8e7fd147aa934e340fdcd12f58400c19a9af17fdac0fa8d24d1412b84572e900
Opcode Fuzzy Hash: 9bcbd0ae487ad773c65203090edb47d8bd9997bfcb6fad77826f5d4dd51fc8b3
Instruction Fuzzy Hash: 2E91AB76218B9082E7608F61E45479E7760F788B98F24413AEE8C4BB99CF7EC085CB50

Function 00007FF6DFF78B30 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF6DFF78B72
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78BB2
GetLastError.KERNEL32 ref: 00007FF6DFF78BF8

Strings

FormatMessageW, xrefs: 00007FF6DFF78BD7
PyInstaller: FormatMessageW failed., xrefs: 00007FF6DFF78BE3
WideCharToMultiByte, xrefs: 00007FF6DFF78B36, 00007FF6DFF78C17
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6DFF78C10
No error messages generated., xrefs: 00007FF6DFF78BD0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6DFF78C23

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 1653872744-2573406579
Opcode ID: a444a6fb349bc4707b2cf69bc53a33dba0618e531a6d6d2ca6af9caf27ae63ed
Instruction ID: ce4d7e3390e0c1b346711bc6b0ea684389290f9c303fafd0d7a854543b9cda1d
Opcode Fuzzy Hash: a444a6fb349bc4707b2cf69bc53a33dba0618e531a6d6d2ca6af9caf27ae63ed
Instruction Fuzzy Hash: 3121AFB1E0CB0391F7209B15F8547AE6361AF88388F548636E96D836A4DF3CE569C700

Function 00007FF6DFF715E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6DFF715F7
LoadLibraryA.KERNEL32 ref: 00007FF6DFF71608
GetProcAddress.KERNEL32 ref: 00007FF6DFF71626
GetProcAddress.KERNEL32 ref: 00007FF6DFF71635

Strings

__register_frame_info, xrefs: 00007FF6DFF71615
libgcc_s_dw2-1.dll, xrefs: 00007FF6DFF715ED
__deregister_frame_info, xrefs: 00007FF6DFF71628

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
Instruction ID: 2d8f1762d55a027ed8050eb516fbbc40f0398d7230d6ea834721bfb353afd410
Opcode Fuzzy Hash: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
Instruction Fuzzy Hash: 1301DB65E09A1BA1EA159F06BC5027D6364BF48B84F494133C96DC7364EF2CE53AC340

Function 00007FF6DFF85C1A Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 1364COMMON

Download Yara Rule

Strings

Infinity, xrefs: 00007FF6DFF85D1D
NaN, xrefs: 00007FF6DFF85D4E

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: Infinity$NaN
API String ID: 0-4285296124
Opcode ID: 7102700f6633cce392ca3b63142a687cafa288b5311c7985e3842b8209ed0999
Instruction ID: 123f4c314724595e66a7bb50f3c3858b3c5a1557c55f3f0a580df3b18974fb17
Opcode Fuzzy Hash: 7102700f6633cce392ca3b63142a687cafa288b5311c7985e3842b8209ed0999
Instruction Fuzzy Hash: 0EE2F6B2A04B858EE751CF7AC4443AD37A5FB4578CF108226EA1D97B59DF38E891CB40

Function 00007FF6DFF7B310 Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00007FF6DFF7BE49
invalid window size, xrefs: 00007FF6DFF7C452
incorrect header check, xrefs: 00007FF6DFF7C0A5

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: 0bcc04c6aca6022001e292fdf715f741d258b71047340956eb0883c8bfcf3deb
Instruction ID: d33a7e3982c93ec93d38a8daa3523c259c2d09650fbc4f93bcd8f42ff1651d17
Opcode Fuzzy Hash: 0bcc04c6aca6022001e292fdf715f741d258b71047340956eb0883c8bfcf3deb
Instruction Fuzzy Hash: 8751DF72E186524BEB688E25948C93E77A6EB44344F01813ADB2EC7384EF3CE924D744

Function 00007FF6DFF7B330 Relevance: 1.5, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF6DFF7B4F8

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d4a3ac781d2dd7079804b81e356a46ba17f177a5c4faaab444abfe3051605557
Instruction ID: 532bdea637d20c8541bbfaa2f887a74bf4426358b5a0c8bccc50c11ba5b3d647
Opcode Fuzzy Hash: d4a3ac781d2dd7079804b81e356a46ba17f177a5c4faaab444abfe3051605557
Instruction Fuzzy Hash: A0B19072E082528BE7658E14D04CB3EBBA5FB46784F15813ADB5D87B88DF39E850CB44

Function 00007FF6DFF7CF80 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e9fc95709145d54ffbee660e2029d8d27f1aabab581049afd4923b1a2fbaa4
Instruction ID: 3d406172a7776b59e245a05e90ace6858be7946ce0a82fae1fb6f8bb894ce87c
Opcode Fuzzy Hash: 50e9fc95709145d54ffbee660e2029d8d27f1aabab581049afd4923b1a2fbaa4
Instruction Fuzzy Hash: ACD1D332E1C79286E7658F14E00067EF7A0FB94744F845136EA9A93B98DF7DE859CB00

Function 00007FF6DFF798D0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a6a1b6c47e1f2b3e1a5b0af0df9fa1198957c7987c6bd126b5b8128568ff48
Instruction ID: 7f27c05a65c10ad0eb2c197dec09b92a61d3762bdf6582d4216a843fb97758d3
Opcode Fuzzy Hash: 12a6a1b6c47e1f2b3e1a5b0af0df9fa1198957c7987c6bd126b5b8128568ff48
Instruction Fuzzy Hash: D5A128B3F241A047EA64CB2A941067EB7A2F74A7D1F84D232DF9987788CA3CE515C700

Function 00007FF6DFF99618 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2bb06eeec5c94951c669f13ff006b9f4ee95621f3dca3fef6b548ae13b83791
Instruction ID: 204770628ba98e3a97501b4a93af3796139d9e65aa94e3e91165f47f0d4779dc
Opcode Fuzzy Hash: c2bb06eeec5c94951c669f13ff006b9f4ee95621f3dca3fef6b548ae13b83791
Instruction Fuzzy Hash: 59B0121BD1FAC166F1F6463405F402C1E80B251C087080559C354430C2C8402425C109

Function 00007FF6DFF7D679 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414ff583ba8e6fd3544dbc432cec04c7b86bc944b6fbebee7f48b844bc084a28
Instruction ID: 9ca9f6e426b04070cffddfc991af3002dfa2fe0dc4fc88b2197cd0b5abbf8aaf
Opcode Fuzzy Hash: 414ff583ba8e6fd3544dbc432cec04c7b86bc944b6fbebee7f48b844bc084a28
Instruction Fuzzy Hash: B8A0021695EC1180E2340F11DC011F86228D746305F052035C43CD3011CF2C90914648

Function 00007FF6DFF774D0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 324libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6DFF774EB
GetProcAddress.KERNEL32 ref: 00007FF6DFF77507
GetProcAddress.KERNEL32 ref: 00007FF6DFF77523
GetProcAddress.KERNEL32 ref: 00007FF6DFF7753F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7755B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77577
GetProcAddress.KERNEL32 ref: 00007FF6DFF77593
GetProcAddress.KERNEL32 ref: 00007FF6DFF775AF
GetProcAddress.KERNEL32 ref: 00007FF6DFF775CB
GetProcAddress.KERNEL32 ref: 00007FF6DFF775E7
GetProcAddress.KERNEL32 ref: 00007FF6DFF77603
GetProcAddress.KERNEL32 ref: 00007FF6DFF7761F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7763B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77657
GetProcAddress.KERNEL32 ref: 00007FF6DFF77673
GetProcAddress.KERNEL32 ref: 00007FF6DFF7768F
GetProcAddress.KERNEL32 ref: 00007FF6DFF776AB
GetProcAddress.KERNEL32 ref: 00007FF6DFF776C7
GetProcAddress.KERNEL32 ref: 00007FF6DFF776E3
GetProcAddress.KERNEL32 ref: 00007FF6DFF776FF
GetProcAddress.KERNEL32 ref: 00007FF6DFF7771B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77737
GetProcAddress.KERNEL32 ref: 00007FF6DFF77753
GetProcAddress.KERNEL32 ref: 00007FF6DFF7776F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7778B
GetProcAddress.KERNEL32 ref: 00007FF6DFF777A7
GetProcAddress.KERNEL32 ref: 00007FF6DFF777C3
GetProcAddress.KERNEL32 ref: 00007FF6DFF777DF
GetProcAddress.KERNEL32 ref: 00007FF6DFF777FB
GetProcAddress.KERNEL32 ref: 00007FF6DFF77817
GetProcAddress.KERNEL32 ref: 00007FF6DFF77833

Strings

Tcl_EvalEx, xrefs: 00007FF6DFF7779D
Tcl_ThreadAlert, xrefs: 00007FF6DFF77685
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6DFF77AE8
Tcl_Free, xrefs: 00007FF6DFF777F1
Failed to get address for Tcl_Init, xrefs: 00007FF6DFF7784F
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6DFF778F0
Tcl_DoOneEvent, xrefs: 00007FF6DFF77535
Tcl_CreateInterp, xrefs: 00007FF6DFF774FD
Tcl_Init, xrefs: 00007FF6DFF774E4
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6DFF77950
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6DFF77938
Tk_Init, xrefs: 00007FF6DFF7780D
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6DFF77980
Tcl_FinalizeThread, xrefs: 00007FF6DFF7756D
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6DFF77968
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6DFF779C8
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6DFF779B0
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6DFF77908
Tcl_NewStringObj, xrefs: 00007FF6DFF77711
Failed to get address for Tcl_Alloc, xrefs: 00007FF6DFF77AB8
Tcl_MutexLock, xrefs: 00007FF6DFF775DD
Tcl_SetVar2, xrefs: 00007FF6DFF776BD
Tcl_GetCurrentThread, xrefs: 00007FF6DFF775C1
Tcl_MutexUnlock, xrefs: 00007FF6DFF775F9
GetProcAddress, xrefs: 00007FF6DFF77856, 00007FF6DFF77876, 00007FF6DFF7788B, 00007FF6DFF778A0, 00007FF6DFF778B5, 00007FF6DFF778CA, 00007FF6DFF778DF, 00007FF6DFF778F7, 00007FF6DFF7790F, 00007FF6DFF77927, 00007FF6DFF7793F, 00007FF6DFF77957, 00007FF6DFF7796F, 00007FF6DFF77987, 00007FF6DFF7799F, 00007FF6DFF779B7, 00007FF6DFF779CF, 00007FF6DFF779E7, 00007FF6DFF779FF, 00007FF6DFF77A17, 00007FF6DFF77A2F, 00007FF6DFF77A47, 00007FF6DFF77A5F, 00007FF6DFF77A77, 00007FF6DFF77A8F, 00007FF6DFF77AA7, 00007FF6DFF77ABF, 00007FF6DFF77AD7, 00007FF6DFF77AEF, 00007FF6DFF77B07, 00007FF6DFF77B1F
Tcl_GetVar2, xrefs: 00007FF6DFF776A1
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6DFF77A70
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6DFF77998
Tcl_NewByteArrayObj, xrefs: 00007FF6DFF7772D
Tcl_EvalObjv, xrefs: 00007FF6DFF777B9
Tcl_Finalize, xrefs: 00007FF6DFF77551
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6DFF7786F
Tcl_ConditionWait, xrefs: 00007FF6DFF7764D
Failed to get address for Tcl_Finalize, xrefs: 00007FF6DFF77899
Tcl_CreateObjCommand, xrefs: 00007FF6DFF776D9
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6DFF77A58
Tcl_GetObjResult, xrefs: 00007FF6DFF77765
Tcl_FindExecutable, xrefs: 00007FF6DFF77519
Tcl_GetString, xrefs: 00007FF6DFF776F5
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6DFF778C3
Tcl_DeleteInterp, xrefs: 00007FF6DFF77589
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6DFF778AE
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6DFF779E0
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6DFF77A10
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6DFF77884
Tcl_EvalFile, xrefs: 00007FF6DFF77781
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6DFF77B18
Tcl_SetVar2Ex, xrefs: 00007FF6DFF77749
Tcl_ConditionNotify, xrefs: 00007FF6DFF77631
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6DFF77AD0
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6DFF779F8
Tk_GetNumMainWindows, xrefs: 00007FF6DFF77829
Tcl_CreateThread, xrefs: 00007FF6DFF775A5
Tcl_ThreadQueueEvent, xrefs: 00007FF6DFF77669
Failed to get address for Tcl_GetString, xrefs: 00007FF6DFF77A28
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6DFF77A40
Tcl_Alloc, xrefs: 00007FF6DFF777D5
Tcl_ConditionFinalize, xrefs: 00007FF6DFF77615
Failed to get address for Tcl_Free, xrefs: 00007FF6DFF77AA0
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6DFF778D8
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6DFF77A88
Failed to get address for Tk_Init, xrefs: 00007FF6DFF77B00
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6DFF77920

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 22024b249153ea0e59b866e83f9e6b0fc22e0894010a1230b992406c58f677af
Instruction ID: 077a3da6979acb93ec69585ff6a48df23fec1cc4376ab0686d599a97df6fb925
Opcode Fuzzy Hash: 22024b249153ea0e59b866e83f9e6b0fc22e0894010a1230b992406c58f677af
Instruction Fuzzy Hash: 86F1B5A1E2DB0790FE15DB16FC510BCA7A6AF45380B945537D8ADC33A5EEACE129C304

Function 00007FF6DFF73770 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF738B4

Strings

Failed to unmarshal code object for %s, xrefs: 00007FF6DFF738EC
_pyi_main_co, xrefs: 00007FF6DFF7388D
Could not get __main__ module's dict., xrefs: 00007FF6DFF739F2
Traceback is disabled via bootloader option., xrefs: 00007FF6DFF73989
\, xrefs: 00007FF6DFF73821
format_exception, xrefs: 00007FF6DFF73A38
traceback, xrefs: 00007FF6DFF73A0F
__main__, xrefs: 00007FF6DFF73797
__file__, xrefs: 00007FF6DFF73854
Absolute path to script exceeds PATH_MAX, xrefs: 00007FF6DFF738D6
%s%c%s.py, xrefs: 00007FF6DFF73829
pyi-disable-windowed-traceback, xrefs: 00007FF6DFF73972
Could not get __main__ module., xrefs: 00007FF6DFF739E1

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
API String ID: 1294909896-4198433784
Opcode ID: 7b76e79bf71ce97a3d82fffa890a01aadf1e29b1b2c140642746c48a92a1b34a
Instruction ID: 40d83b3896e1af90d2fc4c4e46fdb7afbf0c56c54527407c37180c612f6db515
Opcode Fuzzy Hash: 7b76e79bf71ce97a3d82fffa890a01aadf1e29b1b2c140642746c48a92a1b34a
Instruction Fuzzy Hash: A1B12866A09A4AA5EA00AF16E85417D63A0FF89FC4F544433DE2E837B1EF3CE465D300

Function 00007FF6DFF7EEB0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00007FF6DFF7EECF
_strdup.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EEE6
setlocale.MSVCRT ref: 00007FF6DFF7EEFE
mbstowcs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EF35
mbstowcs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EFA6
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F0AD
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F0E6
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F115
realloc.MSVCRT ref: 00007FF6DFF7F130
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F15C
setlocale.MSVCRT ref: 00007FF6DFF7F16D
free.MSVCRT ref: 00007FF6DFF7F179
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F1A2
realloc.MSVCRT ref: 00007FF6DFF7F1BD
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F1E1
setlocale.MSVCRT ref: 00007FF6DFF7F1F2
free.MSVCRT ref: 00007FF6DFF7F1FE

Strings

_MEIPASS2, xrefs: 00007FF6DFF7EEB1

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
String ID: _MEIPASS2
API String ID: 1093732947-3944641314
Opcode ID: 287966860c2ac8b6444271d038978cadc57c822ad10f62d983c926d9487c4d46
Instruction ID: 78298ad18791df875224fbdfa184275dc51ee32a66e523a363780aab3cab1705
Opcode Fuzzy Hash: 287966860c2ac8b6444271d038978cadc57c822ad10f62d983c926d9487c4d46
Instruction Fuzzy Hash: 58A14966F08B6688EB509BA6D8442FD27B0FB08B98F404536DE6C97B99DF3DD421C350

Function 00007FF6DFF73270 Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 203stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF73200: strcpy.MSVCRT(?,_MEIPASS2,00000000,?,00007FF6DFF7373B), ref: 00007FF6DFF73243

Part of subcall function 00007FF6DFF721D0: strlen.MSVCRT ref: 00007FF6DFF721E7

strcmp.MSVCRT ref: 00007FF6DFF733EA

Strings

%s%c%s.exe, xrefs: 00007FF6DFF73499
\, xrefs: 00007FF6DFF73358
pyi-contents-directory option not found in onedir bundle archive!, xrefs: 00007FF6DFF735D9
%s%c%s%c%s.pkg, xrefs: 00007FF6DFF7339A
Failed to open archive %s!, xrefs: 00007FF6DFF735EA
Failed to copy %s, xrefs: 00007FF6DFF73472
Failed to extract %s, xrefs: 00007FF6DFF735CB
pyi-contents-directory, xrefs: 00007FF6DFF732E1
%s%c%s, xrefs: 00007FF6DFF734BE
Archive path exceeds PATH_MAX, xrefs: 00007FF6DFF73590
%s%c%s%c%s%c%s, xrefs: 00007FF6DFF73309, 00007FF6DFF73338
\, xrefs: 00007FF6DFF733A4
Archive not found: %s, xrefs: 00007FF6DFF735A7
_MEIPASS2, xrefs: 00007FF6DFF73279

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: %s%c%s$%s%c%s%c%s%c%s$%s%c%s%c%s.pkg$%s%c%s.exe$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$_MEIPASS2$pyi-contents-directory$pyi-contents-directory option not found in onedir bundle archive!
API String ID: 895318938-736835633
Opcode ID: 7188ce8ba599c65f30d2b2548273d83509032fe689fbd89c554c56a7400f603c
Instruction ID: 69450164bd7b0be1878251386ee4e2e1f836275fae7cd77695b9bee0338588af
Opcode Fuzzy Hash: 7188ce8ba599c65f30d2b2548273d83509032fe689fbd89c554c56a7400f603c
Instruction Fuzzy Hash: 97915C61E08A82A1FA209B22E8406BEA750FF44B84F944533EE6DD7796DF3CE565C740

Function 00007FF6DFF74870 Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 203stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF7488D
strncmp.MSVCRT ref: 00007FF6DFF74911
strcmp.MSVCRT ref: 00007FF6DFF7492B

Strings

unbuffered, xrefs: 00007FF6DFF748D1
optimize, xrefs: 00007FF6DFF74978
hash_seed, xrefs: 00007FF6DFF74B40
utf8, xrefs: 00007FF6DFF749FC
pyi-, xrefs: 00007FF6DFF748BB
verbose, xrefs: 00007FF6DFF748C2
dev, xrefs: 00007FF6DFF74A03
_MEIPASS2, xrefs: 00007FF6DFF74874

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: callocstrcmpstrncmp
String ID: _MEIPASS2$dev$hash_seed$optimize$pyi-$unbuffered$utf8$verbose
API String ID: 3864021093-2470803696
Opcode ID: 1ebc1015cd89388c44d796f0e6af0bbaf2b2aa1507eb9976b7d4d29af4bb5d45
Instruction ID: d99546f7bad84ca07176bd2b7acb97aea0931cbe8399712e4d2665b26defed9f
Opcode Fuzzy Hash: 1ebc1015cd89388c44d796f0e6af0bbaf2b2aa1507eb9976b7d4d29af4bb5d45
Instruction Fuzzy Hash: 1181C262E0C653C6FB759F22A40437EEBA1AF45B98F048077CA6D87695DE3CE660C314

Function 00007FF6DFF71AC0 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

malloc.MSVCRT ref: 00007FF6DFF71B10
fread.MSVCRT ref: 00007FF6DFF71B63
free.MSVCRT ref: 00007FF6DFF71B88
fclose.MSVCRT ref: 00007FF6DFF71B93

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6DFF71BF5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6DFF71C0E
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6DFF71BD5
fread, xrefs: 00007FF6DFF71B79
fseek, xrefs: 00007FF6DFF71BDC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6DFF71B72
malloc, xrefs: 00007FF6DFF71C15
_MEIPASS2, xrefs: 00007FF6DFF71AC0

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _wfopenfclosefreadfreemalloc
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$_MEIPASS2$fread$fseek$malloc
API String ID: 3354994319-975985129
Opcode ID: b6c15d7af01ca10ef3634044a49f60cc2ac562fbc6848c346da0bc4537f0ce61
Instruction ID: b53e8c7804d4d6c24d3277b7c5c428d67e8ed54d4f7925f615f43ad1af85cf2b
Opcode Fuzzy Hash: b6c15d7af01ca10ef3634044a49f60cc2ac562fbc6848c346da0bc4537f0ce61
Instruction Fuzzy Hash: C031E191F09557A0FE149B169814BFE9750AF00BD8F946033DD2D8B7A6FE2CE42AC380

Function 00007FF6DFF72AA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6DFF72AC8
memset.MSVCRT ref: 00007FF6DFF72B16
_wcsdup.MSVCRT ref: 00007FF6DFF72B26
_wcsdup.MSVCRT ref: 00007FF6DFF72B36
_wcsdup.MSVCRT ref: 00007FF6DFF72B46
DialogBoxIndirectParamW.USER32 ref: 00007FF6DFF72B68
free.MSVCRT ref: 00007FF6DFF72B78
free.MSVCRT ref: 00007FF6DFF72B85
free.MSVCRT ref: 00007FF6DFF72B92
DeleteObject.GDI32 ref: 00007FF6DFF72BA4
DestroyIcon.USER32 ref: 00007FF6DFF72BB7

Strings

Unhandled exception in script, xrefs: 00007FF6DFF72AD8

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
String ID: Unhandled exception in script
API String ID: 3963799495-2699770090
Opcode ID: 43471661e5077f8d2a8b4a148338f8b99de2e514ac72301b00bb8278eb0036d4
Instruction ID: 62d9a89a007efd88d56bebd8bfefc60b244f0990eda904e135b20b255dddf3d2
Opcode Fuzzy Hash: 43471661e5077f8d2a8b4a148338f8b99de2e514ac72301b00bb8278eb0036d4
Instruction Fuzzy Hash: 61215172A0DA8281EA219F62F8556FE6760FB85B84F440137EE5E87B55DF3CD025CB40

Function 00007FF6DFF762A0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 122COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF74870: calloc.MSVCRT ref: 00007FF6DFF7488D
Part of subcall function 00007FF6DFF74870: strncmp.MSVCRT ref: 00007FF6DFF74911
Part of subcall function 00007FF6DFF74870: strcmp.MSVCRT ref: 00007FF6DFF7492B

Part of subcall function 00007FF6DFF75020: calloc.MSVCRT ref: 00007FF6DFF7503F

fflush.MSVCRT ref: 00007FF6DFF763C1
fflush.MSVCRT ref: 00007FF6DFF763D0

Strings

Failed to set python home path!, xrefs: 00007FF6DFF76438
Failed to set sys.argv!, xrefs: 00007FF6DFF76454
Failed to allocate PyConfig structure! Unsupported python version?, xrefs: 00007FF6DFF7647E
Failed to start embedded python interpreter!, xrefs: 00007FF6DFF763DA
Failed to pre-C7Dlwp4k embedded python interpreter!, xrefs: 00007FF6DFF76412
Failed to set run-time options!, xrefs: 00007FF6DFF76470
Failed to parse run-time options!, xrefs: 00007FF6DFF76462
Failed to set program name!, xrefs: 00007FF6DFF7642A
Failed to set module search paths!, xrefs: 00007FF6DFF76446

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: callocfflush$strcmpstrncmp
String ID: Failed to allocate PyConfig structure! Unsupported python version?$Failed to parse run-time options!$Failed to pre-C7Dlwp4k embedded python interpreter!$Failed to set module search paths!$Failed to set program name!$Failed to set python home path!$Failed to set run-time options!$Failed to set sys.argv!$Failed to start embedded python interpreter!
API String ID: 2710203250-2440087815
Opcode ID: 4f236a89a7cd51b2b3fca8f5acd636a7ada8452e1d5d72af4d0157a058538f47
Instruction ID: 4a18029d0a3b4edc6e080692d3548aa969e7a30d8f3fd75af06c40f0977b054f
Opcode Fuzzy Hash: 4f236a89a7cd51b2b3fca8f5acd636a7ada8452e1d5d72af4d0157a058538f47
Instruction Fuzzy Hash: 64512B11E0C65391FA15AB2AA8511BDD364AF80BD4F440033EE7EC77E2EE2DE5268750

Function 00007FF6DFF76BD0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF76BF9
memcpy.MSVCRT ref: 00007FF6DFF76C3D
strlen.MSVCRT ref: 00007FF6DFF76C57
strlen.MSVCRT ref: 00007FF6DFF76C64
strlen.MSVCRT ref: 00007FF6DFF76C90
free.MSVCRT ref: 00007FF6DFF76CE3
strncpy.MSVCRT ref: 00007FF6DFF76D3D
strncpy.MSVCRT ref: 00007FF6DFF76D6A
strncpy.MSVCRT ref: 00007FF6DFF76DD9

Strings

SPLASH: Cannot extract requirement %s., xrefs: 00007FF6DFF76DA3
_MEIPASS2, xrefs: 00007FF6DFF76BD9
SPLASH: Cannot find requirement %s in archive., xrefs: 00007FF6DFF76CCF

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlenstrncpy$callocfreememcpy
String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
API String ID: 4189425833-927121926
Opcode ID: 2ecc1dc425c6d9c378c3586f5a4b7250b878fc84675a255019ea90320cbe997f
Instruction ID: 1ade13fce3f264ad864ed2fc2948badbf84ee6a50d2d58c2a3da47ddf2bdf5ae
Opcode Fuzzy Hash: 2ecc1dc425c6d9c378c3586f5a4b7250b878fc84675a255019ea90320cbe997f
Instruction Fuzzy Hash: F641C551F0C64295EA24EA23A8146FEA755FF44FC8F444132EE2DC7786DE2CE265C300

Function 00007FF6DFF769E0 Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 00007FF6DFF76A41
strncpy.MSVCRT ref: 00007FF6DFF76A57
strncpy.MSVCRT ref: 00007FF6DFF76A6D
calloc.MSVCRT ref: 00007FF6DFF76AA3
malloc.MSVCRT ref: 00007FF6DFF76AC3
malloc.MSVCRT ref: 00007FF6DFF76AE3
memcpy.MSVCRT ref: 00007FF6DFF76B17
memcpy.MSVCRT ref: 00007FF6DFF76B2C
memcpy.MSVCRT ref: 00007FF6DFF76B41
free.MSVCRT ref: 00007FF6DFF76B49

Strings

Cannot allocate memory for necessary files., xrefs: 00007FF6DFF76B61
_MEIPASS2, xrefs: 00007FF6DFF769E4

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpystrncpy$malloc$callocfree
String ID: Cannot allocate memory for necessary files.$_MEIPASS2
API String ID: 1819673767-1389504347
Opcode ID: 667f4ada2585d8c75f7d08fbbfbf278b8df85313fa7ef40f25480eeebb1e5e38
Instruction ID: 5b382e8a35e4ef0be4d43a2509c60334f842d77a650e38e39b54c8b68744ae19
Opcode Fuzzy Hash: 667f4ada2585d8c75f7d08fbbfbf278b8df85313fa7ef40f25480eeebb1e5e38
Instruction Fuzzy Hash: B14108A2F0964157EA28EB22A5441EDA761FB45B84F444432DF2D87781DF7CF1718304

Function 00007FF6DFF72410 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6DFF72431
SelectObject.GDI32 ref: 00007FF6DFF72488
DrawTextW.USER32 ref: 00007FF6DFF724AB
SelectObject.GDI32 ref: 00007FF6DFF724C1
ReleaseDC.USER32 ref: 00007FF6DFF724D1
MoveWindow.USER32 ref: 00007FF6DFF7251D
MoveWindow.USER32 ref: 00007FF6DFF7255C
MoveWindow.USER32 ref: 00007FF6DFF725AD
MoveWindow.USER32 ref: 00007FF6DFF725EA

Strings

P%, xrefs: 00007FF6DFF72491

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 634056c5d82886171c5826ebe08236f1ab83107b6a9b60c113236062154ca025
Instruction ID: a392f66cc7a4393c07e568f2692e8b0165ab0fb2e4dec9662cfd9cf96ebf50ec
Opcode Fuzzy Hash: 634056c5d82886171c5826ebe08236f1ab83107b6a9b60c113236062154ca025
Instruction Fuzzy Hash: 4A4165766146A18AD7208F26E44876D77A1F788F99F084232EE8987B59DF3CD145CB20

Function 00007FF6DFF78500 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

fread.MSVCRT ref: 00007FF6DFF78571
ferror.MSVCRT ref: 00007FF6DFF78581
clearerr.MSVCRT(00000000,00000000,?,00007FF6DFF7346A,?,00000000), ref: 00007FF6DFF7858D
fwrite.MSVCRT ref: 00007FF6DFF785A3
ferror.MSVCRT ref: 00007FF6DFF785B0
clearerr.MSVCRT(00000000,00000000,?,00007FF6DFF7346A,?,00000000), ref: 00007FF6DFF785BC
fclose.MSVCRT ref: 00007FF6DFF785C9
fclose.MSVCRT ref: 00007FF6DFF785D1
fclose.MSVCRT ref: 00007FF6DFF785F4
fclose.MSVCRT ref: 00007FF6DFF78601

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fclose$clearerrferror$_wfopenfreadfwrite
String ID:
API String ID: 4075948245-0
Opcode ID: c9d41ce99c79e5cebecc2dfc79a962aeec18882380671e0d6ce33451f3cb1253
Instruction ID: 95f8fdbfcdebfce42eee78c5c4ca8aa1c58bedf5173b6ee43e8a39638485038d
Opcode Fuzzy Hash: c9d41ce99c79e5cebecc2dfc79a962aeec18882380671e0d6ce33451f3cb1253
Instruction Fuzzy Hash: F5212C51F0D24301F92566275A112FD87810F46FE9E688937EC3EEB7C6ED1DE9259340

Function 00007FF6DFF82C0B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF6DFF82CAE
fwprintf.MSVCRT ref: 00007FF6DFF82CE3
memset.MSVCRT ref: 00007FF6DFF82DCA
strlen.MSVCRT ref: 00007FF6DFF82DE2

Part of subcall function 00007FF6DFF88D2E: ___mb_cur_max_func.MSVCRT ref: 00007FF6DFF88D64
Part of subcall function 00007FF6DFF88D2E: ___lc_codepage_func.MSVCRT ref: 00007FF6DFF88D6B

fwprintf.MSVCRT ref: 00007FF6DFF82D0B

Part of subcall function 00007FF6DFF82B80: fputwc.MSVCRT ref: 00007FF6DFF82BD0

Strings

%-*.*S, xrefs: 00007FF6DFF82CD9
%.*S, xrefs: 00007FF6DFF82D01
%*.*S, xrefs: 00007FF6DFF82CA4

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 1485978544-2115465065
Opcode ID: d2eb4217ddd9504e58b3f4f9667a6e8988adc284b89a5f1a388818bb5d907d71
Instruction ID: 8346da720d5201c6fc96e484d1fa1164e6fc85b14c2ad6ccce1c1c233f15eb46
Opcode Fuzzy Hash: d2eb4217ddd9504e58b3f4f9667a6e8988adc284b89a5f1a388818bb5d907d71
Instruction Fuzzy Hash: AE81DDB6B04B498AE710CF2AC8806AC77E0F748B9CB118536EE5D87B58DF38E510CB40

Function 00007FF6DFF78D20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78D68
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78DBA
calloc.MSVCRT ref: 00007FF6DFF78DD0

Strings

WideCharToMultiByte, xrefs: 00007FF6DFF78E07, 00007FF6DFF78E27
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6DFF78E00
Failed to get UTF-8 buffer size., xrefs: 00007FF6DFF78E20
Out of memory., xrefs: 00007FF6DFF78DE1
win32_utils_to_utf8, xrefs: 00007FF6DFF78DE8

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1374691127-27947307
Opcode ID: c28c0e6c5d8874854bbcf17be2a90bb230ec35532378af5f2a3c060bcab11e97
Instruction ID: 0c7d5e9bc210586d3266d7fa33d153b834d967358e801053244ef3e995094e7e
Opcode Fuzzy Hash: c28c0e6c5d8874854bbcf17be2a90bb230ec35532378af5f2a3c060bcab11e97
Instruction Fuzzy Hash: E12171A1E0DB4284EB209B66E85037EA751EF48394F544637DA6E877D5EF3CD014C740

Function 00007FF6DFF78C30 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78C72
calloc.MSVCRT ref: 00007FF6DFF78C82
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78CB7

Strings

Failed to get ANSI buffer size., xrefs: 00007FF6DFF78CD0
WideCharToMultiByte, xrefs: 00007FF6DFF78CD7, 00007FF6DFF78CF7
win32_wcs_to_mbs, xrefs: 00007FF6DFF78D0E
Failed to encode filename as ANSI., xrefs: 00007FF6DFF78CF0
Out of memory., xrefs: 00007FF6DFF78D07

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
API String ID: 1374691127-3831141058
Opcode ID: 70b0f69a5f29bccdbde79e00c8141b456ca76900c87d9a96fa50ccaa8911fad9
Instruction ID: 1e02d4b8b2572cbe69a01b1a892fed694666fc1bfe4374e98ca6aa1d9704d815
Opcode Fuzzy Hash: 70b0f69a5f29bccdbde79e00c8141b456ca76900c87d9a96fa50ccaa8911fad9
Instruction Fuzzy Hash: CD21AE61E0CB4684FB209B56E85476EA791EF48394F54823BEE6E872D5EF3CE114C700

Function 00007FF6DFF78850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF7886B
_strdup.MSVCRT ref: 00007FF6DFF7889C
_errno.MSVCRT ref: 00007FF6DFF788D0
strerror.MSVCRT ref: 00007FF6DFF788D8
_errno.MSVCRT ref: 00007FF6DFF788F5
strerror.MSVCRT ref: 00007FF6DFF788FD

Strings

LOADER: failed to allocate argv_pyi: %s, xrefs: 00007FF6DFF78902
LOADER: failed to strdup argv[%d]: %s, xrefs: 00007FF6DFF788DF

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _errnostrerror$_strdupcalloc
String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
API String ID: 4278403329-2782260415
Opcode ID: 1d9ac3ccfa277b8f64417ff6ae261a12fd7eef427e7f1ea7b4c48e259a183636
Instruction ID: 988da3331115488e609a45b75c5a7114608f4476b182f52658dd46157a018ff0
Opcode Fuzzy Hash: 1d9ac3ccfa277b8f64417ff6ae261a12fd7eef427e7f1ea7b4c48e259a183636
Instruction Fuzzy Hash: 1311AF62E0960395F7249F55E841ABDA790BF44B45F64463ADD3EC7391EE3CA464C300

Function 00007FF6DFF76490 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF764AB
free.MSVCRT ref: 00007FF6DFF765BB

Strings

Failed to get _MEIPASS as PyObject., xrefs: 00007FF6DFF765E9
utf-8, xrefs: 00007FF6DFF764B7
strict, xrefs: 00007FF6DFF764B0
_MEIPASS, xrefs: 00007FF6DFF764E0
Module object for %s is NULL!, xrefs: 00007FF6DFF76586
_MEIPASS2, xrefs: 00007FF6DFF76492

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freestrlen
String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
API String ID: 322734593-568040347
Opcode ID: 7a526db5fdafa739e6a8bdaf9888ecddec0414ce26d8671fe76357d577240bed
Instruction ID: e8518395bc81662b837a93de50228821deddaa71410712a11e3d66e3c590b473
Opcode Fuzzy Hash: 7a526db5fdafa739e6a8bdaf9888ecddec0414ce26d8671fe76357d577240bed
Instruction Fuzzy Hash: 13417C62F09A46A1EE159F26E84447D6360BF49FD4B884177EE2E873A4DE3CE465D300

Function 00007FF6DFF78EF0 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26
MultiByteToWideChar.KERNEL32 ref: 00007FF6DFF78F68
calloc.MSVCRT ref: 00007FF6DFF78F7E

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF6DFF78FC8
win32_utils_from_utf8, xrefs: 00007FF6DFF78F92
%s%s: %s, xrefs: 00007FF6DFF78EF0
Out of memory., xrefs: 00007FF6DFF78F8B
Failed to decode wchar_t from UTF-8, xrefs: 00007FF6DFF78FA8
MultiByteToWideChar, xrefs: 00007FF6DFF78FAF, 00007FF6DFF78FCF

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: %s%s: %s$Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1374691127-2292745976
Opcode ID: ae36a3af2c446c5ec232e177f4e3447b6ea882bf452ebd8e328b24314d8fb46a
Instruction ID: a06bbc942f7b06f367d388c3c42a3877dee9169ef41c31f784d905c65db84865
Opcode Fuzzy Hash: ae36a3af2c446c5ec232e177f4e3447b6ea882bf452ebd8e328b24314d8fb46a
Instruction Fuzzy Hash: A711A561F0974284FA209B66EC502BD9352AF487A4F588637DE2DC76D1DE7CE124C300

Function 00007FF6DFF77210 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF7738B

Strings

exit, xrefs: 00007FF6DFF772C2
rename ::source ::_source, xrefs: 00007FF6DFF772E0
_image_data, xrefs: 00007FF6DFF77369
source, xrefs: 00007FF6DFF77309
tcl_findLibrary, xrefs: 00007FF6DFF7728D
tclInit, xrefs: 00007FF6DFF7726B

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
API String ID: 1294909896-1126984729
Opcode ID: e7df9e5e9c9a22bf82ea4de0ef2a26f98d4efede9051a1b578dbcbab44cc7672
Instruction ID: 33d603ea0ea8db5aa824c65d07c9247fe9ad312b5d5ffe7f46b8351212428843
Opcode Fuzzy Hash: e7df9e5e9c9a22bf82ea4de0ef2a26f98d4efede9051a1b578dbcbab44cc7672
Instruction Fuzzy Hash: B571D67AA18A4695EB109F22E8543AD7360FB48F89F444537DEAE87364DF7CD528C340

Function 00007FF6DFF76600 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF76614

Strings

strict, xrefs: 00007FF6DFF76619
utf-8, xrefs: 00007FF6DFF76623
Installing PYZ: Could not get sys.path!, xrefs: 00007FF6DFF766AC
path, xrefs: 00007FF6DFF76665
%U?%llu, xrefs: 00007FF6DFF76639
Failed to append PYZ entry to sys.path!, xrefs: 00007FF6DFF76690

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen
String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
API String ID: 39653677-372213108
Opcode ID: ad6469434e16e444b467f2237217c5c1b6908c5ff4eac4261832d946bacd06fa
Instruction ID: 8e58cf26accd32eb8e2fb2244b0d440959714c56669f2723740acffded19ea13
Opcode Fuzzy Hash: ad6469434e16e444b467f2237217c5c1b6908c5ff4eac4261832d946bacd06fa
Instruction Fuzzy Hash: 3D112C66E09A1691EA109F2AF8540AD6360AF89FD4B844133DD2EC73A0EE3CE525C700

Function 00007FF6DFF82F08 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF6DFF82FAB
fwprintf.MSVCRT ref: 00007FF6DFF82FE0

Part of subcall function 00007FF6DFF82B80: fputwc.MSVCRT ref: 00007FF6DFF82BD0

Strings

%-*.*s, xrefs: 00007FF6DFF82FD6
%.*s, xrefs: 00007FF6DFF82FFE
%*.*s, xrefs: 00007FF6DFF82FA1

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fwprintf$fputwc
String ID: %*.*s$%-*.*s$%.*s
API String ID: 2988249585-4054516066
Opcode ID: d6417dfda2078b4447efd06462b0ebb0257d965d566ff2bcbec1a803eaf523e4
Instruction ID: 470a58fe9e66724bbe8e8a8e223da522ea5263e7df3ead5fb2985e6253d07bb7
Opcode Fuzzy Hash: d6417dfda2078b4447efd06462b0ebb0257d965d566ff2bcbec1a803eaf523e4
Instruction Fuzzy Hash: BE71DCB6B04B8ACAD750CF2AC8815AD77E0F748B9CB118526EE5D87768DF38D550CB40

Function 00007FF6DFF77BB0 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF77BD0
strlen.MSVCRT ref: 00007FF6DFF77BE7
strlen.MSVCRT ref: 00007FF6DFF77BFC
malloc.MSVCRT ref: 00007FF6DFF77C0A

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$malloc
String ID:
API String ID: 3157260142-0
Opcode ID: cd771d01ee20a4a004eb1f515599c7128b18be52d0559a66d9b4fa3e6a355d5b
Instruction ID: 0675d6db0c8971358b7866bccb280e4f83368b4bbc989daf64ff1b6dfad210ff
Opcode Fuzzy Hash: cd771d01ee20a4a004eb1f515599c7128b18be52d0559a66d9b4fa3e6a355d5b
Instruction Fuzzy Hash: 2611A042F1F58718FE6AA95329156BF8FC11F49FD8D084432DD6E8F781ED6CA8618340

Function 00007FF6DFF729E0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6DFF72A09
EndDialog.USER32 ref: 00007FF6DFF72A38
GetWindowLongPtrW.USER32 ref: 00007FF6DFF72A45
InvalidateRect.USER32 ref: 00007FF6DFF72A65
SetWindowLongPtrW.USER32 ref: 00007FF6DFF72A84

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: DialogLongWindow$InvalidateRect
String ID:
API String ID: 1200242243-0
Opcode ID: 28415b81cc461644b9bde5041361b6faa17e91a7d6b1d99a581dc0e61d36b3c2
Instruction ID: 758476059aad64da1f9ea33b667355a24cf0f8d91833607470bf6581cebcb866
Opcode Fuzzy Hash: 28415b81cc461644b9bde5041361b6faa17e91a7d6b1d99a581dc0e61d36b3c2
Instruction Fuzzy Hash: AE01B531F1C46742F7782B2A68441BCA382EF99B51F5584B3DD1EC3B95CD3C68E29A01

Function 00007FF6DFF7E490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF6DFF7E4B8

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d250d892eb8f1a517ca8d111c4faaae7f46539765e284bd4c425852093292da5
Instruction ID: e78c2964a53f32d1a9ed32512d217c7ac9fb974b02fb810f8d47eec562e415e2
Opcode Fuzzy Hash: d250d892eb8f1a517ca8d111c4faaae7f46539765e284bd4c425852093292da5
Instruction Fuzzy Hash: 0D412072E18606CAFB208B64C9543BE6361EB44758F114A37CA3DC77E8DE3CE5719641

Function 00007FF6DFF72CD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

MessageBoxW.USER32 ref: 00007FF6DFF72D53
MessageBoxA.USER32 ref: 00007FF6DFF72D7B

Strings

WideCharToMultiByte, xrefs: 00007FF6DFF72CD8
Failed to get UTF-8 buffer size., xrefs: 00007FF6DFF72CD6

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
API String ID: 1878133881-785100509
Opcode ID: 7f5320ca9c022b5a5880cc99aba030728f2a4c067df74a4bd38cf457f7fd81ef
Instruction ID: b926aa467ec84e4f2eb51ee7f183d300fb0ec4147c6839f7f52eaf8f8861ed6f
Opcode Fuzzy Hash: 7f5320ca9c022b5a5880cc99aba030728f2a4c067df74a4bd38cf457f7fd81ef
Instruction Fuzzy Hash: 2501D23270878040EB301B26A8057EEA281A748BD5F488436CE4D57B85DE3CD596CB40

Function 00007FF6DFF74420 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6DFF74442

Part of subcall function 00007FF6DFF78D20: WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78D68

Strings

GetModuleFileNameW, xrefs: 00007FF6DFF7447F
Failed to convert executable path to UTF-8., xrefs: 00007FF6DFF74490
Failed to get executable path., xrefs: 00007FF6DFF74478

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 1532159127-1977442011
Opcode ID: 32aec0e32114a87591ef6c700c884524eb8b134af1a94f75ba6e9a037605cee3
Instruction ID: f583215f5a875d78b95783f26efdf387e37190ee78a53fc549733cbb6ba6bcb9
Opcode Fuzzy Hash: 32aec0e32114a87591ef6c700c884524eb8b134af1a94f75ba6e9a037605cee3
Instruction Fuzzy Hash: 3FF049A2F1C50381FA616B22AC453BD83519F497C4F444437EC2EC76AAEE1CEA6A9710

Function 00007FF6DFF72BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF72C38
free.MSVCRT ref: 00007FF6DFF72C40
free.MSVCRT ref: 00007FF6DFF72C48

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

Strings

Failed to obtain/convert traceback!, xrefs: 00007FF6DFF72C62

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$ByteCharMultiWide
String ID: Failed to obtain/convert traceback!
API String ID: 3219091393-982972847
Opcode ID: c72f11a31188c5ad1fdffc2f5de9e9f27b8325dc9da19ccfbcf90b0df7aa0248
Instruction ID: fc935b794c4ecc42dae60d055cef241e0147faffa363122169aa5537e3775994
Opcode Fuzzy Hash: c72f11a31188c5ad1fdffc2f5de9e9f27b8325dc9da19ccfbcf90b0df7aa0248
Instruction Fuzzy Hash: 4B018441F1E29205FD6965BB09226BE83424F44FD0E5C8436ED1ECBF83ED2DE4218740

Function 00007FF6DFF7DA10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04
Unknown error, xrefs: 00007FF6DFF7DAAA

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 23188349e83ee451bd10b25c6aa65908cd8bb1407ab069ba85c36fe8cde94703
Instruction ID: ea7d7fa1beba4fb9b81b13a6b6b7af66ed2faf8db1383a30a18d23fb41ca7994
Opcode Fuzzy Hash: 23188349e83ee451bd10b25c6aa65908cd8bb1407ab069ba85c36fe8cde94703
Instruction Fuzzy Hash: 38215B66A04F849AEB118F69D8413EE7371FF59798F444622EE8C57724EF38D259C300

Function 00007FF6DFF72F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF6DFF72F57

Part of subcall function 00007FF6DFF72CD0: MessageBoxW.USER32 ref: 00007FF6DFF72D53

Strings

%s%s: %s, xrefs: 00007FF6DFF72F74
Fatal error detected, xrefs: 00007FF6DFF72F8B

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Message_errno
String ID: %s%s: %s$Fatal error detected
API String ID: 1796756983-2410924014
Opcode ID: d1cbbd953ca21beeb29a1fcc411e82e708ae5de07ba7f1a82297aa0e77065503
Instruction ID: 3528331e711ed51f9038acbe8c82439837edfb55d7efaa6888778f9b2227a186
Opcode Fuzzy Hash: d1cbbd953ca21beeb29a1fcc411e82e708ae5de07ba7f1a82297aa0e77065503
Instruction Fuzzy Hash: 07016262A1C681D1F2209B22F8407EE6764FB94BD4F904232DF9C53B99CE3CD666CB44

Function 00007FF6DFF7DA5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Argument domain error (DOMAIN), xrefs: 00007FF6DFF7DA5C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 4bc73b72bde602d50bd6996f048aa5e1ed414ff175956bb87dcdf23f434c2120
Instruction ID: f409264a34dc21a663902793d20d8ef256a9f8a28325509877978cebf4d50623
Opcode Fuzzy Hash: 4bc73b72bde602d50bd6996f048aa5e1ed414ff175956bb87dcdf23f434c2120
Instruction Fuzzy Hash: 43015A66A04F848AE7118F69D8402AE7770FF4DB99F044722EF8D27724DF28C155C300

Function 00007FF6DFF7DA69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Argument singularity (SIGN), xrefs: 00007FF6DFF7DA69
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: ff2b5c5fb687d91f0b221557c7184b2a53967751068dee2070be2c40401cae02
Instruction ID: 4ec232df48cabf016e323973b6fb810d5ee70b24c5a579c74140d1a437babf19
Opcode Fuzzy Hash: ff2b5c5fb687d91f0b221557c7184b2a53967751068dee2070be2c40401cae02
Instruction Fuzzy Hash: 1A014866A04F848AE7118F69D8402AE7770FF4DB99F044622EF8D2B724DF28C155C300

Function 00007FF6DFF7DA76 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04
Overflow range error (OVERFLOW), xrefs: 00007FF6DFF7DA76

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 4a93ca5e65c98c494370446ff841bccd9ff8d068e8bfda7413ee571c7891f540
Instruction ID: 40f3be69c8f015ed90040d3d59ad8a048c53a61d45ce2618f5cce828a7fa1eb9
Opcode Fuzzy Hash: 4a93ca5e65c98c494370446ff841bccd9ff8d068e8bfda7413ee571c7891f540
Instruction Fuzzy Hash: 28015666A04F888AE7118F69D8402AE7770FF8DB99F048722EF8D6B725DF28C155C300

Function 00007FF6DFF7DA83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF6DFF7DA83
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 0d1aa399085a75b8b072d80d84b44118880c3291a941a9cf13af9718a2cff7b3
Instruction ID: 7426d82e1fda0ca193de79dfe724d53d3241c4aeaeb8e865a7944e1d53d0f0a3
Opcode Fuzzy Hash: 0d1aa399085a75b8b072d80d84b44118880c3291a941a9cf13af9718a2cff7b3
Instruction Fuzzy Hash: 91015A66A04F848AE7118F69D8402AE7770FF8DB99F044722EF8D67724DF28C155C300

Function 00007FF6DFF7DA90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Total loss of significance (TLOSS), xrefs: 00007FF6DFF7DA90
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: f67ed119eb88b9fe41558e53022155db75d7e3d109680d0b53d5d3a77e47e22f
Instruction ID: 9b497590dbd34f8225aeb5ebe17caa28a98b3b8d6606dc62705535b93449c97f
Opcode Fuzzy Hash: f67ed119eb88b9fe41558e53022155db75d7e3d109680d0b53d5d3a77e47e22f
Instruction Fuzzy Hash: 32015A66A04F848AE7118F69D8402AE7770FF4DB99F044722EF8D67724DF28C155C300

Function 00007FF6DFF7DA9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6DFF7DA9D
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: b97a8a5cf53c8f5fae4f755748c6196fedc78155e63a17b4b90822ca1f009b6f
Instruction ID: 4044260a64d3866eecffe72d0060c1cebcefad0b55a0cc0e23d2225388023843
Opcode Fuzzy Hash: b97a8a5cf53c8f5fae4f755748c6196fedc78155e63a17b4b90822ca1f009b6f
Instruction Fuzzy Hash: 3F014466A04F888AE7118F69D8402AE7770FB8DB99F048622EF9D6B724DF28C155C300

Function 00007FF6DFF747E0 Relevance: 5.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF7480C
free.MSVCRT ref: 00007FF6DFF7481A
free.MSVCRT ref: 00007FF6DFF7483C
free.MSVCRT ref: 00007FF6DFF7484A

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e32ea28c20312c466fe0eae4607c9c7db9732c83a98e376157454717f3c0b371
Instruction ID: 989cc6f2cd2bf04213030c574eaab4401f27d8d3b2eb54f6acaa518a628baea1
Opcode Fuzzy Hash: e32ea28c20312c466fe0eae4607c9c7db9732c83a98e376157454717f3c0b371
Instruction Fuzzy Hash: 3601B163E08515C2EB60DB36E4412BDA770FF88F58F258232CE1E87346CD28D8A2C784

Function 00007FF6DFF76EB0 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF76ECD
free.MSVCRT ref: 00007FF6DFF76EDE
free.MSVCRT ref: 00007FF6DFF76EEF
free.MSVCRT ref: 00007FF6DFF76EF7

Memory Dump Source

Source File: 00000000.00000002.2100572714.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000000.00000002.2100557371.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100593956.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100611366.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100628838.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100643740.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100658058.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100672652.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f0bf0e9c3c52508d81d47e1dd12508dcc90c83752b35f5aea06d8c31e236c31f
Instruction ID: 53d1c5cef05e611de79c153dfbf840d3de36754651e1243659b0dabcad704ec2
Opcode Fuzzy Hash: f0bf0e9c3c52508d81d47e1dd12508dcc90c83752b35f5aea06d8c31e236c31f
Instruction Fuzzy Hash: 40F08C91E0A51245FD69AA72E0203BD57205F44F84F148432CB2E97B82CE2DE862C314

Analysis Process: zapret.exePID: 7096, Parent PID: 6048COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1505
Total number of Limit Nodes:	62

Executed Functions

Function 61CC6580 Relevance: 118.2, APIs: 51, Strings: 16, Instructions: 915librarystringloaderCOMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON310 ref: 61CC65A1
PyTuple_GetItem.PYTHON310 ref: 61CC65BB
PyLong_AsLong.PYTHON310 ref: 61CC65D0
PyTuple_GetItem.PYTHON310 ref: 61CC65E0
PyLong_AsLong.PYTHON310 ref: 61CC65EE
PySys_GetObject.PYTHON310 ref: 61CC65FD
PyLong_AsVoidPtr.PYTHON310 ref: 61CC6609
GetProcAddress.KERNEL32 ref: 61CC662E
GetProcAddress.KERNEL32 ref: 61CC664C
GetProcAddress.KERNEL32 ref: 61CC666A
PyModule_Create2.PYTHON310 ref: 61CC6694
PyModule_GetName.PYTHON310 ref: 61CC66A9
strrchr.MSVCRT ref: 61CC66CE
malloc.MSVCRT ref: 61CC66E4
memcpy.MSVCRT ref: 61CC66FE
PyBytes_FromStringAndSize.PYTHON310 ref: 61CC6751
PyBytes_AsString.PYTHON310 ref: 61CC676B
malloc.MSVCRT ref: 61CC677F
PyCMethod_New.PYTHON310 ref: 61CC67CD
PyCMethod_New.PYTHON310 ref: 61CC6813
PyCMethod_New.PYTHON310 ref: 61CC6859
PyBytes_FromStringAndSize.PYTHON310 ref: 61CC6883
PyBytes_AsString.PYTHON310 ref: 61CC6899
_time64.MSVCRT ref: 61CC6976
srand.MSVCRT ref: 61CC697E
strstr.MSVCRT ref: 61CC6B25
strncmp.MSVCRT ref: 61CC6B61
PyErr_Format.PYTHON310 ref: 61CC6BD4
_Py_Dealloc.PYTHON310 ref: 61CC6C0A
_Py_Dealloc.PYTHON310 ref: 61CC6C19
malloc.MSVCRT ref: 61CC6C3A
free.MSVCRT ref: 61CC6CA4
malloc.MSVCRT ref: 61CC6CB0
memcpy.MSVCRT ref: 61CC6CD3
free.MSVCRT ref: 61CC6D02
malloc.MSVCRT ref: 61CC6D0E
memcpy.MSVCRT ref: 61CC6D31
PyErr_Format.PYTHON310 ref: 61CC7378

Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE123
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE140
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE162
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE182
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE1A2
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE1C2
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE1E2
Part of subcall function 61CDE0F0: memcmp.MSVCRT ref: 61CDE202

Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDE93
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDEB3
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDED5
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDEF5
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDF15
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDF35
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDF55
Part of subcall function 61CDDE60: memcmp.MSVCRT ref: 61CDDF75

Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD8BB
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD8E5
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD904
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD923
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD942
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD95D
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD978
Part of subcall function 61CDD890: strcmp.MSVCRT ref: 61CDD993

Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDB5B
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDB7F
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDB9B
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDBBA
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDBD9
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDBF4
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDC0F
Part of subcall function 61CDDB30: strcmp.MSVCRT ref: 61CDDC2A

Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDA0B
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDA35
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDA54
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDA73
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDA92
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDAAD
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDAC8
Part of subcall function 61CDD9E0: strcmp.MSVCRT ref: 61CDDAE3

PyBytes_AsStringAndSize.PYTHON310 ref: 61CC6EA8

Strings

sha256, xrefs: 61CC6A15
aes, xrefs: 61CC69E1
version_info, xrefs: 61CC6593
000000, xrefs: 61CC6B54
.pyarmor.ikey, xrefs: 61CC6E80
PyCell_Get, xrefs: 61CC6627
,*, xrefs: 61CC7363
sprng, xrefs: 61CC69FB
%s (%d:%d), xrefs: 61CC6BCD, 61CC6DF5, 61CC6E64, 61CC6FD5, 61CC730D, 61CC7371
PyCell_New, xrefs: 61CC6633
C_LEAVE_CO_OBJECT_INDEX, xrefs: 61CC6831
C_ASSERT_ARMORED_INDEX, xrefs: 61CC6794
PyCell_Set, xrefs: 61CC6651
pyarmor_runtime_, xrefs: 61CC6B19, 61CC6B35
C_ENTER_CO_OBJECT_INDEX, xrefs: 61CC67EB
dllhandle, xrefs: 61CC65F0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strcmp$memcmp$Bytes_Stringmalloc$AddressLong_Method_ProcSizememcpy$DeallocErr_FormatFromItemLongModule_ObjectSys_Tuple_free$Create2NameVoid_time64srandstrncmpstrrchrstrstr
String ID: %s (%d:%d)$,*$.pyarmor.ikey$000000$C_ASSERT_ARMORED_INDEX$C_ENTER_CO_OBJECT_INDEX$C_LEAVE_CO_OBJECT_INDEX$PyCell_Get$PyCell_New$PyCell_Set$aes$dllhandle$pyarmor_runtime_$sha256$sprng$version_info
API String ID: 3695841847-3717260241
Opcode ID: 94d1ce50745224fe057015ac7690fb2e86e3108c663763c3d9d43fa9fa93740a
Instruction ID: f4749ac73d11c1545eac58df4ead7c3dc6aacc6068679d4bc1cb718c429779f4
Opcode Fuzzy Hash: 94d1ce50745224fe057015ac7690fb2e86e3108c663763c3d9d43fa9fa93740a
Instruction Fuzzy Hash: 7B82F272705B94C2EB01CB69E5507AE3BA2FB85F84F89C016CA4D4B794EF39D856C342

Function 00007FF8A8631956 Relevance: 44.5, APIs: 18, Strings: 7, Instructions: 785COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8A8640414
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8A864041C
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8A86405F9
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A8640601
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8A864066D

Strings

POST , xrefs: 00007FF8A8640CA9
PUT , xrefs: 00007FF8A8640CE6
GET , xrefs: 00007FF8A8640C86
HEAD , xrefs: 00007FF8A8640CC7
CONNE, xrefs: 00007FF8A8640CFA
, xrefs: 00007FF8A864057F
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A8640499, 00007FF8A8640D1A, 00007FF8A8640DC2

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: D_sizeO_memcmpR_flagsX_cipherX_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT
API String ID: 2456506815-3985260174
Opcode ID: 064def04b24ac4c63f2f0036b05941dcbb17a60faf78b2664020f0661c7207e1
Instruction ID: cf6be9b65ab30120c5681b3ea98c0bada27e6e60cc804e6954f6b57c023250ea
Opcode Fuzzy Hash: 064def04b24ac4c63f2f0036b05941dcbb17a60faf78b2664020f0661c7207e1
Instruction Fuzzy Hash: FE72B132F0A65296FBA08E11D6487BE37A0EB44BC8F146035DA8D476C5CF7DE584C72A

Function 00007FF8A8632207 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8654D7D
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8654DCF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8654DF4

Strings

ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FF8A8654F57
ssl3-sha1, xrefs: 00007FF8A8654FBF
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A8654D73, 00007FF8A8654DBF, 00007FF8A8654DDF, 00007FF8A8654E1E, 00007FF8A8654E7E, 00007FF8A8654EA4, 00007FF8A8655033
ssl3-md5, xrefs: 00007FF8A8654F97
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256, xrefs: 00007FF8A8654F25

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ssl3-md5$ssl3-sha1
API String ID: 1767461275-1115027282
Opcode ID: 64c1ed371fb724922acc68a584a4f72b312f0de4d445f977e19cc316ff135a2a
Instruction ID: f6c8426ce48531cf7a41b2bf819e1a031d9ca5e918f793ae6d3f07c8b60cd5e7
Opcode Fuzzy Hash: 64c1ed371fb724922acc68a584a4f72b312f0de4d445f977e19cc316ff135a2a
Instruction Fuzzy Hash: 1EA14C71A0AB42A5FB949F24E4583B836A0FF44B88F442175DA4D4B3CAEF3CE554C728

Function 61CC7590 Relevance: 28.5, APIs: 15, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61CC7600
PyErr_Format.PYTHON310 ref: 61CC7975
PyErr_Format.PYTHON310 ref: 61CC79DD
PyErr_Format.PYTHON310 ref: 61CC7AAD

Strings

%s (%d:%d), xrefs: 61CC7896, 61CC796B, 61CC79D3, 61CC7AA3, 61CC7B13, 61CC7B93, 61CC7C1F, 61CC7CF0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_Format$malloc
String ID: %s (%d:%d)
API String ID: 1817594650-1595188566
Opcode ID: b33b37f8c80731f465efa34021d5711eb861afc8313d97311348655fbc83c4e6
Instruction ID: 9c02d53f6421519eb35b140a5b1edd5b08b1bd9b6fab511941fff31210af28fd
Opcode Fuzzy Hash: b33b37f8c80731f465efa34021d5711eb861afc8313d97311348655fbc83c4e6
Instruction Fuzzy Hash: 5B02ABB2706B44C1FF158B6AD5903AD3B62FB85F88F488416CE5D0B794EF29C861E342

Function 00007FF8A8659720 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8659752
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8659782

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A8659744, 00007FF8A8659772, 00007FF8A8659794, 00007FF8A86597DF, 00007FF8A8659807, 00007FF8A8659AA9, 00007FF8A8659AF4, 00007FF8A8659B4D

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 7b6a55bb11b7fe575e0ec2b4a4e773588f60d0a70433b007c9e18af06fed72e4
Instruction ID: ac37b83402012836d7f2c7aaceb70de3598b1aebf85d01dc8381c6cb9d2644fe
Opcode Fuzzy Hash: 7b6a55bb11b7fe575e0ec2b4a4e773588f60d0a70433b007c9e18af06fed72e4
Instruction Fuzzy Hash: 4BE10B36606B8196EB88CF29E5843E973A4FB48B88F086136DF5C4B355DF38A161C724

Function 00007FF8A8631393 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8A867E957
d2i_X509.LIBCRYPTO-1_1 ref: 00007FF8A867EA7B
X509_free.LIBCRYPTO-1_1 ref: 00007FF8A867EEE9
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A867EEF8

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A867EA17, 00007FF8A867EEC4

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1068509327-1507966698
Opcode ID: ffbb3dbb5cbfe55bb72e612411af48878a88a6c77842706b967c83123da13720
Instruction ID: 403f4164c7d3f9f06180c3d383975f6ef4f58f11245ef111d7cb1b02578c5daf
Opcode Fuzzy Hash: ffbb3dbb5cbfe55bb72e612411af48878a88a6c77842706b967c83123da13720
Instruction Fuzzy Hash: F4E10172B0AA8192F760EB15E4487A97BA1EB84FC4F045134EA8C4BBD5CF3CD155CB68

Function 00007FF6DFF71154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_amsg_exit.MSVCRT ref: 00007FF6DFF711F6
_initterm.MSVCRT ref: 00007FF6DFF7122B
_initterm.MSVCRT ref: 00007FF6DFF7125E
exit.MSVCRT ref: 00007FF6DFF71358
_cexit.MSVCRT ref: 00007FF6DFF71367

Strings

0, xrefs: 00007FF6DFF71164

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _initterm$_amsg_exit_cexitexit
String ID: 0
API String ID: 602970348-4108050209
Opcode ID: 9905e89fe877ea847ce878e57ecea80b115fcac03c0dbd49d2c840cd9bbea999
Instruction ID: 1096287b07b8139a3d7d187a53bc78fa1d6aa9ed2c783f792b60a51c742898dd
Opcode Fuzzy Hash: 9905e89fe877ea847ce878e57ecea80b115fcac03c0dbd49d2c840cd9bbea999
Instruction Fuzzy Hash: 3761B176E19B0699FB509FA6E88036C23A4BB48B84F404436DE6CD73A5DF7CE464C700

Function 00007FF8A8631073 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A865341A
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A8653459
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A8653484
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A86534AD

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FF8A86533F5

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: D_run_once$R_put_error
String ID: ..\s\ssl\ssl_init.c
API String ID: 511881677-1166085723
Opcode ID: fd329f3d3c4ac018813aac7fd218cde1706058dba49e64e5e4a2f582db8a53f4
Instruction ID: 274b434ddddc202ccbb36b409dec1a51c9a6826e40ef198129d4915c7fd1b591
Opcode Fuzzy Hash: fd329f3d3c4ac018813aac7fd218cde1706058dba49e64e5e4a2f582db8a53f4
Instruction Fuzzy Hash: 7A214D61B0A603A6FA469B15EE082B53391EFA17C0F847034DA0D87195EF3CE5658628

Function 61CC5870 Relevance: 63.3, APIs: 30, Strings: 6, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_GetFrame.PYTHON310 ref: 61CC54E2
PyUnicode_FromFormat.PYTHON310 ref: 61CC54FF
Py_DecRef.PYTHON310 ref: 61CC5513
PyUnicode_AsUTF8.PYTHON310 ref: 61CC5924
PyImport_GetModuleDict.PYTHON310 ref: 61CC5958
PyDict_GetItem.PYTHON310 ref: 61CC5966
PyModule_GetDict.PYTHON310 ref: 61CC5977
PyDict_GetItemString.PYTHON310 ref: 61CC598A
PyImport_ExecCodeModuleObject.PYTHON310 ref: 61CC59AD
PyErr_Occurred.PYTHON310 ref: 61CC59B6

Part of subcall function 61CCFEF0: VirtualAlloc.KERNEL32 ref: 61CCFF49
Part of subcall function 61CCFEF0: memcpy.MSVCRT ref: 61CCFF6C

Strings

%s (%d:%d), xrefs: 61CC61EC
__main__, xrefs: 61CC5918
<frozen %U>, xrefs: 61CC54F8, 61CC5543
__spec__, xrefs: 61CC597D
, xrefs: 61CC589B
__mp_main__, xrefs: 61CC593E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DictDict_Import_ItemModuleUnicode_$AllocCodeErr_Eval_ExecFormatFrameFromModule_ObjectOccurredStringVirtualmemcpy
String ID: $%s (%d:%d)$<frozen %U>$__main__$__mp_main__$__spec__
API String ID: 3240200909-2782528897
Opcode ID: 9f99c94b7b96d533b1f1e693010825b1f91511f5ee8f84518908bb79f4947a67
Instruction ID: 9d5261043e6f7d5a03067e58142d9cd2251be7f76ad8d106654df8bd077a4fc9
Opcode Fuzzy Hash: 9f99c94b7b96d533b1f1e693010825b1f91511f5ee8f84518908bb79f4947a67
Instruction Fuzzy Hash: 91D17932306A90C6EF05CFA6E9503AD7B61FB86F98F0C8525CA5E47764EF29C855C342

Function 00007FF6DFF73770 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00007FF6DFF738B4

Strings

Failed to unmarshal code object for %s, xrefs: 00007FF6DFF738EC
\, xrefs: 00007FF6DFF73821
Could not get __main__ module., xrefs: 00007FF6DFF739E1
format_exception, xrefs: 00007FF6DFF73A38
Traceback is disabled via bootloader option., xrefs: 00007FF6DFF73989
_pyi_main_co, xrefs: 00007FF6DFF7388D
Absolute path to script exceeds PATH_MAX, xrefs: 00007FF6DFF738D6
__main__, xrefs: 00007FF6DFF73797
traceback, xrefs: 00007FF6DFF73A0F
%s%c%s.py, xrefs: 00007FF6DFF73829
pyi-disable-windowed-traceback, xrefs: 00007FF6DFF73972
__file__, xrefs: 00007FF6DFF73854
Could not get __main__ module's dict., xrefs: 00007FF6DFF739F2

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
API String ID: 1294909896-4198433784
Opcode ID: 142cad25816035ac1b29b6c4e55a3deab6ebdbd29f4bea9490b2cb5a38c870e8
Instruction ID: 40d83b3896e1af90d2fc4c4e46fdb7afbf0c56c54527407c37180c612f6db515
Opcode Fuzzy Hash: 142cad25816035ac1b29b6c4e55a3deab6ebdbd29f4bea9490b2cb5a38c870e8
Instruction Fuzzy Hash: A1B12866A09A4AA5EA00AF16E85417D63A0FF89FC4F544433DE2E837B1EF3CE465D300

Function 61CC5881 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyUnicode_AsUTF8.PYTHON310 ref: 61CC5924
PyImport_GetModuleDict.PYTHON310 ref: 61CC5958
PyDict_GetItem.PYTHON310 ref: 61CC5966
PyModule_GetDict.PYTHON310 ref: 61CC5977
PyDict_GetItemString.PYTHON310 ref: 61CC598A
PyImport_ExecCodeModuleObject.PYTHON310 ref: 61CC59AD
PyErr_Occurred.PYTHON310 ref: 61CC59B6

Strings

%s (%d:%d), xrefs: 61CC5ECC
__main__, xrefs: 61CC5918
__spec__, xrefs: 61CC597D
, xrefs: 61CC589B
__mp_main__, xrefs: 61CC593E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DictDict_Import_ItemModule$CodeErr_ExecModule_ObjectOccurredStringUnicode_
String ID: $%s (%d:%d)$__main__$__mp_main__$__spec__
API String ID: 4088344453-4025645406
Opcode ID: a4cddb5d03bf338fd50233326f17270ead7959291250665b9a77482a27f73f7a
Instruction ID: 8616776a3776f3ae34bb5c02e2edc679549f59525a613bde2febbfdd4a88b952
Opcode Fuzzy Hash: a4cddb5d03bf338fd50233326f17270ead7959291250665b9a77482a27f73f7a
Instruction Fuzzy Hash: BA816732702A94C5FF19CBA6E5903AD7B61EB85F98F08C425CA6E47764EF29C845C342

Function 00007FF6DFF7F220 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strdup.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F256
setlocale.MSVCRT ref: 00007FF6DFF7F26E
mbstowcs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F2A5
mbstowcs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F316
setlocale.MSVCRT ref: 00007FF6DFF7F381
free.MSVCRT ref: 00007FF6DFF7F38D
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F5C1
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F635
realloc.MSVCRT ref: 00007FF6DFF7F650
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F679
setlocale.MSVCRT ref: 00007FF6DFF7F68A
free.MSVCRT ref: 00007FF6DFF7F696
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F6C0
realloc.MSVCRT ref: 00007FF6DFF7F6DB
wcstombs.MSVCRT(00007FF6DFF722CB,00000000,00000000,?,?,00007FF6DFF73FE6), ref: 00007FF6DFF7F6FF
setlocale.MSVCRT ref: 00007FF6DFF7F710
free.MSVCRT ref: 00007FF6DFF7F71C

Strings

_MEIPASS2, xrefs: 00007FF6DFF7F221

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
String ID: _MEIPASS2
API String ID: 918573998-3944641314
Opcode ID: c5ee0499fa5628169db05d05735613bc8efeb40af6ea19e85eafb8c680fa8f82
Instruction ID: b0bb3eca46c73ec4c6d61e9800e3e5428c6877fb6b3873fdff2a6a2fd9eaa479
Opcode Fuzzy Hash: c5ee0499fa5628169db05d05735613bc8efeb40af6ea19e85eafb8c680fa8f82
Instruction Fuzzy Hash: 7DF13E66F04B5688EB508FAAC8412BD77B1FB48B98F804436DE5DA7798DF38D461C390

Function 00007FF6DFF71710 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 198
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF6DFF71788
malloc.MSVCRT ref: 00007FF6DFF7179E
fread.MSVCRT ref: 00007FF6DFF717CD
ferror.MSVCRT ref: 00007FF6DFF717DE
fwrite.MSVCRT ref: 00007FF6DFF71867
ferror.MSVCRT ref: 00007FF6DFF71882
free.MSVCRT ref: 00007FF6DFF71905
free.MSVCRT ref: 00007FF6DFF7190D

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6DFF71A5E
1.2.13, xrefs: 00007FF6DFF7173F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6DFF718E9
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6DFF71A07
malloc, xrefs: 00007FF6DFF71A46, 00007FF6DFF71A65
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6DFF71A3F

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ferrorfreemalloc$freadfwrite
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 3559050057-1655038675
Opcode ID: 62eed4cfbfaa732855b6b3e01fb02c6c80926af7a80d21806595b23648814707
Instruction ID: c0a2989b2f348435a473791c0552fceb6c917691929fc3a3497eed9a5517a961
Opcode Fuzzy Hash: 62eed4cfbfaa732855b6b3e01fb02c6c80926af7a80d21806595b23648814707
Instruction Fuzzy Hash: D581A572E0C68291E7608B26E8403BEA3A0FB44BA8F544132DEAD877D5DF7CD559C740

Function 00007FF6DFF71F20 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

Part of subcall function 00007FF6DFF78A10: malloc.MSVCRT ref: 00007FF6DFF78A2E
Part of subcall function 00007FF6DFF78A10: free.MSVCRT ref: 00007FF6DFF78B05

fclose.MSVCRT ref: 00007FF6DFF71F83
fread.MSVCRT ref: 00007FF6DFF71FBF
malloc.MSVCRT ref: 00007FF6DFF7201D
fread.MSVCRT ref: 00007FF6DFF7203E

Strings

Could not read full TOC!, xrefs: 00007FF6DFF720B0
fread, xrefs: 00007FF6DFF720B7, 00007FF6DFF720F7
Failed to seek to cookie position!, xrefs: 00007FF6DFF720D0
Error on file., xrefs: 00007FF6DFF72110
malloc, xrefs: 00007FF6DFF72132
Failed to read cookie!, xrefs: 00007FF6DFF720F0
Could not allocate buffer for TOC!, xrefs: 00007FF6DFF7212B
fseek, xrefs: 00007FF6DFF720D7

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freadmalloc$_wfopenfclosefree
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
API String ID: 2617120823-2084260460
Opcode ID: 8c530e99f211ac12411ce80beb8c1e36b3f9bdd053f5727f3e698ff15fa3ad99
Instruction ID: 043cdda40fdb1ef1b9a809d076d468cc2834f1fe66f82b4f194839115f8b96cc
Opcode Fuzzy Hash: 8c530e99f211ac12411ce80beb8c1e36b3f9bdd053f5727f3e698ff15fa3ad99
Instruction Fuzzy Hash: 0651ACA1F0964282EB148B25D4402BCA7A1EF88B98F648137DE2D877D9DF3CE525C744

Function 61D3FA70 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 61D3FACE
CreateFileMappingA.KERNEL32 ref: 61D3FB25
MapViewOfFile.KERNEL32 ref: 61D3FB51
CloseHandle.KERNEL32 ref: 61D3FB5D
GetLastError.KERNEL32 ref: 61D3FB68
_errno.MSVCRT ref: 61D3FB70

Strings

@, xrefs: 61D3FBD4
, xrefs: 61D3FAAC
@, xrefs: 61D3FC2D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: File_errno$CloseCreateErrorHandleLastMappingView
String ID: $@$@
API String ID: 896588047-3743272326
Opcode ID: b473d53525f37515d8b2ce07c67a023395be36e63a601f2f4f506b98d8fad01c
Instruction ID: c75ee2ef624de56ef5ac33b9622be236562742b65e8a87ec4ed1251c85724638
Opcode Fuzzy Hash: b473d53525f37515d8b2ce07c67a023395be36e63a601f2f4f506b98d8fad01c
Instruction Fuzzy Hash: 854102B3A1566886F7158B96AC0078A6511B78FBF5F4D8322DE79473E0EB3CC841C342

Function 00007FF6DFF71AC0 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

malloc.MSVCRT ref: 00007FF6DFF71B10
fread.MSVCRT ref: 00007FF6DFF71B63
free.MSVCRT ref: 00007FF6DFF71B88
fclose.MSVCRT ref: 00007FF6DFF71B93

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6DFF71B72
fread, xrefs: 00007FF6DFF71B79
_MEIPASS2, xrefs: 00007FF6DFF71AC0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6DFF71BD5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6DFF71BF5
malloc, xrefs: 00007FF6DFF71C15
fseek, xrefs: 00007FF6DFF71BDC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6DFF71C0E

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _wfopenfclosefreadfreemalloc
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$_MEIPASS2$fread$fseek$malloc
API String ID: 3354994319-975985129
Opcode ID: b75b8568c4b256912a9e1c68b85e95a78c6b4c27be2cad1b3528ec8dd99e5e38
Instruction ID: b53e8c7804d4d6c24d3277b7c5c428d67e8ed54d4f7925f615f43ad1af85cf2b
Opcode Fuzzy Hash: b75b8568c4b256912a9e1c68b85e95a78c6b4c27be2cad1b3528ec8dd99e5e38
Instruction Fuzzy Hash: C031E191F09557A0FE149B169814BFE9750AF00BD8F946033DD2D8B7A6FE2CE42AC380

Function 00007FF6DFF762A0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF74870: calloc.MSVCRT ref: 00007FF6DFF7488D
Part of subcall function 00007FF6DFF74870: strncmp.MSVCRT ref: 00007FF6DFF74911
Part of subcall function 00007FF6DFF74870: strcmp.MSVCRT ref: 00007FF6DFF7492B

Part of subcall function 00007FF6DFF75020: calloc.MSVCRT ref: 00007FF6DFF7503F

fflush.MSVCRT ref: 00007FF6DFF763C1
fflush.MSVCRT ref: 00007FF6DFF763D0

Strings

Failed to set module search paths!, xrefs: 00007FF6DFF76446
Failed to set program name!, xrefs: 00007FF6DFF7642A
Failed to allocate PyConfig structure! Unsupported python version?, xrefs: 00007FF6DFF7647E
Failed to parse run-time options!, xrefs: 00007FF6DFF76462
Failed to set run-time options!, xrefs: 00007FF6DFF76470
Failed to set sys.argv!, xrefs: 00007FF6DFF76454
Failed to start embedded python interpreter!, xrefs: 00007FF6DFF763DA
Failed to pre-C7Dlwp4k embedded python interpreter!, xrefs: 00007FF6DFF76412
Failed to set python home path!, xrefs: 00007FF6DFF76438

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: callocfflush$strcmpstrncmp
String ID: Failed to allocate PyConfig structure! Unsupported python version?$Failed to parse run-time options!$Failed to pre-C7Dlwp4k embedded python interpreter!$Failed to set module search paths!$Failed to set program name!$Failed to set python home path!$Failed to set run-time options!$Failed to set sys.argv!$Failed to start embedded python interpreter!
API String ID: 2710203250-2440087815
Opcode ID: 4f236a89a7cd51b2b3fca8f5acd636a7ada8452e1d5d72af4d0157a058538f47
Instruction ID: 4a18029d0a3b4edc6e080692d3548aa969e7a30d8f3fd75af06c40f0977b054f
Opcode Fuzzy Hash: 4f236a89a7cd51b2b3fca8f5acd636a7ada8452e1d5d72af4d0157a058538f47
Instruction Fuzzy Hash: 64512B11E0C65391FA15AB2AA8511BDD364AF80BD4F440033EE7EC77E2EE2DE5268750

Function 00007FF6DFF716D0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 298
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6DFF78E40: free.MSVCRT ref: 00007FF6DFF78EA7
Part of subcall function 00007FF6DFF78E40: free.MSVCRT ref: 00007FF6DFF78EB4

Part of subcall function 00007FF6DFF72160: calloc.MSVCRT ref: 00007FF6DFF7216E

Part of subcall function 00007FF6DFF74420: GetModuleFileNameW.KERNEL32 ref: 00007FF6DFF74442

Part of subcall function 00007FF6DFF77C80: GetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77CAC

SetDllDirectoryW.KERNEL32 ref: 00007FF6DFF73D98
strcmp.MSVCRT ref: 00007FF6DFF73DC5
strcpy.MSVCRT ref: 00007FF6DFF73E0B

Part of subcall function 00007FF6DFF72250: strcpy.MSVCRT ref: 00007FF6DFF7231E

free.MSVCRT ref: 00007FF6DFF73CF5

Part of subcall function 00007FF6DFF77D70: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77D8B
Part of subcall function 00007FF6DFF77D70: free.MSVCRT ref: 00007FF6DFF77D96

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6DFF740BE
_MEIPASS2, xrefs: 00007FF6DFF73CAD
_PYI_ONEDIR_MODE, xrefs: 00007FF6DFF73CC8, 00007FF6DFF73CFA
Failed to convert DLL search path!, xrefs: 00007FF6DFF74110
Error opening archive IrNk6XIbAZ from executable (%s) or external archive (%s), xrefs: 00007FF6DFF74124

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$EnvironmentVariablestrcpy$DirectoryFileModuleNamecallocstrcmp
String ID: Cannot side-load external archive %s (code %d)!$Error opening archive IrNk6XIbAZ from executable (%s) or external archive (%s)$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2787634916-3664968274
Opcode ID: 8ab4ae117decd85d3be84a159dd5d500e8c4ae14a293ed636c4e2ffd3fd6aa2a
Instruction ID: 83aba9533eaca010ce55228cc880f2d050f975e536582eeb88061daeff42b67a
Opcode Fuzzy Hash: 8ab4ae117decd85d3be84a159dd5d500e8c4ae14a293ed636c4e2ffd3fd6aa2a
Instruction Fuzzy Hash: F6C19D21E1C64390FA54AF22A8112BED790AF44BC0F544533EE6EC77E6EE3CF5658641

Function 00007FF8A8631CF3 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8A86767BA
SetLastError.KERNEL32 ref: 00007FF8A86767C1
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A86768C7
BUF_MEM_grow.LIBCRYPTO-1_1 ref: 00007FF8A8676952
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8676999
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8676ABF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8676B12
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8A8676B20

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A86768B7, 00007FF8A8676989, 00007FF8A8676AAF, 00007FF8A8676B02

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: R_put_error$ErrorLastM_freeM_growR_clear_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 2562538362-2512360314
Opcode ID: 5a18f19eade6bbdf1c3fd5c0022a7e5d24853fc1c8443fcb9dd35289795e6565
Instruction ID: fceff6042176d1664acf0b111c8f85ad4faed97217ac9273ebe697cc24a611b4
Opcode Fuzzy Hash: 5a18f19eade6bbdf1c3fd5c0022a7e5d24853fc1c8443fcb9dd35289795e6565
Instruction Fuzzy Hash: 1DB1A2B2E0A242A6F7A49F25C44837937E1EB40BC8F146035DA4C47795DF3DE885CBA9

Function 61CDF680 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 455COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CDF723
free.MSVCRT ref: 61CDF7D1

Strings

src/pk/rsa/rsa_import.c, xrefs: 61CDFACA, 61CDFAE3, 61CDFAFC
in != NULL, xrefs: 61CDFB03
size > 0, xrefs: 61CDFD25
ltc_mp.name != NULL, xrefs: 61CDFAD1
ltc_mp.name != NULL, xrefs: 61CDFD0C
key != NULL, xrefs: 61CDFAEA
key != NULL, xrefs: 61CDFCF3
src/pk/rsa/rsa_make_key.c, xrefs: 61CDFCEC, 61CDFD05, 61CDFD1E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
API String ID: 306872129-2031961738
Opcode ID: 9aac367d4d9d0c17e2a34d24c83e6ff2f9d842589f5c903137b548d993848e72
Instruction ID: 609de8d0fdfe09d474ac4165902bd0003608ba447b1a147e163e670c47316bd2
Opcode Fuzzy Hash: 9aac367d4d9d0c17e2a34d24c83e6ff2f9d842589f5c903137b548d993848e72
Instruction Fuzzy Hash: C8122976608B81C6E760CF66E45478EBBA4F784BC8F048116EF8987B58EF79C495CB40

Function 61CDC540 Relevance: 14.7, APIs: 4, Strings: 5, Instructions: 1167COMMON

Download Yara Rule

Strings

d != NULL, xrefs: 61CDC68E, 61CDC73E, 61CDCE4E, 61CDD1BE
src/math/tfm_desc.c, xrefs: 61CDC554, 61CDC598, 61CDC5E7, 61CDC625, 61CDC687, 61CDC6A0, 61CDC6B9, 61CDC6D2, 61CDC737, 61CDC750, 61CDC769, 61CDC782, 61CDC7F1, 61CDC80A, 61CDCA49, 61CDCA62, 61CDCA9A, 61CDCAB3, 61CDCAF2, 61CDCB0B, 61CDCB24, 61CDCB5F, 61CDCB78, 61CDCB91, 61CDCBCF, 61CDCBE8, 61CDCC01, 61CDCC4C, 61CDCC65, 61CDCC9F, 61CDCCB8, 61CDCCD1, 61CDCD17, 61CDCD5A, 61CDCD73, 61CDCDC4, 61CDCDDD, 61CDCE47, 61CDCE60, 61CDCE79, 61CDCE92, 61CDCEC2, 61CDCEFA, 61CDCF13, 61CDCF5E, 61CDCFF7, 61CDD010, 61CDD077, 61CDD090, 61CDD0A9, 61CDD117, 61CDD130, 61CDD149, 61CDD1B7, 61CDD1D0, 61CDD1E9, 61CDD202, 61CDD23F, 61CDD258, 61CDD271, 61CDD2AF, 61CDD2C8, 61CDD2E1, 61CDD357, 61CDD370, 61CDD3C8, 61CDD3E1, 61CDD41A, 61CDD433, 61CDD46A, 61CDD483, 61CDD4BA, 61CDD4D3, 61CDD50A, 61CDD523, 61CDD55A, 61CDD573, 61CDD5A2, 61CDD5F8, 61CDD611, 61CDD668, 61CDD681, 61CDD6B5, 61CDD6E2, 61CDD712, 61CDD745, 61CDD7BD, 61CDD7D6
a != NULL, xrefs: 61CDC55B, 61CDC59F, 61CDC5EE, 61CDC62C, 61CDC6D9, 61CDC789, 61CDC7F8, 61CDCA69, 61CDCAA1, 61CDCAF9, 61CDCB66, 61CDCBD6, 61CDCC53, 61CDCCA6, 61CDCD1E, 61CDCD61, 61CDCDCB, 61CDCE99, 61CDCEC9, 61CDCF01, 61CDCF65, 61CDD017, 61CDD0B0, 61CDD150, 61CDD209, 61CDD246, 61CDD2B6, 61CDD377, 61CDD3E8, 61CDD421, 61CDD471, 61CDD4C1, 61CDD511, 61CDD561, 61CDD5A9, 61CDD618, 61CDD688, 61CDD6BC, 61CDD6E9, 61CDD719, 61CDD74C, 61CDD7C4, 61CDD7DD
b != NULL, xrefs: 61CDC6C0, 61CDC770, 61CDC811, 61CDCA50, 61CDCABA, 61CDCB2B, 61CDCB98, 61CDCC08, 61CDCC6C, 61CDCCD8, 61CDCD7A, 61CDCE80, 61CDCF1A, 61CDCFFE, 61CDD097, 61CDD137, 61CDD1F0, 61CDD278, 61CDD2E8, 61CDD3CF, 61CDD52A, 61CDD57A, 61CDD5FF, 61CDD66F
c != NULL, xrefs: 61CDC6A7, 61CDC757, 61CDCB12, 61CDCB7F, 61CDCBEF, 61CDCCBF, 61CDCDE4, 61CDCE67, 61CDD07E, 61CDD11E, 61CDD1D7, 61CDD25F, 61CDD2CF, 61CDD35E, 61CDD43A, 61CDD48A, 61CDD4DA

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID:
String ID: a != NULL$b != NULL$c != NULL$d != NULL$src/math/tfm_desc.c
API String ID: 0-1480740242
Opcode ID: 43a186c766ca1d2dbcd47a0f16d9229582f8bd80e7719955eb51f550f4e35b66
Instruction ID: 899ec6a48472be91919d6f2b3995c223f97fd7625b0174158b3a8ed20f2355d7
Opcode Fuzzy Hash: 43a186c766ca1d2dbcd47a0f16d9229582f8bd80e7719955eb51f550f4e35b66
Instruction Fuzzy Hash: 1692D574F12986C1FF05DBA5D8813FC6AA2EBA5784F84D519CA0E43690FB3EC256CB50

Function 00007FF8A8631B45 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 571COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A863C807
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A863C814
memcpy.VCRUNTIME140 ref: 00007FF8A863C857
memcpy.VCRUNTIME140 ref: 00007FF8A863C9FD

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A863C401, 00007FF8A863CB1A
SSL alert number , xrefs: 00007FF8A863CB4E

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: memcpy$O_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number
API String ID: 1692547093-34800109
Opcode ID: 3f7b08efb40acede6e7db4cb099754d1f20ad0c872ddb133913668b6976d7c20
Instruction ID: c18dde37f0cddeac1399a3514eec88209743532e30a1dcc91d3195569e0d7ead
Opcode Fuzzy Hash: 3f7b08efb40acede6e7db4cb099754d1f20ad0c872ddb133913668b6976d7c20
Instruction Fuzzy Hash: FD42DF32A0A782A6FA748F15D54837E76A0FB417D4F146135EB8E07B91CF3DE460A728

Function 00007FF6DFF76490 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF764AB
free.MSVCRT ref: 00007FF6DFF765BB

Strings

strict, xrefs: 00007FF6DFF764B0
_MEIPASS2, xrefs: 00007FF6DFF76492
utf-8, xrefs: 00007FF6DFF764B7
_MEIPASS, xrefs: 00007FF6DFF764E0
Module object for %s is NULL!, xrefs: 00007FF6DFF76586
Failed to get _MEIPASS as PyObject., xrefs: 00007FF6DFF765E9

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freestrlen
String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
API String ID: 322734593-568040347
Opcode ID: e2ab7b0680e4429b5e230e4caf005a74eeca196501d88c7380114935420e399f
Instruction ID: e8518395bc81662b837a93de50228821deddaa71410712a11e3d66e3c590b473
Opcode Fuzzy Hash: e2ab7b0680e4429b5e230e4caf005a74eeca196501d88c7380114935420e399f
Instruction Fuzzy Hash: 13417C62F09A46A1EE159F26E84447D6360BF49FD4B884177EE2E873A4DE3CE465D300

Function 61D3F9E3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114fileCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 61D3FACE
CreateFileMappingA.KERNEL32 ref: 61D3FB25
MapViewOfFile.KERNEL32 ref: 61D3FB51
CloseHandle.KERNEL32 ref: 61D3FB5D
GetLastError.KERNEL32 ref: 61D3FB68
_errno.MSVCRT ref: 61D3FB70

Strings

, xrefs: 61D3FAAC

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: File_errno$CloseCreateErrorHandleLastMappingView
String ID:
API String ID: 896588047-3916222277
Opcode ID: 34f910369a867b5564e74c5bc8bc86b68905e5fdacad7ef74a30051b781ed1dd
Instruction ID: bd968f805c8a8168607a62bb61df2966df0892bc66a5b11bb4c51e1a41d9b54d
Opcode Fuzzy Hash: 34f910369a867b5564e74c5bc8bc86b68905e5fdacad7ef74a30051b781ed1dd
Instruction Fuzzy Hash: B941CEBB20D6D09ED312CB649CA174D3FA4BB8AB54F09C346DFA483391D72CA4A5D302

Function 00007FF8A8631497 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A863D01A
memcpy.VCRUNTIME140 ref: 00007FF8A863D079
SetLastError.KERNEL32 ref: 00007FF8A863D175
BIO_read.LIBCRYPTO-1_1 ref: 00007FF8A863D198

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A863D125, 00007FF8A863D210

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: memcpy$ErrorLastO_read
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1958097105-2209325370
Opcode ID: 83668bf32006c5783a5dc4ffc212bfc49eadf443eaa9813d3b7cb11514e49313
Instruction ID: dcdd3f11ef427e661a982f7764e7f86b80271362c32bdff915637659fbc1eccb
Opcode Fuzzy Hash: 83668bf32006c5783a5dc4ffc212bfc49eadf443eaa9813d3b7cb11514e49313
Instruction Fuzzy Hash: 5E81A172A0AA8592FB519E25D4487B92BA5FB00FC8F145136DE8C0BB88DF39D446C368

Function 00007FF8A8676290 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-1_1(?,?,?,00000000,?,-00000031,00007FF8A8676A4D), ref: 00007FF8A8676431

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A867652B, 00007FF8A86765F4

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: M_grow_clean
String ID: ..\s\ssl\statem\statem.c
API String ID: 964628749-2512360314
Opcode ID: 7a77c42f21e6545b3253a2a35eacc0d4b118e17c4845b2e3276a665ed4b67177
Instruction ID: 4bfd51b398c7f580ae0b699e582d8192f9fa52f54fcfdfd6451d524aecf8cce3
Opcode Fuzzy Hash: 7a77c42f21e6545b3253a2a35eacc0d4b118e17c4845b2e3276a665ed4b67177
Instruction Fuzzy Hash: 48A1C1B2A0A682A5FB61CF25D4483B93BA0FB44BC8F446135CA4E47798CF7DE485C764

Function 00007FF8A8657120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8657159
ASYNC_get_current_job.LIBCRYPTO-1_1 ref: 00007FF8A86571A6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A8657140

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: C_get_current_jobR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4281227279-1080266419
Opcode ID: 8cd2e79bd01e4c605c840c68644f3601f27a72c746b1b2c873290dc5c8e684b8
Instruction ID: 73d8f6cdcd5b124b1c2848a09bf7dc2ef7cb712736aba24e525426bf03d73638
Opcode Fuzzy Hash: 8cd2e79bd01e4c605c840c68644f3601f27a72c746b1b2c873290dc5c8e684b8
Instruction Fuzzy Hash: 42219032B0A64296FB54DF25E5092AD33A0EF88BC4F483131EE4D47785EF3CE5558A28

Function 00007FF6DFF78A10 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6DFF78A2E
free.MSVCRT ref: 00007FF6DFF78B05

Strings

_MEIPASS2, xrefs: 00007FF6DFF78A14

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freemalloc
String ID: _MEIPASS2
API String ID: 3061335427-3944641314
Opcode ID: 30bea74480df5144b0e88ebe706ce1ab35208d2e40c2af47dddbd5c4f15bae86
Instruction ID: bd066e40b249c5803f80c6c65fa401b7f2a4824d1a5a8010002be6c37174075a
Opcode Fuzzy Hash: 30bea74480df5144b0e88ebe706ce1ab35208d2e40c2af47dddbd5c4f15bae86
Instruction Fuzzy Hash: F521F152F0915210FE109A2799197FECB41AF45BC8F984832DE1D8B392EE3CE152C200

Function 00007FF6DFF72250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF6DFF7231E

Strings

pyi-contents-directory option not found in onedir bundle archive!, xrefs: 00007FF6DFF72338
pyi-contents-directory, xrefs: 00007FF6DFF722CB

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strcpy
String ID: pyi-contents-directory$pyi-contents-directory option not found in onedir bundle archive!
API String ID: 3177657795-1958350669
Opcode ID: 144c37537c1f78c3223557a0433869cfc476ad927a52626deb4d2883448216f2
Instruction ID: 98332f0639dfc2f6523e0c0d467c83d8dbd001778be503606b5d6fd081819779
Opcode Fuzzy Hash: 144c37537c1f78c3223557a0433869cfc476ad927a52626deb4d2883448216f2
Instruction Fuzzy Hash: FC218E51F0868394FB61AA62AC053FD9340AF54BC4F844033ED2DC77DAEE6CE62AC650

Function 00007FF6DFF76E70 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF76E7E

Strings

Cannot allocate memory for SPLASH_STATUS., xrefs: 00007FF6DFF76E8D
calloc, xrefs: 00007FF6DFF76E94

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: calloc
String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
API String ID: 2635317215-799113134
Opcode ID: 942f8fe5890305979e7b23bd6c61b12b378b7291ddffaf8757f4366481b4c106
Instruction ID: 167647614fc9035ebad04c5e0a32e68d695ae085befdb3ef582847a3ffa897c2
Opcode Fuzzy Hash: 942f8fe5890305979e7b23bd6c61b12b378b7291ddffaf8757f4366481b4c106
Instruction Fuzzy Hash: A7E0ECA1F08A0780EA245711E4511AE5761DB84344F940437DA6D877A5EE2CE5318754

Function 00007FF8A8676D40 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,?,00007FF8A8676A65), ref: 00007FF8A86770C8

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A86770B7

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 1767461275-2512360314
Opcode ID: bd53e6fc818244c25e435d994b3a884f1f165cbe6141e99f021bcfac66b9e287
Instruction ID: 322704e6ecccebb6c1d0a96a7b90010b68c14f23b19a06ad3d2fc57ebd0ae7dd
Opcode Fuzzy Hash: bd53e6fc818244c25e435d994b3a884f1f165cbe6141e99f021bcfac66b9e287
Instruction Fuzzy Hash: AF91C3B2A19642A6FB60DF25D4583BC37A1FB40BC8F042136DA4D47694CF3DE944CB68

Function 00007FF8A8676668 Relevance: 3.3, APIs: 2, Instructions: 316COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8A86767BA
SetLastError.KERNEL32 ref: 00007FF8A86767C1
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8A8676B20

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: d91c353022e18e8c7fba8ab01a5b39995b184d47e2ab8ef492f61c0125e03bd4
Instruction ID: 4138a9249bfb3fed9b200daed7242eca4332af539f17e8c852477d66ca2e68fc
Opcode Fuzzy Hash: d91c353022e18e8c7fba8ab01a5b39995b184d47e2ab8ef492f61c0125e03bd4
Instruction Fuzzy Hash: 2121C0B2E0A602E6F7A48E25944933D3790EF41FC4F24A434DA4C57285DF38E891C7B9

Function 00007FF8A8675F80 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8A86767BA
SetLastError.KERNEL32 ref: 00007FF8A86767C1
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8A8676B20

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: dd87c8fa57a67f30e78edd1cda4d61b8500bc7ecdac66fbb42d91985a94daee1
Instruction ID: 8028278e0b535b06505f52dbeaea7a4e85154ff3696c755e665fd7aa4d67c65f
Opcode Fuzzy Hash: dd87c8fa57a67f30e78edd1cda4d61b8500bc7ecdac66fbb42d91985a94daee1
Instruction Fuzzy Hash: 62218EB2E0A602A6F7A49F25844937D37A1EF41FC4F14A034EA4D56285DF38E891C7B9

Function 00007FF6DFF7FEF0 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fsetpos.MSVCRT ref: 00007FF6DFF7FF95

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fsetpos
String ID:
API String ID: 850078086-0
Opcode ID: 494cfbfd0869b4bd86ec742704f25e9796c654e056705adcf2f762cf5b6a1ee1
Instruction ID: ba8272c1e2f4161f1bfb219e5db670d3cf4165b3be4ac2ab6d83ee38dc78ba83
Opcode Fuzzy Hash: 494cfbfd0869b4bd86ec742704f25e9796c654e056705adcf2f762cf5b6a1ee1
Instruction Fuzzy Hash: 32115CB2E05B829AEB209F7584411EC67A1EB0979CF504A36EA7D877D9DF38D070C280

Function 00007FF6DFF78610 Relevance: 3.0, APIs: 2, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

LoadLibraryExW.KERNEL32 ref: 00007FF6DFF78631
free.MSVCRT ref: 00007FF6DFF7863D

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWidefree
String ID:
API String ID: 3231889924-0
Opcode ID: 025484cb09e70cc9f28b378bb3fad4c85954a6dd3767711329c1eeef3697bfbd
Instruction ID: 1becf51a574c79328afd0e6a6a1c8b2f2345e4952dcaffc89dc4e92d28d4d4a0
Opcode Fuzzy Hash: 025484cb09e70cc9f28b378bb3fad4c85954a6dd3767711329c1eeef3697bfbd
Instruction Fuzzy Hash: D8D05E11F2A1B601FEE8B77B2C1A6AE46411F89FD4E98D435DC1E87B42ED2DD5928700

Function 00007FF6DFF7FDAB Relevance: 2.6, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF7FBC0: wcslen.MSVCRT ref: 00007FF6DFF7FBF6

free.MSVCRT ref: 00007FF6DFF7FDEF
memset.MSVCRT ref: 00007FF6DFF7FE0C

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: freememsetwcslen
String ID:
API String ID: 2332356550-0
Opcode ID: e88c4608d201782b6472b1c03b40e46fee2dc1c91fef45b03c45720059a672e0
Instruction ID: e4d162cb836cd76cdf3d0085fbfe1ff703bbc7296ca6173950c48b4b4476b6f8
Opcode Fuzzy Hash: e88c4608d201782b6472b1c03b40e46fee2dc1c91fef45b03c45720059a672e0
Instruction Fuzzy Hash: 8331C866F04B1489EB10CF7AD48109C3BB1FB58BA8B108526EE5C57B68EF34C5A1C790

Function 00007FF8A8631E33 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A8648F03

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: c1da98bc727de0285aaba979841360076624c623f116a6a3bfa264bbc0fd5706
Instruction ID: 6b86145ea67d940744124c3fe80ccf9101cc609d311138f69a711846bb7ccb1b
Opcode Fuzzy Hash: c1da98bc727de0285aaba979841360076624c623f116a6a3bfa264bbc0fd5706
Instruction Fuzzy Hash: 1931BF32708B8586E7908F65E444BED77A0F789B88F085136EF9C4BB49CF79C1958B24

Function 61D410F0 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 61D4112E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 531dd30f406ed16142e4044d0df50ffebc8c0c5486a1135a9399a8d773c52e95
Instruction ID: 49a2cc5055a7411c2625e3138c7ff33fbac87888a2d8349746646227ad33327b
Opcode Fuzzy Hash: 531dd30f406ed16142e4044d0df50ffebc8c0c5486a1135a9399a8d773c52e95
Instruction Fuzzy Hash: 68F01C703B6134C5FE3147A9DA00F5439715707B91E58D3069DA41ABE4D55BE2A58F02

Function 00007FF8A8676130 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A8676166

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: R_put_error
String ID:
API String ID: 1767461275-0
Opcode ID: 4f48c1642cd8e079b41de6a7940bea788ae535b90593227ebd844b7e21ca7648
Instruction ID: 31f478486f5d3807ec830623910cf0aab1ad04ecf3df69b539a024569ff0da3d
Opcode Fuzzy Hash: 4f48c1642cd8e079b41de6a7940bea788ae535b90593227ebd844b7e21ca7648
Instruction Fuzzy Hash: 0101D172A1924186F7A48E6DD40C36977A0EB84BCCF141035EE58437EACB3DD884CB54

Function 00007FF6DFF744D0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

_wfopen.MSVCRT ref: 00007FF6DFF74515

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide_wfopen
String ID:
API String ID: 372205238-0
Opcode ID: 460021445462d38f751c38bff17167d13b53ccdfd410499e5b587a202733885b
Instruction ID: 9d83d13d86bbd2136fd3f6e93965e452c138be5e61d9ed3a67b67243d88186e1
Opcode Fuzzy Hash: 460021445462d38f751c38bff17167d13b53ccdfd410499e5b587a202733885b
Instruction Fuzzy Hash: 51E09A91B0825001FA246216AA047EE8312AF4AFC4E408032EE1C9BB8ACE2CD2638708

Function 00007FF8A8631C53 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A8676D06

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 1c3f39584990be4e739d6b1426a93424ac52aed5e56eaee72e8e1012d233033e
Instruction ID: d0d3ecb254281e3771ee16957239cc04bdae72e32e2bb7c8defc9b23918dfc12
Opcode Fuzzy Hash: 1c3f39584990be4e739d6b1426a93424ac52aed5e56eaee72e8e1012d233033e
Instruction Fuzzy Hash: 24E041F2F1550256F7505775944B7642650DB48754F642030DE0CC6682E75DD9D34658

Function 00007FF8A86E2B53 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 00007FF8A88D753F

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 0f56840c3668eef90e64ac72c1166a1ce6f4bd6752172c29d911233d513c3bc9
Instruction ID: dc7ab491fd5a805add40d87b39446a2e945bb5cbee881f4bd4425d70391c793c
Opcode Fuzzy Hash: 0f56840c3668eef90e64ac72c1166a1ce6f4bd6752172c29d911233d513c3bc9
Instruction Fuzzy Hash: 3EC01225F0700257F7482338A85616D11509F48350FD04034F00EC2AA0FE0CA8599B19

Function 61D3E130 Relevance: 1.5, APIs: 1, Instructions: 213COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 61D3E3D2

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: e171eb12b2caf9bff91b63673bff23f6913cf624baee4941fd5105bb93664278
Instruction ID: f784ed66063ed990e3e2136b6c142df3ed9a6f4840c3b9a9751c8a3f0f056d61
Opcode Fuzzy Hash: e171eb12b2caf9bff91b63673bff23f6913cf624baee4941fd5105bb93664278
Instruction Fuzzy Hash: D4918BB2605BA4C5EB558F66D05035D3BA0E78AFDCF18821ACE99173E8DB38C895C390

Function 00007FF6DFF7D7E0 Relevance: 1.3, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DFF7D89A

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 4a3cd53f5ab6c9f56d3a5cf8db0897558940d4d2ad38b878033855946d3f594a
Instruction ID: 56a6df174f2534fca10e9255a24ee1bc4e19a63f972ccb56a52b0519f40624f3
Opcode Fuzzy Hash: 4a3cd53f5ab6c9f56d3a5cf8db0897558940d4d2ad38b878033855946d3f594a
Instruction Fuzzy Hash: 65311726F0471599FB108BA6D4403BC77B0A704B88F94407ADEAC97B98DF3CD6A9C714

Function 61D3E5B0 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,00000000,?,61D21420,00000000,?,?,61CD4366,?,?,?,?,?,?), ref: 61D3E5BF

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 7a769ee3dffd10594c224eb626ffee38f5d175eb6511ca44a6aa877a12a9c7a8
Instruction ID: 69379a310f6d85bf6c6fb9f9e9f1839c0d20d3465fcf03863d076b89338053ad
Opcode Fuzzy Hash: 7a769ee3dffd10594c224eb626ffee38f5d175eb6511ca44a6aa877a12a9c7a8
Instruction Fuzzy Hash: 3CD01266BC7A5581D50D9B573C402D895A6675EBE0E4CC4348E8E97315EC3864A74300

Function 61D3E630 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 61D3E640

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b49b276dedcc1e6ac4234f2e8d46d4c294a95776399f1bbabf67ed100b30ae7a
Instruction ID: 579e8cea84a983d79f117e7539c4e9901fe74169e478221f1cdee3ca71adba95
Opcode Fuzzy Hash: b49b276dedcc1e6ac4234f2e8d46d4c294a95776399f1bbabf67ed100b30ae7a
Instruction Fuzzy Hash: DBC08CB6A03A00C1FF094BE2F8613382260AB9CF05F1C4010CE5A46341EB3C40A08B10

Non-executed Functions

Function 61CD4D70 Relevance: 63.4, APIs: 30, Strings: 6, Instructions: 406memorystringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 61CD4E39
GetProcessHeap.KERNEL32 ref: 61CD4E74
HeapAlloc.KERNEL32 ref: 61CD4E89
GetAdaptersAddresses.IPHLPAPI ref: 61CD4EB9
strlen.MSVCRT ref: 61CD4EE7
GetProcessHeap.KERNEL32 ref: 61CD4F0B
HeapFree.KERNEL32 ref: 61CD4F16
malloc.MSVCRT ref: 61CD4FA2

Strings

Characteristics, xrefs: 61CD540E
NetCfgInstanceId, xrefs: 61CD53B4
01234567, xrefs: 61CD4DCC
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}, xrefs: 61CD52CE
89abcdef, xrefs: 61CD4DDE
:[sc, xrefs: 61CD4DB9

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocComputerFreeNamemallocstrlen
String ID: 01234567$89abcdef$:[sc$Characteristics$NetCfgInstanceId$SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
API String ID: 1478035857-3618987999
Opcode ID: 3a5f10f7657aafadba48855465c7c90e5ff1ab9a9f6775dcfbda5b5a3797d017
Instruction ID: 6491474c83145bd9c355d392bf11ada9e445aa2df75e57f336940f3b3487cd00
Opcode Fuzzy Hash: 3a5f10f7657aafadba48855465c7c90e5ff1ab9a9f6775dcfbda5b5a3797d017
Instruction Fuzzy Hash: 8EF16D72719781C6E720CB66A850B9FBBA5F785B84F888129DF8947B58EF3DC005CB50

Function 61CC9C10 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 477COMMON

Download Yara Rule

APIs

PyList_Append.PYTHON310 ref: 61CC9C35
PyErr_Occurred.PYTHON310 ref: 61CCA0F8
PyErr_SetString.PYTHON310 ref: 61CCAFA6

Strings

EOF read where object expected, xrefs: 61CCB4FD
bad marshal data (index list too large), xrefs: 61CCAF99

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$AppendList_OccurredString
String ID: EOF read where object expected$bad marshal data (index list too large)
API String ID: 2605687773-1134984
Opcode ID: 24328e07c6b711e09adfeec3f75ff8ec5d1008f7abd984826023d49cddbf1295
Instruction ID: b1055ea72862ef913e12f6f119b4536f450b2bb93a29d0d5af9bef55230b0d15
Opcode Fuzzy Hash: 24328e07c6b711e09adfeec3f75ff8ec5d1008f7abd984826023d49cddbf1295
Instruction Fuzzy Hash: DB12643220AB90C5EA648FA6E55879EB7A1F785FC8F09C416CA9D47B18FF39C854C701

Function 00007FF6DFF77DB0 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 188COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6DFF77E11
free.MSVCRT ref: 00007FF6DFF77E1C

Part of subcall function 00007FF6DFF79280: wcslen.MSVCRT ref: 00007FF6DFF79289

_wfullpath.MSVCRT ref: 00007FF6DFF77E44
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77EAD
wcschr.MSVCRT(?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77EB8
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77ECA
_wputenv_s.MSVCRT ref: 00007FF6DFF77ED6
free.MSVCRT ref: 00007FF6DFF77EE1
GetTempPathW.KERNEL32 ref: 00007FF6DFF77EFB
_getpid.MSVCRT(?,?,_MEIPASS2,00000000,?,00007FF6DFF723DC), ref: 00007FF6DFF77F01
_wtempnam.MSVCRT ref: 00007FF6DFF77F2A
free.MSVCRT ref: 00007FF6DFF77F3F
free.MSVCRT ref: 00007FF6DFF77F69

Part of subcall function 00007FF6DFF77C80: GetEnvironmentVariableW.KERNEL32 ref: 00007FF6DFF77CAC

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

_wcsdup.MSVCRT ref: 00007FF6DFF77F8B

Strings

_MEI%d, xrefs: 00007FF6DFF77F06
TMP, xrefs: 00007FF6DFF77ECC
_MEIPASS2, xrefs: 00007FF6DFF77DB9
TMP, xrefs: 00007FF6DFF77DD8, 00007FF6DFF77F57, 00007FF6DFF77FDF, 00007FF6DFF78005, 00007FF6DFF78087
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6DFF78030
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6DFF78048
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6DFF78071
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6DFF78060

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$CreateDirectoryEnvironment$ByteCharExpandMultiPathStringsTempVariableWide_getpid_wcsdup_wfullpath_wputenv_s_wtempnamwcschrwcslen
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d$_MEIPASS2
API String ID: 2274789544-3119237222
Opcode ID: 3365566f51a541132fa0856e1823789bb9b7212fc1a85a05e25b1d125dbfa748
Instruction ID: c271e22c152e286cb6793e196d0d99da6559543f42e01823f082908f65814ba2
Opcode Fuzzy Hash: 3365566f51a541132fa0856e1823789bb9b7212fc1a85a05e25b1d125dbfa748
Instruction Fuzzy Hash: 7861AB52F1D64240FA64AB23A9112FE8391AF49BC4F948437EC3EC77C6EE2CE425C240

Function 00007FF6DFF72620 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF6DFF72653
MulDiv.KERNEL32 ref: 00007FF6DFF72670
MulDiv.KERNEL32 ref: 00007FF6DFF72689
SystemParametersInfoW.USER32 ref: 00007FF6DFF726CF
LoadIconMetric.COMCTL32 ref: 00007FF6DFF72703
CreateWindowExW.USER32 ref: 00007FF6DFF72761
CreateWindowExW.USER32 ref: 00007FF6DFF727BB
CreateWindowExW.USER32 ref: 00007FF6DFF7281C
CreateWindowExW.USER32 ref: 00007FF6DFF7287E
SendMessageW.USER32 ref: 00007FF6DFF728A1
SendMessageW.USER32 ref: 00007FF6DFF728B9
SendMessageW.USER32 ref: 00007FF6DFF728D4
SendMessageW.USER32 ref: 00007FF6DFF728F1
SendMessageW.USER32 ref: 00007FF6DFF7290C
SendMessageW.USER32 ref: 00007FF6DFF72927
SendMessageW.USER32 ref: 00007FF6DFF72942
SendMessageW.USER32 ref: 00007FF6DFF72956
SendMessageW.USER32 ref: 00007FF6DFF7296B
GetClientRect.USER32 ref: 00007FF6DFF72976
CreateFontIndirectW.GDI32 ref: 00007FF6DFF72998

Strings

Failed to gA7WkD6n script '%ls' due to unhandled exception: %ls, xrefs: 00007FF6DFF7262B
EDIT, xrefs: 00007FF6DFF727D2
STATIC, xrefs: 00007FF6DFF726FC
, xrefs: 00007FF6DFF726BD
BUTTON, xrefs: 00007FF6DFF72834
Close, xrefs: 00007FF6DFF72824

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
String ID: $BUTTON$Close$EDIT$Failed to gA7WkD6n script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 3223904152-4231048771
Opcode ID: 9bcbd0ae487ad773c65203090edb47d8bd9997bfcb6fad77826f5d4dd51fc8b3
Instruction ID: 8e7fd147aa934e340fdcd12f58400c19a9af17fdac0fa8d24d1412b84572e900
Opcode Fuzzy Hash: 9bcbd0ae487ad773c65203090edb47d8bd9997bfcb6fad77826f5d4dd51fc8b3
Instruction Fuzzy Hash: 2E91AB76218B9082E7608F61E45479E7760F788B98F24413AEE8C4BB99CF7EC085CB50

Function 00007FF8A864C910 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A864C93C
X509_STORE_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A864C971
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A864C999
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A864C9BF
X509_STORE_CTX_init.LIBCRYPTO-1_1 ref: 00007FF8A864C9D0
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A864C9F4
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A864C9FC
X509_STORE_CTX_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A864CA35
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A864CA48
X509_STORE_CTX_set_ex_data.LIBCRYPTO-1_1 ref: 00007FF8A864CA6D
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A864CA8D
X509_STORE_CTX_set0_dane.LIBCRYPTO-1_1 ref: 00007FF8A864CA9C
X509_STORE_CTX_set_default.LIBCRYPTO-1_1 ref: 00007FF8A864CAB9
X509_VERIFY_PARAM_set1.LIBCRYPTO-1_1 ref: 00007FF8A864CAC8
X509_STORE_CTX_set_verify_cb.LIBCRYPTO-1_1 ref: 00007FF8A864CADC
X509_verify_cert.LIBCRYPTO-1_1 ref: 00007FF8A864CB02
X509_STORE_CTX_get_error.LIBCRYPTO-1_1 ref: 00007FF8A864CB0C
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A864CB25
X509_STORE_CTX_get0_chain.LIBCRYPTO-1_1 ref: 00007FF8A864CB38
X509_STORE_CTX_get1_chain.LIBCRYPTO-1_1 ref: 00007FF8A864CB45
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A864CB71
X509_VERIFY_PARAM_move_peername.LIBCRYPTO-1_1 ref: 00007FF8A864CB82
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A864CB8A

Strings

ssl_server, xrefs: 00007FF8A864CAAB
ssl_client, xrefs: 00007FF8A864CAA4
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A864C97E, 00007FF8A864C9D9, 00007FF8A864CB56

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: X509_$R_put_error$L_sk_numX_free$D_run_onceL_sk_pop_freeL_sk_valueM_move_peernameM_set1X509_verify_certX_get0_chainX_get1_chainX_get_errorX_initX_newX_set0_daneX_set_defaultX_set_ex_dataX_set_flagsX_set_verify_cb
String ID: ..\s\ssl\ssl_cert.c$ssl_client$ssl_server
API String ID: 4052934069-2466788060
Opcode ID: 559dd0a72a5e0bb964254e27a7f39a778eebb142006f13fbcb3aac166a5fa4f6
Instruction ID: 8334f1086c6c44e61119d264708a6219fc73311aa9d3ea0425879ec39d636dee
Opcode Fuzzy Hash: 559dd0a72a5e0bb964254e27a7f39a778eebb142006f13fbcb3aac166a5fa4f6
Instruction Fuzzy Hash: A4618565B0AA42A1FA84EF2196483BD7B51EF85BC4F446035DE0D4B7D6EF3CE5018728

Function 61CC38D6 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 418stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CC3989
free.MSVCRT ref: 61CC399E
malloc.MSVCRT ref: 61CC39AA
memcpy.MSVCRT ref: 61CC39CC
_Py_Dealloc.PYTHON310 ref: 61CC39F2

Strings

%s (%d:%d), xrefs: 61CC3D9F, 61CC3E26, 61CC3E8B, 61CC3F51, 61CC42AB
N+, xrefs: 61CC429D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Deallocfreemallocmemcpystrcmp
String ID: %s (%d:%d)$N+
API String ID: 2421945241-2748867177
Opcode ID: 7d6618ac22768b21cf684f78b8b3511db59920d27abd0f05e378ec20e4bc5ec3
Instruction ID: 5510d666008df7f4d7c7d1bb4af7b2f10f6af2a4a66d97486628d2a00c8bcdc3
Opcode Fuzzy Hash: 7d6618ac22768b21cf684f78b8b3511db59920d27abd0f05e378ec20e4bc5ec3
Instruction Fuzzy Hash: 7EF1BC72745680C6EB11CF6AE49039D3B71FB86F98F48C212DAA90B794EF39C951C712

Function 61CC2C80 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 282librarystringloaderCOMMON

Download Yara Rule

APIs

PyEval_GetGlobals.PYTHON310 ref: 61CC2CE4
PyFunction_NewWithQualName.PYTHON310 ref: 61CC2CF3
_PyObject_CallFunction_SizeT.PYTHON310 ref: 61CC2D2F
_Py_Dealloc.PYTHON310 ref: 61CC2D71
PyErr_Format.PYTHON310 ref: 61CC2E4A
GetProcAddress.KERNEL32 ref: 61CC2E6A
strlen.MSVCRT ref: 61CC2E82
PyErr_Format.PYTHON310 ref: 61CC3147

Part of subcall function 61CCEFA0: PyList_New.PYTHON310 ref: 61CCEFDB
Part of subcall function 61CCEFA0: PyErr_Occurred.PYTHON310 ref: 61CCEFFA
Part of subcall function 61CCEFA0: PyMem_Free.PYTHON310 ref: 61CCF028

_Py_Dealloc.PYTHON310 ref: 61CC2F99
_Py_Dealloc.PYTHON310 ref: 61CC2FAD
_Py_Dealloc.PYTHON310 ref: 61CC2FD9
_Py_Dealloc.PYTHON310 ref: 61CC3003
_Py_Dealloc.PYTHON310 ref: 61CC3013

Strings

%s (%d:%d), xrefs: 61CC2E43, 61CC3071, 61CC30D6, 61CC3140
lf/exe, xrefs: 61CC2DB2
z(, xrefs: 61CC30C8
/proc/se, xrefs: 61CC2DA0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dealloc$Err_$FormatFunction_$AddressCallEval_FreeGlobalsList_Mem_NameObject_OccurredProcQualSizeWithstrlen
String ID: %s (%d:%d)$/proc/se$lf/exe$z(
API String ID: 3243918594-3850701646
Opcode ID: 7776b01a49bd029e22bb9d8f954f20ffe382dd5cac6ebb045be2ef1bcec11073
Instruction ID: f0ad8feda5caa367e13daa0971a1e9a3d8c529ec0b4f756997c05da0c0ca0b73
Opcode Fuzzy Hash: 7776b01a49bd029e22bb9d8f954f20ffe382dd5cac6ebb045be2ef1bcec11073
Instruction Fuzzy Hash: 7BB1AB71341B84D5EA10CBAAE89439D3772F78AF85F489116CD5E0B7A4EF2EC912C742

Function 61CD2640 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 61CD268C
CreateFileA.KERNEL32 ref: 61CD26C0
GlobalAlloc.KERNEL32 ref: 61CD26DA
DeviceIoControl.KERNEL32 ref: 61CD2754
GlobalFree.KERNEL32 ref: 61CD276A
_snprintf.MSVCRT ref: 61CD27A7
CreateFileA.KERNEL32 ref: 61CD27D4
GlobalAlloc.KERNEL32 ref: 61CD27F5
GlobalAlloc.KERNEL32 ref: 61CD2804
DeviceIoControl.KERNEL32 ref: 61CD284C
GlobalFree.KERNEL32 ref: 61CD2865
GlobalFree.KERNEL32 ref: 61CD286A
CloseHandle.KERNEL32 ref: 61CD2874
GlobalFree.KERNEL32 ref: 61CD2896

Part of subcall function 61CD22F0: GetLastError.KERNEL32 ref: 61CD22F4
Part of subcall function 61CD22F0: FormatMessageA.KERNEL32 ref: 61CD2325
Part of subcall function 61CD22F0: LocalFree.KERNEL32 ref: 61CD2346

Strings

\\.\Scsi%d, xrefs: 61CD2655
\\.\PhysicalDrive%d, xrefs: 61CD279B
../src/platforms/windows/hdinfo.c, xrefs: 61CD2777
Empty serial number, xrefs: 61CD2770
SCSIDISK, xrefs: 61CD2704
/%d:, xrefs: 61CD2646

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c$/%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d
API String ID: 1119308327-3953537554
Opcode ID: 70db97bde88c69948421bc1cd1e860fd79147349a12ec31b0888bd7bc928a58f
Instruction ID: 21e4970575025d9aa39d98909109ebc45a695a6b72518b8b41b452e2cab31fbe
Opcode Fuzzy Hash: 70db97bde88c69948421bc1cd1e860fd79147349a12ec31b0888bd7bc928a58f
Instruction Fuzzy Hash: 1351D33130068596E720DB62FC6478A7B91F788BE8F488225AE5E07BD4DF3DC506C784

Function 61CD3800 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 149networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 61CD385F
gethostbyname.WS2_32 ref: 61CD3870
socket.WS2_32 ref: 61CD389D
setsockopt.WS2_32 ref: 61CD38D5
setsockopt.WS2_32 ref: 61CD38F8
htons.WS2_32 ref: 61CD391B
sendto.WS2_32 ref: 61CD3999
recvfrom.WS2_32 ref: 61CD39DE
ntohl.WS2_32 ref: 61CD39FF
ntohl.WS2_32 ref: 61CD3A09
closesocket.WS2_32 ref: 61CD3A2E
WSACleanup.WS2_32 ref: 61CD3A34
WSAGetLastError.WS2_32 ref: 61CD3A40
closesocket.WS2_32 ref: 61CD3A4B
WSACleanup.WS2_32 ref: 61CD3A51
SetLastError.KERNEL32 ref: 61CD3A60
WSAGetLastError.WS2_32 ref: 61CD3A80
WSACleanup.WS2_32 ref: 61CD3A88
SetLastError.KERNEL32 ref: 61CD3A97

Strings

http://, xrefs: 61CD3805
or,, xrefs: 61CD3802
and,, xrefs: 61CD3807

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ErrorLast$Cleanup$closesocketntohlsetsockopt$Startupgethostbynamehtonsrecvfromsendtosocket
String ID: and,$http://$or,
API String ID: 1750001962-2642771825
Opcode ID: c8e321f5ef4eb657ba943f47a9e848e34e07c68d11a51ef849309d8966b1429c
Instruction ID: 004422543741b98f5e731b6c41bdd79f6004794685c4370b8ba3d20e1a4d16f3
Opcode Fuzzy Hash: c8e321f5ef4eb657ba943f47a9e848e34e07c68d11a51ef849309d8966b1429c
Instruction Fuzzy Hash: 37516A32B05B8096E710CB65F81435AB7A1F789BB4F184329EAAD47BE4EB7DC445CB40

Function 61CC9A50 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9A61
_PyLong_New.PYTHON310 ref: 61CC9A94
PyErr_Occurred.PYTHON310 ref: 61CC9AEF
PyErr_Occurred.PYTHON310 ref: 61CC9B37
PyErr_Occurred.PYTHON310 ref: 61CC9B5C
_PyLong_New.PYTHON310 ref: 61CCA555
PyErr_Occurred.PYTHON310 ref: 61CCA88F
PyErr_Occurred.PYTHON310 ref: 61CCA8B2
_Py_Dealloc.PYTHON310 ref: 61CCADA6
PyErr_SetString.PYTHON310 ref: 61CCADC0
PyErr_SetString.PYTHON310 ref: 61CCAEC0

Strings

bad marshal data (long size out of range), xrefs: 61CCAEB3
bad marshal data (digit out of range in long), xrefs: 61CCADB3
bad marshal data (unnormalized long data), xrefs: 61CCAF78

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Occurred$Long_String$Dealloc
String ID: bad marshal data (digit out of range in long)$bad marshal data (long size out of range)$bad marshal data (unnormalized long data)
API String ID: 3848820501-2912230410
Opcode ID: 6d20ad8110112b538d0e355b395b7314ade5b59fd9d8ad14f655acca4bf87ef2
Instruction ID: be011a40f78d45a7ba3dc285d12210f0c40ef1a4fe043d249f9a01541dbd1977
Opcode Fuzzy Hash: 6d20ad8110112b538d0e355b395b7314ade5b59fd9d8ad14f655acca4bf87ef2
Instruction Fuzzy Hash: B1614A31645651C6EA05CFA6C45CB6F3BA2FB86F88F0AD510C90A07724FF39D84AC386

Function 61CD0FC2 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD0FFB

Strings

exception causes must derive from BaseException, xrefs: 61CD105A
exceptions must derive from BaseException, xrefs: 61CD0FF1
calling %R should have returned an instance of BaseException, not %R, xrefs: 61CD127A

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_String
String ID: calling %R should have returned an instance of BaseException, not %R$exception causes must derive from BaseException$exceptions must derive from BaseException
API String ID: 1450464846-2865718950
Opcode ID: 1ad5de58b9e0abd037f4507d06af2914c7edbde7597750aca410e29d04165ed7
Instruction ID: 6a5eb37c363b1f478ab9af322c4dea44f4ccb9495f4aef2088e181f758bd7ec1
Opcode Fuzzy Hash: 1ad5de58b9e0abd037f4507d06af2914c7edbde7597750aca410e29d04165ed7
Instruction Fuzzy Hash: 7F614C72B45A84D6EB459FAAA95479E37B1A786FD4F0C8021CF4947B24EF3AC064C340

Function 61CD29F0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 61CD2A15
wsprintfA.USER32 ref: 61CD2A27
CreateFileA.KERNEL32 ref: 61CD2A54
memset.MSVCRT ref: 61CD2A93
DeviceIoControl.KERNEL32 ref: 61CD2AC9
CloseHandle.KERNEL32 ref: 61CD2AD6
isxdigit.MSVCRT ref: 61CD2B53
isxdigit.MSVCRT ref: 61CD2B80
isprint.MSVCRT ref: 61CD2BAB
memcpy.MSVCRT ref: 61CD2C3B
CloseHandle.KERNEL32 ref: 61CD2C43

Strings

\\.\PhysicalDrive%d, xrefs: 61CD2A20
/%d:, xrefs: 61CD29F6

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
String ID: /%d:$\\.\PhysicalDrive%d
API String ID: 2355516209-72258043
Opcode ID: 89683aa018d352bc7483927c2884a9494289da326e639269118be85bf05dc60c
Instruction ID: 25a673be461365b6bd4b311013c27bc7fc495097a7303d0bad8d993ed232d1f9
Opcode Fuzzy Hash: 89683aa018d352bc7483927c2884a9494289da326e639269118be85bf05dc60c
Instruction Fuzzy Hash: A951187260868085E711CB76A86035FBBA2F7C6798F48C115EF9A47B98EB7DC048C740

Function 00007FF8A8631924 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

BN_copy.LIBCRYPTO-1_1 ref: 00007FF8A869C8F9
BN_free.LIBCRYPTO-1_1 ref: 00007FF8A869C90A
BN_dup.LIBCRYPTO-1_1 ref: 00007FF8A869C91B
BN_copy.LIBCRYPTO-1_1 ref: 00007FF8A869C93B
BN_free.LIBCRYPTO-1_1 ref: 00007FF8A869C94C
BN_dup.LIBCRYPTO-1_1 ref: 00007FF8A869C95D
BN_copy.LIBCRYPTO-1_1 ref: 00007FF8A869C97D
BN_free.LIBCRYPTO-1_1 ref: 00007FF8A869C98E
BN_dup.LIBCRYPTO-1_1 ref: 00007FF8A869C99F
BN_copy.LIBCRYPTO-1_1 ref: 00007FF8A869C9C7
BN_free.LIBCRYPTO-1_1 ref: 00007FF8A869C9D8
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A869CA15
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8A869CA2A

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8A869CA0E, 00007FF8A869CA20

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: N_copyN_free$N_dup$O_freeO_strdup
String ID: ..\s\ssl\tls_srp.c
API String ID: 3070725730-1778748169
Opcode ID: 69c56b4ffa0e70a954dfc1c9d6b1705144bf44245e90bbea21a6e62e083cf1e4
Instruction ID: a89902bf7ee4210642caae7cff49481c6522a7c08eef2b7e9acade6df172cfc4
Opcode Fuzzy Hash: 69c56b4ffa0e70a954dfc1c9d6b1705144bf44245e90bbea21a6e62e083cf1e4
Instruction Fuzzy Hash: 73413721A0FF82A0FED0EF6691583B836A4EF44FC4F086035D98D0A6C9DF6CA4418768

Function 61CE4B50 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 61CE4BA6
CryptAcquireContextA.ADVAPI32 ref: 61CE4BC6
CryptGenRandom.ADVAPI32 ref: 61CE4BD7
CryptReleaseContext.ADVAPI32 ref: 61CE4BED
clock.MSVCRT ref: 61CE4C30
clock.MSVCRT ref: 61CE4C43
clock.MSVCRT ref: 61CE4C4C
clock.MSVCRT ref: 61CE4C63

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 61CE4B95, 61CE4BBC
src/prngs/rng_get_bytes.c, xrefs: 61CE4CB0
out != NULL, xrefs: 61CE4CB7
(, xrefs: 61CE4BAE

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Cryptclock$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
API String ID: 2525729555-3762154145
Opcode ID: ec0db19bdf79496ae953b7909ce52b60800ae2d0c8bf03e08580c0d5631425c0
Instruction ID: 0e1ae70651d15ab6d9e90f54ab19413d26a100f7f5aefe2c99f3414f61194303
Opcode Fuzzy Hash: ec0db19bdf79496ae953b7909ce52b60800ae2d0c8bf03e08580c0d5631425c0
Instruction Fuzzy Hash: 6231B432708A51D1E710CBAAA84834E7AE5B7C9BD8F489421DE49C3664EF7EC456C790

Function 00007FF8A863194C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A864931A
ASN1_item_free.LIBCRYPTO-1_1 ref: 00007FF8A8649329
memcpy.VCRUNTIME140 ref: 00007FF8A864941A
memcpy.VCRUNTIME140 ref: 00007FF8A8649450
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A8649467
X509_free.LIBCRYPTO-1_1 ref: 00007FF8A864948F
memcpy.VCRUNTIME140 ref: 00007FF8A86494CB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A8649554

Part of subcall function 00007FF8A8649DF0: CRYPTO_free.LIBCRYPTO-1_1(00000000,00007FF8A86494F3), ref: 00007FF8A8649E19
Part of subcall function 00007FF8A8649DF0: CRYPTO_strndup.LIBCRYPTO-1_1(00000000,00007FF8A86494F3), ref: 00007FF8A8649E3E

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A8649614
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A864967D
ASN1_item_free.LIBCRYPTO-1_1 ref: 00007FF8A86496CF

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FF8A864930A, 00007FF8A8649384, 00007FF8A86493AE, 00007FF8A8649531, 00007FF8A86495A7, 00007FF8A86495EE, 00007FF8A8649663

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_free$memcpy$N1_item_free$O_strndupR_put_errorX509_free_time64
String ID: ..\s\ssl\ssl_asn1.c
API String ID: 3876440904-3659835543
Opcode ID: 502b59dba9b475c89e1af2ffad6b85ca553ba54a73eca1870dec0eec6ab11ce9
Instruction ID: 134b754ed94e5f387256ce3b704224b7000f94561c8a867a5e9bd31945b01ac2
Opcode Fuzzy Hash: 502b59dba9b475c89e1af2ffad6b85ca553ba54a73eca1870dec0eec6ab11ce9
Instruction Fuzzy Hash: 7DD1273264AB82A6FB95CF25D5882BC77A0FB45B84F089036DB4D477A5DF38E460C324

Function 00007FF8A86E266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A88AC011
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A88AC032
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A88AC04D
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A88AC068
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A88AC0B0
WideCharToMultiByte.KERNEL32 ref: 00007FF8A88AC0E6
WideCharToMultiByte.KERNEL32 ref: 00007FF8A88AC13B

Strings

HOME, xrefs: 00007FF8A88AC020
RANDFILE, xrefs: 00007FF8A88ABFF9
.rnd, xrefs: 00007FF8A88AC1EA
SYSTEMROOT, xrefs: 00007FF8A88AC059
USERPROFILE, xrefs: 00007FF8A88AC03E

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 17414fb3dbadd164f9036994a62f8e8a7c38cf9ca0ef5b7dd5b31d780b298b5d
Instruction ID: 01dc6ce6561c6fe62a2542f12979f0455af1768afbbe8d2cb8d295cda3ff167b
Opcode Fuzzy Hash: 17414fb3dbadd164f9036994a62f8e8a7c38cf9ca0ef5b7dd5b31d780b298b5d
Instruction Fuzzy Hash: 7861B322B0AB82A5EB508F25A840179A7E2FB45BE4F494271DE6D43BE4EF3DE445C314

Function 61CD2170 Relevance: 18.1, APIs: 12, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2191
HeapAlloc.KERNEL32 ref: 61CD21A6
memcpy.MSVCRT ref: 61CD221C
GetProcessHeap.KERNEL32 ref: 61CD223A
HeapFree.KERNEL32 ref: 61CD2245
GetProcessHeap.KERNEL32 ref: 61CD225A
HeapFree.KERNEL32 ref: 61CD2265
GetProcessHeap.KERNEL32 ref: 61CD2280
HeapFree.KERNEL32 ref: 61CD228B
GetProcessHeap.KERNEL32 ref: 61CD2295
HeapAlloc.KERNEL32 ref: 61CD22A0
GetAdaptersAddresses.IPHLPAPI ref: 61CD22BC

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$AdaptersAddressesmemcpy
String ID:
API String ID: 1739390247-0
Opcode ID: 578627ab2bbaa116def379c49418e510e3e6a83278a856ab89d8ac39e8884121
Instruction ID: a97683afd9d64a6ca20e611f4483d335d02fb46d2accae240e9b772e823667bb
Opcode Fuzzy Hash: 578627ab2bbaa116def379c49418e510e3e6a83278a856ab89d8ac39e8884121
Instruction Fuzzy Hash: 0031E6227056419AEB45DBBAAC50B9D67A2AB89BD4F4CC135EF1C47715FF38C981C700

Function 00007FF8A85112F0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A85118D0: PyMem_Malloc.PYTHON310 ref: 00007FF8A851193B
Part of subcall function 00007FF8A85118D0: PyType_IsSubtype.PYTHON310 ref: 00007FF8A8511A1D
Part of subcall function 00007FF8A85118D0: PyType_IsSubtype.PYTHON310 ref: 00007FF8A8511A7A

PyMem_Malloc.PYTHON310 ref: 00007FF8A8511372
PyMem_Free.PYTHON310 ref: 00007FF8A85114B6
PyErr_NoMemory.PYTHON310 ref: 00007FF8A85138E9
_Py_Dealloc.PYTHON310 ref: 00007FF8A85138F9

Strings

0, xrefs: 00007FF8A8511346

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID: 0
API String ID: 4139299733-4108050209
Opcode ID: 9f9c89dfe89939c84336a20baca6dfd687e87eebe8aa8381b46da653639d6d15
Instruction ID: 10296ca5e21baf76b38430bb0139d11407c5f29004d9f825c9af2719b508a486
Opcode Fuzzy Hash: 9f9c89dfe89939c84336a20baca6dfd687e87eebe8aa8381b46da653639d6d15
Instruction Fuzzy Hash: C7E10172E0F652A5EB60AB15D8586BE33A5FB447C0F541531EE8E826C4EF7CE840C728

Function 00007FF8A86319EC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A867D30D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A867D33E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A867D4FD
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A867D528

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A867D22F, 00007FF8A867D5DB, 00007FF8A867D5FD, 00007FF8A867D621, 00007FF8A867D6B5
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FF8A867D4EF, 00007FF8A867D51B

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_free$O_memdup
String ID: ..\s\ssl\statem\statem_clnt.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3545228654-3043411186
Opcode ID: 14704f4ea8be45842db3f41262605a4ccd75a1c2c2d0842067412517b520504c
Instruction ID: 293d1e178701c94d67a0f748149e2d6729970a3006023196ee9affbe38fd1eb9
Opcode Fuzzy Hash: 14704f4ea8be45842db3f41262605a4ccd75a1c2c2d0842067412517b520504c
Instruction Fuzzy Hash: 8AD19B72A0AB8195FB108B21D8487AD3BA4FB48BC8F149535EE8C17799DF3CE1858758

Function 00007FF8A863192E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A86393E5
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A86393FB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A8639445
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A863945B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A86394A5
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A86394BB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A863954F

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FF8A86393D4, 00007FF8A86393EE, 00007FF8A8639434, 00007FF8A863944E, 00007FF8A8639494, 00007FF8A86394AE, 00007FF8A8639542

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: 62b2b4f85efa3d580454f03a1549156fc1a83f92d3b8e2c1d5c88e3ed77353f9
Instruction ID: 9f591f2c37a8bc467f9188e39169d0cfca3c9428d81ed6f13a87f0daf8f6983e
Opcode Fuzzy Hash: 62b2b4f85efa3d580454f03a1549156fc1a83f92d3b8e2c1d5c88e3ed77353f9
Instruction Fuzzy Hash: E8517012A1AB8291FB00EB26D4942BD63A1FF85FC8F007531EE4D47796EF29E491C318

Function 00007FF8A865C970 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A865C9AE
CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A865C9C8
OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8A865C9FA
EVP_get_digestbyname.LIBCRYPTO-1_1 ref: 00007FF8A865CA02

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A865C99E, 00007FF8A865C9B9, 00007FF8A865CA5D, 00007FF8A865CA72, 00007FF8A865CA8E

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_zalloc$J_nid2snP_get_digestbyname
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4284552970-1080266419
Opcode ID: 231cf4d7bf0d1909718f62e827b62a538bfd29cf69b0f45843327f8b0e74a5a1
Instruction ID: dd5825467e8447f041e4baafd17f5f00cc57d5e082e2f9000518fa62da16df96
Opcode Fuzzy Hash: 231cf4d7bf0d1909718f62e827b62a538bfd29cf69b0f45843327f8b0e74a5a1
Instruction Fuzzy Hash: BE31C221B0BA91AAFB449F25E4183A97BA0EB45BC4F442135EF8C07BC6DF7DE1518724

Function 00007FF8A85118D0 Relevance: 13.9, APIs: 9, Instructions: 435COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 00007FF8A851193B
PyType_IsSubtype.PYTHON310 ref: 00007FF8A8511A1D
PyType_IsSubtype.PYTHON310 ref: 00007FF8A8511A7A
PyUnicode_FromKindAndData.PYTHON310 ref: 00007FF8A8511B4E
PyMem_Free.PYTHON310 ref: 00007FF8A8511B5A
PyMem_Realloc.PYTHON310 ref: 00007FF8A8511C39
PyMem_Free.PYTHON310 ref: 00007FF8A8513A6B
PyErr_NoMemory.PYTHON310 ref: 00007FF8A8513A71

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: a6f8d227c04c96ee92d3327cf4cee3c09afe3ee40d30a4d34132af5cf80b64b2
Instruction ID: 0da5d55c02ae3cff71cf0cd65859081880560bd1475d48f68bee126ef98afbae
Opcode Fuzzy Hash: a6f8d227c04c96ee92d3327cf4cee3c09afe3ee40d30a4d34132af5cf80b64b2
Instruction Fuzzy Hash: 9B023472F4E652A2EB24AB15DC546B97BA5EB847C0F445231DE8E467C4EF3CE844C328

Function 00007FF8A8513068 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A8513084
memset.VCRUNTIME140 ref: 00007FF8A85130A8
RtlCaptureContext.KERNEL32 ref: 00007FF8A85130B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A85130CB
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A851310C
memset.VCRUNTIME140 ref: 00007FF8A851313F
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8513160
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8513181
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A851318C

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 00f1522312bfcd982374d2b7872c5ef4cc0ec29a30735505d4bf24cc2f66f2d8
Instruction ID: a33b9f4f812802308cf70497a4eb71721057c7500f2b03a263395eba8783838f
Opcode Fuzzy Hash: 00f1522312bfcd982374d2b7872c5ef4cc0ec29a30735505d4bf24cc2f66f2d8
Instruction Fuzzy Hash: B0314D7260AB8195EB60AF61E8503ED73A4FB84784F44443ADB4E47A98DF3CD648C724

Function 61D3FF20 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 61D3FF34
RtlLookupFunctionEntry.KERNEL32 ref: 61D3FF4B
RtlVirtualUnwind.KERNEL32 ref: 61D3FF8D
SetUnhandledExceptionFilter.KERNEL32 ref: 61D3FFD1
UnhandledExceptionFilter.KERNEL32 ref: 61D3FFDE
GetCurrentProcess.KERNEL32 ref: 61D3FFE4
TerminateProcess.KERNEL32 ref: 61D3FFF2
abort.MSVCRT ref: 61D3FFF8

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 34e47eac2d239704eba39ba913f863e637461c29c0bdffefba06e04daf3a5a4f
Instruction ID: 218b7e20b59df865aece717c3ce152185d8bf3536e35a5d2637b8bed06f6e0a3
Opcode Fuzzy Hash: 34e47eac2d239704eba39ba913f863e637461c29c0bdffefba06e04daf3a5a4f
Instruction Fuzzy Hash: 5621D072211B04A5EB00CF65F8843DA37B6BB4DB94F484526EA5E5B724EF3AC165C780

Function 61CC3AC1 Relevance: 7.7, APIs: 5, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a696cac2692144fd41d63314c9d240007b05f43e07727a89cadcc8317ebeafb
Instruction ID: feec73b75fd21b1a3c10566d494c28a3adb4dd63f9378a8a5cc770b2f2c7e397
Opcode Fuzzy Hash: 9a696cac2692144fd41d63314c9d240007b05f43e07727a89cadcc8317ebeafb
Instruction Fuzzy Hash: A4A1E3B3204ADAA7C702CF6AE0001DFBF70F706B0DB99C145EB5A4A112E736D95AC752

Function 61D3FE40 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61D3FE85
GetCurrentProcessId.KERNEL32 ref: 61D3FE90
GetCurrentThreadId.KERNEL32 ref: 61D3FE99
GetTickCount.KERNEL32 ref: 61D3FEA1
QueryPerformanceCounter.KERNEL32 ref: 61D3FEAE

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9927ebffe976e8623314bf487f79a03bd834ee23fd5eadd176ab0ac3cb8e1d83
Instruction ID: 644738562a21768717a1273499f30fd12c2c7385cf9d5a289d6df6731eb65da6
Opcode Fuzzy Hash: 9927ebffe976e8623314bf487f79a03bd834ee23fd5eadd176ab0ac3cb8e1d83
Instruction Fuzzy Hash: A7118C36615A5096FB109B25F80439966A1B78DBA4F0C4670DE9D027A4EA3DC495C340

Function 00007FF8A8631974 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A866DC64
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A866DC91

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A866DCCB
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FF8A866DC5D, 00007FF8A866DC84

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_clnt.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-2231994545
Opcode ID: 3fa6e8d300fdef3058764ae3552a8500907979292cb2cd1364e61a4063f92c5c
Instruction ID: 99360e1527dcd2b855f70e913aad9dafd6cef3c02bdb774a1505799ef50fd55a
Opcode Fuzzy Hash: 3fa6e8d300fdef3058764ae3552a8500907979292cb2cd1364e61a4063f92c5c
Instruction Fuzzy Hash: FA31E432A1EA8052FA548B14F4442A9B794FB847D4F486230FB9D47B95EF7CE1A08714

Function 00007FF8A86E2B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF8A87AA5A9
WSAGetLastError.WS2_32 ref: 00007FF8A87AA5B8

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A87AA55E, 00007FF8A87AA5CE, 00007FF8A87AA5EA

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: f933256663fa9be9d4592beb2c2da40180bdaf449910e1692b9e8b997b1e31ed
Instruction ID: 78a9d31c2218bbb049dbd542f6458b0f41ac5b061a08802018ae1d292f192bd5
Opcode Fuzzy Hash: f933256663fa9be9d4592beb2c2da40180bdaf449910e1692b9e8b997b1e31ed
Instruction Fuzzy Hash: CA21AE31B0A60296FB10DB25F8086ADB361FB84BC4F504135EA5C07B99EF3DE956CB18

Function 00007FF8A8638970 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(00007FF8A8637B9F), ref: 00007FF8A8638A39

Strings

..\s\ssl\packet.c, xrefs: 00007FF8A8638A25

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\packet.c
API String ID: 2581946324-1434567093
Opcode ID: 1d1c7a30cca5a33fcf645cae5dc294225f4670823913cfb1b420e4b6c07ae7af
Instruction ID: 7d638f20c66fde2a8ea909de48efc15eefd794d634d1781a1524e9e8e8220be7
Opcode Fuzzy Hash: 1d1c7a30cca5a33fcf645cae5dc294225f4670823913cfb1b420e4b6c07ae7af
Instruction Fuzzy Hash: A021AF7AB16B4591EE548B29C04CBB823A4FB54BC0F56A031DE5C83380EF3AD420C324

Function 00007FF6DFF75810 Relevance: 233.2, APIs: 44, Strings: 89, Instructions: 451libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00000000,?,?,00007FF6DFF73B9D), ref: 00007FF6DFF75827
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75843
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7585F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7587B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75897
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758B3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758CF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF758EB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75907
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75923
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7593F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF7595B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75977
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75993
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759AF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759CB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF759E7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A03
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A1F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A3B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A57
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A73
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75A8F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AAB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AC7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AE3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75AFF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B1B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B37
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B53
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B6F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75B8B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BA7
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BC3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BDF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75BFB
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C17
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C33
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C4F
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C6B
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75C87
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CA3
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CBF
GetProcAddress.KERNEL32(?,00007FF6DFF73B9D), ref: 00007FF6DFF75CDB

Strings

Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6DFF75F48
PyConfig_SetBytesString, xrefs: 00007FF6DFF75935
PyUnicode_Replace, xrefs: 00007FF6DFF75CD1
Failed to get address for Py_ExitStatusException, xrefs: 00007FF6DFF75D17
Failed to get address for PyModule_GetDict, xrefs: 00007FF6DFF75F78
PyUnicode_Decode, xrefs: 00007FF6DFF75C45
PyMem_RawFree, xrefs: 00007FF6DFF75AD9
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6DFF75ED0
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF6DFF75D41
PyErr_Fetch, xrefs: 00007FF6DFF759A5
PyErr_Restore, xrefs: 00007FF6DFF75A15
Failed to get address for PyErr_Fetch, xrefs: 00007FF6DFF75E58
PyObject_Str, xrefs: 00007FF6DFF75B81
Failed to get address for PyErr_Occurred, xrefs: 00007FF6DFF75E28
Failed to get address for PyUnicode_Join, xrefs: 00007FF6DFF760C8
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6DFF75FD8
Failed to get address for Py_Finalize, xrefs: 00007FF6DFF75D56
PyUnicode_FromFormat, xrefs: 00007FF6DFF75C7D
Failed to get address for Py_DecRef, xrefs: 00007FF6DFF75CF6
PyErr_Print, xrefs: 00007FF6DFF759F9
Failed to get address for PySys_GetObject, xrefs: 00007FF6DFF76050
PyConfig_Clear, xrefs: 00007FF6DFF758E1
PyImport_ExecCodeModule, xrefs: 00007FF6DFF75A69
PyUnicode_Join, xrefs: 00007FF6DFF75CB5
PyErr_Occurred, xrefs: 00007FF6DFF759DD
Failed to get address for PyErr_Clear, xrefs: 00007FF6DFF75E70
PySys_SetObject, xrefs: 00007FF6DFF75C0D
GetProcAddress, xrefs: 00007FF6DFF75CFD, 00007FF6DFF75D1E, 00007FF6DFF75D33, 00007FF6DFF75D48, 00007FF6DFF75D5D, 00007FF6DFF75D72, 00007FF6DFF75D87, 00007FF6DFF75D9F, 00007FF6DFF75DB7, 00007FF6DFF75DCF, 00007FF6DFF75DE7, 00007FF6DFF75DFF, 00007FF6DFF75E17, 00007FF6DFF75E2F, 00007FF6DFF75E47, 00007FF6DFF75E5F, 00007FF6DFF75E77, 00007FF6DFF75E8F, 00007FF6DFF75EA7, 00007FF6DFF75EBF, 00007FF6DFF75ED7, 00007FF6DFF75EEF, 00007FF6DFF75F07, 00007FF6DFF75F1F, 00007FF6DFF75F37, 00007FF6DFF75F4F, 00007FF6DFF75F67, 00007FF6DFF75F7F, 00007FF6DFF75F97, 00007FF6DFF75FAF, 00007FF6DFF75FC7, 00007FF6DFF75FDF, 00007FF6DFF75FF7, 00007FF6DFF7600F, 00007FF6DFF76027, 00007FF6DFF7603F, 00007FF6DFF76057, 00007FF6DFF7606F, 00007FF6DFF76087, 00007FF6DFF7609F, 00007FF6DFF760B7, 00007FF6DFF760CF, 00007FF6DFF760E7, 00007FF6DFF760FF
Failed to get address for PyStatus_Exception, xrefs: 00007FF6DFF76008
PyConfig_Read, xrefs: 00007FF6DFF75919
Failed to get address for PyObject_Str, xrefs: 00007FF6DFF75FC0
PyUnicode_DecodeFSDefault, xrefs: 00007FF6DFF75C61
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6DFF75F00
Failed to get address for PyConfig_SetString, xrefs: 00007FF6DFF75DE0
Failed to get address for PyMem_RawFree, xrefs: 00007FF6DFF75F90
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6DFF76080
Py_InitializeFromConfig, xrefs: 00007FF6DFF7588D
Failed to get address for PyErr_Restore, xrefs: 00007FF6DFF75EA0
Py_DecodeLocale, xrefs: 00007FF6DFF75839
PyImport_ImportModule, xrefs: 00007FF6DFF75A85
Failed to get address for Py_PreInitialize, xrefs: 00007FF6DFF75D80
PyUnicode_FromString, xrefs: 00007FF6DFF75C99
PyObject_SetAttrString, xrefs: 00007FF6DFF75B65
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75B9D
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6DFF76068
PyStatus_Exception, xrefs: 00007FF6DFF75BD5
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6DFF760E0
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6DFF760F8
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75FA8
Failed to get address for PyErr_Print, xrefs: 00007FF6DFF75E88
PySys_GetObject, xrefs: 00007FF6DFF75BF1
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6DFF75FF0
Failed to get address for PyConfig_Read, xrefs: 00007FF6DFF75E10
PyMarshal_ReadObjectFromString, xrefs: 00007FF6DFF75ABD
Py_IsInitialized, xrefs: 00007FF6DFF758A9
Py_PreInitialize, xrefs: 00007FF6DFF758C5
Py_DecRef, xrefs: 00007FF6DFF7581D
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6DFF75F30
PyConfig_SetWideStringList, xrefs: 00007FF6DFF7596D
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6DFF75F18
Failed to get address for PyConfig_Clear, xrefs: 00007FF6DFF75D6B
PyConfig_SetString, xrefs: 00007FF6DFF75951
PyObject_CallFunction, xrefs: 00007FF6DFF75B11
Failed to get address for PyImport_AddModule, xrefs: 00007FF6DFF75EB8
Failed to get address for Py_IsInitialized, xrefs: 00007FF6DFF75D98
PyErr_NormalizeException, xrefs: 00007FF6DFF759C1
PyImport_AddModule, xrefs: 00007FF6DFF75A4D
Py_Finalize, xrefs: 00007FF6DFF75871
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF6DFF75DF8
PyModule_GetDict, xrefs: 00007FF6DFF75AF5
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6DFF76020
Failed to get address for PySys_SetObject, xrefs: 00007FF6DFF76038
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF6DFF75DB0
PyConfig_InitIsolatedConfig, xrefs: 00007FF6DFF758FD
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6DFF760B0
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6DFF75E40
PyObject_GetAttrString, xrefs: 00007FF6DFF75B49
PyRun_SimpleStringFlags, xrefs: 00007FF6DFF75BB9
Py_ExitStatusException, xrefs: 00007FF6DFF75855
PyUnicode_AsUTF8, xrefs: 00007FF6DFF75C29
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6DFF75F60
PyEval_EvalCode, xrefs: 00007FF6DFF75A31
PyObject_CallFunctionObjArgs, xrefs: 00007FF6DFF75B2D
PyErr_Clear, xrefs: 00007FF6DFF75989
PyList_Append, xrefs: 00007FF6DFF75AA1
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6DFF75D2C
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF6DFF75DC8
Failed to get address for PyList_Append, xrefs: 00007FF6DFF75EE8
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6DFF76098

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: af163ddc85bf2b883ecff41c15d72a41c989fd972fde24fa4a0f8e3ace152156
Instruction ID: 305803e4dfb3c5e1c7bec2880f0f9c039351baa635088c4661c820f3203d7628
Opcode Fuzzy Hash: af163ddc85bf2b883ecff41c15d72a41c989fd972fde24fa4a0f8e3ace152156
Instruction Fuzzy Hash: EE3290A0E6DB0B90EE15DB16F8500BCA396AF45380F985437C92EC72B5EE6CF5368354

Function 00007FF6DFF774D0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 324libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6DFF774EB
GetProcAddress.KERNEL32 ref: 00007FF6DFF77507
GetProcAddress.KERNEL32 ref: 00007FF6DFF77523
GetProcAddress.KERNEL32 ref: 00007FF6DFF7753F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7755B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77577
GetProcAddress.KERNEL32 ref: 00007FF6DFF77593
GetProcAddress.KERNEL32 ref: 00007FF6DFF775AF
GetProcAddress.KERNEL32 ref: 00007FF6DFF775CB
GetProcAddress.KERNEL32 ref: 00007FF6DFF775E7
GetProcAddress.KERNEL32 ref: 00007FF6DFF77603
GetProcAddress.KERNEL32 ref: 00007FF6DFF7761F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7763B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77657
GetProcAddress.KERNEL32 ref: 00007FF6DFF77673
GetProcAddress.KERNEL32 ref: 00007FF6DFF7768F
GetProcAddress.KERNEL32 ref: 00007FF6DFF776AB
GetProcAddress.KERNEL32 ref: 00007FF6DFF776C7
GetProcAddress.KERNEL32 ref: 00007FF6DFF776E3
GetProcAddress.KERNEL32 ref: 00007FF6DFF776FF
GetProcAddress.KERNEL32 ref: 00007FF6DFF7771B
GetProcAddress.KERNEL32 ref: 00007FF6DFF77737
GetProcAddress.KERNEL32 ref: 00007FF6DFF77753
GetProcAddress.KERNEL32 ref: 00007FF6DFF7776F
GetProcAddress.KERNEL32 ref: 00007FF6DFF7778B
GetProcAddress.KERNEL32 ref: 00007FF6DFF777A7
GetProcAddress.KERNEL32 ref: 00007FF6DFF777C3
GetProcAddress.KERNEL32 ref: 00007FF6DFF777DF
GetProcAddress.KERNEL32 ref: 00007FF6DFF777FB
GetProcAddress.KERNEL32 ref: 00007FF6DFF77817
GetProcAddress.KERNEL32 ref: 00007FF6DFF77833

Strings

Tcl_Alloc, xrefs: 00007FF6DFF777D5
Tk_GetNumMainWindows, xrefs: 00007FF6DFF77829
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6DFF77A88
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6DFF77998
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6DFF77938
Tcl_FinalizeThread, xrefs: 00007FF6DFF7756D
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6DFF77920
Tcl_CreateObjCommand, xrefs: 00007FF6DFF776D9
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6DFF778C3
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6DFF779E0
Tcl_SetVar2Ex, xrefs: 00007FF6DFF77749
Tcl_FindExecutable, xrefs: 00007FF6DFF77519
Tcl_ConditionWait, xrefs: 00007FF6DFF7764D
Tcl_MutexLock, xrefs: 00007FF6DFF775DD
Tk_Init, xrefs: 00007FF6DFF7780D
Tcl_CreateInterp, xrefs: 00007FF6DFF774FD
Tcl_GetCurrentThread, xrefs: 00007FF6DFF775C1
Tcl_ConditionFinalize, xrefs: 00007FF6DFF77615
Tcl_ThreadQueueEvent, xrefs: 00007FF6DFF77669
Tcl_EvalFile, xrefs: 00007FF6DFF77781
Failed to get address for Tcl_Init, xrefs: 00007FF6DFF7784F
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6DFF779F8
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6DFF77980
GetProcAddress, xrefs: 00007FF6DFF77856, 00007FF6DFF77876, 00007FF6DFF7788B, 00007FF6DFF778A0, 00007FF6DFF778B5, 00007FF6DFF778CA, 00007FF6DFF778DF, 00007FF6DFF778F7, 00007FF6DFF7790F, 00007FF6DFF77927, 00007FF6DFF7793F, 00007FF6DFF77957, 00007FF6DFF7796F, 00007FF6DFF77987, 00007FF6DFF7799F, 00007FF6DFF779B7, 00007FF6DFF779CF, 00007FF6DFF779E7, 00007FF6DFF779FF, 00007FF6DFF77A17, 00007FF6DFF77A2F, 00007FF6DFF77A47, 00007FF6DFF77A5F, 00007FF6DFF77A77, 00007FF6DFF77A8F, 00007FF6DFF77AA7, 00007FF6DFF77ABF, 00007FF6DFF77AD7, 00007FF6DFF77AEF, 00007FF6DFF77B07, 00007FF6DFF77B1F
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6DFF77A58
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6DFF77A40
Tcl_MutexUnlock, xrefs: 00007FF6DFF775F9
Tcl_Free, xrefs: 00007FF6DFF777F1
Tcl_DoOneEvent, xrefs: 00007FF6DFF77535
Tcl_EvalObjv, xrefs: 00007FF6DFF777B9
Tcl_ConditionNotify, xrefs: 00007FF6DFF77631
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6DFF778AE
Tcl_GetVar2, xrefs: 00007FF6DFF776A1
Tcl_DeleteInterp, xrefs: 00007FF6DFF77589
Failed to get address for Tcl_Free, xrefs: 00007FF6DFF77AA0
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6DFF77908
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6DFF77968
Tcl_GetObjResult, xrefs: 00007FF6DFF77765
Failed to get address for Tcl_Finalize, xrefs: 00007FF6DFF77899
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6DFF779C8
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6DFF7786F
Tcl_NewByteArrayObj, xrefs: 00007FF6DFF7772D
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6DFF77B18
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6DFF778F0
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6DFF779B0
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6DFF77A10
Tcl_Init, xrefs: 00007FF6DFF774E4
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6DFF77AD0
Tcl_SetVar2, xrefs: 00007FF6DFF776BD
Failed to get address for Tcl_GetString, xrefs: 00007FF6DFF77A28
Tcl_EvalEx, xrefs: 00007FF6DFF7779D
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6DFF77950
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6DFF77AE8
Tcl_CreateThread, xrefs: 00007FF6DFF775A5
Tcl_Finalize, xrefs: 00007FF6DFF77551
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6DFF778D8
Tcl_ThreadAlert, xrefs: 00007FF6DFF77685
Failed to get address for Tk_Init, xrefs: 00007FF6DFF77B00
Tcl_NewStringObj, xrefs: 00007FF6DFF77711
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6DFF77884
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6DFF77A70
Tcl_GetString, xrefs: 00007FF6DFF776F5
Failed to get address for Tcl_Alloc, xrefs: 00007FF6DFF77AB8

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 22024b249153ea0e59b866e83f9e6b0fc22e0894010a1230b992406c58f677af
Instruction ID: 077a3da6979acb93ec69585ff6a48df23fec1cc4376ab0686d599a97df6fb925
Opcode Fuzzy Hash: 22024b249153ea0e59b866e83f9e6b0fc22e0894010a1230b992406c58f677af
Instruction Fuzzy Hash: 86F1B5A1E2DB0790FE15DB16FC510BCA7A6AF45380B945537D8ADC33A5EEACE129C304

Function 61CD3070 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CD30AE

Part of subcall function 61CD2CC0: strlen.MSVCRT ref: 61CD2CE3

fprintf.MSVCRT ref: 61CD30E7

Part of subcall function 61CD2EE0: strlen.MSVCRT ref: 61CD2EFA

fputc.MSVCRT ref: 61CD3119

Part of subcall function 61CD2360: GetProcessHeap.KERNEL32 ref: 61CD2383
Part of subcall function 61CD2360: HeapAlloc.KERNEL32 ref: 61CD2397
Part of subcall function 61CD2360: GetAdaptersAddresses.IPHLPAPI ref: 61CD23BC
Part of subcall function 61CD2360: GetProcessHeap.KERNEL32 ref: 61CD242F
Part of subcall function 61CD2360: HeapFree.KERNEL32 ref: 61CD2439

fprintf.MSVCRT ref: 61CD3148

Part of subcall function 61CD2170: GetProcessHeap.KERNEL32 ref: 61CD2191
Part of subcall function 61CD2170: HeapAlloc.KERNEL32 ref: 61CD21A6
Part of subcall function 61CD2170: memcpy.MSVCRT ref: 61CD221C
Part of subcall function 61CD2170: GetProcessHeap.KERNEL32 ref: 61CD223A
Part of subcall function 61CD2170: HeapFree.KERNEL32 ref: 61CD2245

fputc.MSVCRT ref: 61CD317B

Part of subcall function 61CD24F0: GetProcessHeap.KERNEL32 ref: 61CD2513
Part of subcall function 61CD24F0: HeapAlloc.KERNEL32 ref: 61CD2527
Part of subcall function 61CD24F0: GetAdaptersAddresses.IPHLPAPI ref: 61CD254F
Part of subcall function 61CD24F0: inet_ntoa.WS2_32 ref: 61CD2587
Part of subcall function 61CD24F0: GetProcessHeap.KERNEL32 ref: 61CD25A2
Part of subcall function 61CD24F0: HeapFree.KERNEL32 ref: 61CD25AC

fprintf.MSVCRT ref: 61CD31AA
fputc.MSVCRT ref: 61CD31BE

Part of subcall function 61CD28F0: GetProcessHeap.KERNEL32 ref: 61CD290B
Part of subcall function 61CD28F0: HeapAlloc.KERNEL32 ref: 61CD291F
Part of subcall function 61CD28F0: GetNetworkParams.IPHLPAPI ref: 61CD2957
Part of subcall function 61CD28F0: GetProcessHeap.KERNEL32 ref: 61CD2979
Part of subcall function 61CD28F0: HeapFree.KERNEL32 ref: 61CD2983

fprintf.MSVCRT ref: 61CD31ED
fwrite.MSVCRT ref: 61CD320E
strchr.MSVCRT ref: 61CD323B
fwrite.MSVCRT ref: 61CD3273
fprintf.MSVCRT ref: 61CD329B
strchr.MSVCRT ref: 61CD32A8
fprintf.MSVCRT ref: 61CD32C9
fputc.MSVCRT ref: 61CD32E2
fwrite.MSVCRT ref: 61CD3303
malloc.MSVCRT ref: 61CD330D
fwrite.MSVCRT ref: 61CD36A7
fwrite.MSVCRT ref: 61CD36C8
fwrite.MSVCRT ref: 61CD36E9
fwrite.MSVCRT ref: 61CD370A

Strings

Default Mac address: "%s", xrefs: 61CD313B
Failed to get harddisk information., xrefs: 61CD3692
Failed to get mac address., xrefs: 61CD36B3
"%s", xrefs: 61CD327D, 61CD32BC
%02x:, xrefs: 61CD35BE
Serial number with disk name: , xrefs: 61CD325E
Failed to get domain name., xrefs: 61CD36F5
Domain name: "%s", xrefs: 61CD31E0
Failed to get ip address., xrefs: 61CD36D4
Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 61CD31F9
>", xrefs: 61CD3667
Hardware informations got by PyArmor:, xrefs: 61CD3096
Multiple Mac addresses: "<, xrefs: 61CD32EE
%02x, xrefs: 61CD361D
Serial number of default harddisk: "%s", xrefs: 61CD30DA
Ip address: "%s", xrefs: 61CD319D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Processfwrite$fprintf$AllocFreefputc$AdaptersAddressesstrchrstrlen$NetworkParamsinet_ntoamallocmemcpy
String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
API String ID: 3427000353-3771683696
Opcode ID: b783e3071cae2d82e5867a8721324a09ed24aac78513499f7840a47468256dd0
Instruction ID: 92e2d17e8ae4c0f6397d3f9441ee972215c020172eae537d116b54a4bedd9b74
Opcode Fuzzy Hash: b783e3071cae2d82e5867a8721324a09ed24aac78513499f7840a47468256dd0
Instruction Fuzzy Hash: 9902CAB2605B808AEB50CBA6E45439E77A2F789BD4F488229CF9E47794EF39D050C711

Function 61CD3AE0 Relevance: 72.1, APIs: 35, Strings: 6, Instructions: 355networkstringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 61CD3B02
WSAStartup.WS2_32 ref: 61CD3B14
gethostbyname.WS2_32 ref: 61CD3B59
socket.WS2_32 ref: 61CD3B96
htons.WS2_32 ref: 61CD3BBD
ioctlsocket.WS2_32 ref: 61CD3BF2
connect.WS2_32 ref: 61CD3C0A
ioctlsocket.WS2_32 ref: 61CD3C2C
send.WS2_32 ref: 61CD3C64
WSAGetLastError.WS2_32 ref: 61CD3C6D
closesocket.WS2_32 ref: 61CD3C78
WSACleanup.WS2_32 ref: 61CD3C7E
SetLastError.KERNEL32 ref: 61CD3C86
recv.WS2_32 ref: 61CD3CDC
closesocket.WS2_32 ref: 61CD3CF4
WSACleanup.WS2_32 ref: 61CD3CFA
strstr.MSVCRT ref: 61CD3D0A
strstr.MSVCRT ref: 61CD3D35
toupper.MSVCRT ref: 61CD3D4A
toupper.MSVCRT ref: 61CD3D59
toupper.MSVCRT ref: 61CD3D68
toupper.MSVCRT ref: 61CD3D77
strstr.MSVCRT ref: 61CD3DD8
memcmp.MSVCRT ref: 61CD3E8F
memcmp.MSVCRT ref: 61CD3EAD
_mktime64.MSVCRT ref: 61CD3F54
gethostbyname.WS2_32 ref: 61CD3F8E
WSAGetLastError.WS2_32 ref: 61CD3FA7
ioctlsocket.WS2_32 ref: 61CD3FC4
WSAGetLastError.WS2_32 ref: 61CD3FC6
WSAGetLastError.WS2_32 ref: 61CD3FD0
WSACleanup.WS2_32 ref: 61CD3FD8
SetLastError.KERNEL32 ref: 61CD3FE0
select.WS2_32 ref: 61CD405A
ioctlsocket.WS2_32 ref: 61CD4076

Strings

http://, xrefs: 61CD3AE9
HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close, xrefs: 61CD3B37, 61CD3F6F
or,, xrefs: 61CD3AE6
Nov, xrefs: 61CD3E7F
and,, xrefs: 61CD3AEB
Dec, xrefs: 61CD3E9D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ErrorLast$ioctlsockettoupper$Cleanupstrstr$closesocketgethostbynamememcmp$Startup_mktime64connecthtonsrecvselectsendsocketstrchr
String ID: Dec$HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close$Nov$and,$http://$or,
API String ID: 3493847099-1714119496
Opcode ID: acafb66694e3a6d8a3140dddf388bdaeaa594ae6991981273d92853579bfbd55
Instruction ID: 2245fc7e2c34ebdecf51f47339fa0a5b3204eb2be2a55567f34bb1af9096f0c0
Opcode Fuzzy Hash: acafb66694e3a6d8a3140dddf388bdaeaa594ae6991981273d92853579bfbd55
Instruction Fuzzy Hash: ECE1F472A09AC1D1E711CB61E44039EBBB1F385B98F08D226CB6947B98FB3DD546C741

Function 61CC33ED Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 171COMMON

Download Yara Rule

APIs

PyImport_GetModuleDict.PYTHON310 ref: 61CC33ED
PyDict_GetItemString.PYTHON310 ref: 61CC3400
PyModule_GetDict.PYTHON310 ref: 61CC340E
PyDict_GetItemString.PYTHON310 ref: 61CC3427
PyObject_GetAttrString.PYTHON310 ref: 61CC344D
PyList_GetItem.PYTHON310 ref: 61CC3461
_PyObject_CallFunction_SizeT.PYTHON310 ref: 61CC34A6
_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC34D7
_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC34E9
_Py_Dealloc.PYTHON310 ref: 61CC34F5
PyErr_Clear.PYTHON310 ref: 61CC3580
getenv.MSVCRT ref: 61CC358D
PyUnicode_FromFormat.PYTHON310(?,?,?,?,?,?), ref: 61CC35AA
_PyObject_CallFunction_SizeT.PYTHON310(?,?,?,?,?,?), ref: 61CC35D7
_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC3605
_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC3617
_Py_Dealloc.PYTHON310 ref: 61CC3623
PyList_GetItem.PYTHON310 ref: 61CC3685
_Py_Dealloc.PYTHON310 ref: 61CC3824

Strings

PYARMOR_RKEY, xrefs: 61CC3586
close, xrefs: 61CC34DF, 61CC360D, 61CC372C
__path__, xrefs: 61CC341D
read, xrefs: 61CC34C6, 61CC35F4, 61CC3713
_path, xrefs: 61CC3443
%s/%s, xrefs: 61CC36C6
%U/../%s, xrefs: 61CC3479
%U/%s, xrefs: 61CC369D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Object_$CallSize$ItemMethod_$DeallocString$DictDict_Function_List_$AttrClearErr_FormatFromImport_ModuleModule_Unicode_getenv
String ID: %U/%s$%U/../%s$%s/%s$PYARMOR_RKEY$__path__$_path$close$read
API String ID: 2543034039-1237617226
Opcode ID: 634047117cca7d8fce8fedee0322fcf63425aa1eb2170c42f010d6675a89240e
Instruction ID: 60af7937a6a6349b4c965615d5f79901f695ac0d2ba64db0d57a8ef2a3aba520
Opcode Fuzzy Hash: 634047117cca7d8fce8fedee0322fcf63425aa1eb2170c42f010d6675a89240e
Instruction Fuzzy Hash: BD611675342A10E5FA05DB6AF8547D927A2BB4AFC4F4CA5268C0D06760EF3EC869C391

Function 61CC82A0 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 201COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON310 ref: 61CC82C1
PyTuple_New.PYTHON310 ref: 61CC82CD
_PyObject_LookupAttr.PYTHON310 ref: 61CC832F
_PyObject_GetAttrId.PYTHON310 ref: 61CC8343
PyModule_GetFilenameObject.PYTHON310 ref: 61CC836F
PyUnicode_FromString.PYTHON310 ref: 61CC837F
_PyErr_Clear.PYTHON310 ref: 61CC83B9
PyErr_SetImportError.PYTHON310 ref: 61CC83DF
_Py_Dealloc.PYTHON310 ref: 61CC83FE

Strings

cannot import name %R from %R (%S), xrefs: 61CC850A
cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S), xrefs: 61CC8525
cannot import name %R from %R (unknown location), xrefs: 61CC83C5
<unknown module name>, xrefs: 61CC8378
%U.%U, xrefs: 61CC8452

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: AttrErr_Object_Tuple_$ClearDeallocErrorFilenameFromImportLookupModule_ObjectSizeStringUnicode_
String ID: %U.%U$<unknown module name>$cannot import name %R from %R (%S)$cannot import name %R from %R (unknown location)$cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S)
API String ID: 597108667-3215622635
Opcode ID: 56f31735fa42c127f0fc7403903652c87f1e802b72edcce93260bfb485918a12
Instruction ID: 45fe86b5ef952b9bb675518cf420b8f767b54ac1bd1b9f4280c3b25a1860d71c
Opcode Fuzzy Hash: 56f31735fa42c127f0fc7403903652c87f1e802b72edcce93260bfb485918a12
Instruction Fuzzy Hash: D1717732609A84E5EA05CFA6A814B9F77A6B786FD4F0C8028DE4E07724EF3DC565D341

Function 61CCE2C0 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 472fileCOMMON

Download Yara Rule

APIs

_Py_hashtable_new_full.PYTHON310 ref: 61CCE347
_Py_hashtable_destroy.PYTHON310 ref: 61CCE384
fwrite.MSVCRT ref: 61CCE3A1
PyErr_NoMemory.PYTHON310 ref: 61CCE472
fwrite.MSVCRT ref: 61CCEACA

Strings

too many objects, xrefs: 61CCE847

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: fwrite$Err_MemoryPy_hashtable_destroyPy_hashtable_new_full
String ID: too many objects
API String ID: 3535940709-4209268247
Opcode ID: a023a58e50b9cdfc8f5c553eb389cbe8784738619cfb37b626762e79cdfb616a
Instruction ID: 4f9ccfb5cd135e6d91eadede883def994fa55df538c354cf6cc8e921125d75c0
Opcode Fuzzy Hash: a023a58e50b9cdfc8f5c553eb389cbe8784738619cfb37b626762e79cdfb616a
Instruction Fuzzy Hash: 13127B72209B84C6DB00CB9AE44178EBFB0F386BD0F548116EA9D07BA8EB7DD455CB41

Function 61CD1810 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 254COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD195B
_Py_Dealloc.PYTHON310 ref: 61CD19A1
PyTuple_New.PYTHON310 ref: 61CD1AA6
PyDict_GetItem.PYTHON310 ref: 61CD1B8F
PyDict_DelItem.PYTHON310 ref: 61CD1BB7
PyErr_SetString.PYTHON310 ref: 61CD1BE4

Strings

missing required positional arguments, xrefs: 61CD1951
missing kwonly required arguments, xrefs: 61CD1BDA
Can't remove argname from kwargs, xrefs: 61CD1A36
too many positional arguments, xrefs: 61CD1C44

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dict_Err_ItemString$DeallocTuple_
String ID: Can't remove argname from kwargs$missing kwonly required arguments$missing required positional arguments$too many positional arguments
API String ID: 2174600326-1903473336
Opcode ID: 7303d3d761875bdc6893d637ceab9efaca0c6dfe1dfae3e27ea568136a0aeaab
Instruction ID: 9d091126f05559e10f132cc32e8c77f01fcecdd16f6401f7f237ae201c93b453
Opcode Fuzzy Hash: 7303d3d761875bdc6893d637ceab9efaca0c6dfe1dfae3e27ea568136a0aeaab
Instruction Fuzzy Hash: 50B12872A45B84C1EA258FAAE84439E77B5F785BE4F598211CF9D03B68EF39C095C301

Function 61CD0400 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

PyObject_GetIter.PYTHON310 ref: 61CD0447
PyIter_Next.PYTHON310 ref: 61CD0498
PyErr_Occurred.PYTHON310 ref: 61CD04A0
_Py_Dealloc.PYTHON310 ref: 61CD04DA
_Py_Dealloc.PYTHON310 ref: 61CD04EB
Py_DecRef.PYTHON310 ref: 61CD04F4
Py_DecRef.PYTHON310 ref: 61CD053D
PyIter_Next.PYTHON310 ref: 61CD0558
PyErr_Format.PYTHON310 ref: 61CD057E
PyErr_ExceptionMatches.PYTHON310 ref: 61CD05DA
PySequence_Check.PYTHON310 ref: 61CD05FE
PyErr_Format.PYTHON310 ref: 61CD061F

Strings

too many values to unpack (expected %d), xrefs: 61CD0574
cannot unpack non-iterable %.200s object, xrefs: 61CD0611
not enough values to unpack (expected %d, got %d), xrefs: 61CD063D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$DeallocFormatIter_Next$CheckExceptionIterMatchesObject_OccurredSequence_
String ID: cannot unpack non-iterable %.200s object$not enough values to unpack (expected %d, got %d)$too many values to unpack (expected %d)
API String ID: 2492064420-2953850414
Opcode ID: 224b8fdaf8469154bcdc4b29a407f2cc88bfa41e49ca95c53d5af208a2519096
Instruction ID: b0e1e0a8e3f0cb19e75434d76ab230b714a1b645ffccfe76e9d81ce85982b160
Opcode Fuzzy Hash: 224b8fdaf8469154bcdc4b29a407f2cc88bfa41e49ca95c53d5af208a2519096
Instruction Fuzzy Hash: 31615A32A41A54C1EA069FAEE854B9D37B1FB89B98F498516CF1D87724FF39C0A5C340

Function 00007FF8A88929E0 Relevance: 33.6, APIs: 11, Strings: 8, Instructions: 340stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892B7A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892BF1
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892C15
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892C2E
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892C4A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892C63
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892CA2
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892CDA
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892CF0
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8892D1A

Strings

,, xrefs: 00007FF8A8892CE3
Proc-Type:, xrefs: 00007FF8A8892B70
, xrefs: 00007FF8A8892C59
, xrefs: 00007FF8A8892C40
Expecting: , xrefs: 00007FF8A8892F10
ENCRYPTED, xrefs: 00007FF8A8892C21
DEK-Info:, xrefs: 00007FF8A8892C97
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A8892A6E, 00007FF8A8892A82, 00007FF8A8892A96, 00007FF8A8892AB3, 00007FF8A8892AC5, 00007FF8A8892ADA, 00007FF8A8892B91, 00007FF8A8892BB9, 00007FF8A8892BCD, 00007FF8A8892C7E, 00007FF8A8892CB9, 00007FF8A8892D30, 00007FF8A8892D69, 00007FF8A8892D90, 00007FF8A8892E65, 00007FF8A8892E85, 00007FF8A8892E9E, 00007FF8A8892EB0, 00007FF8A8892ED0, 00007FF8A8892EED

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: strspn$strncmp$strcspn
String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Expecting: $Proc-Type:
API String ID: 232339659-387852012
Opcode ID: d3478d28586b3b591f2bcac79bc20f546f927b3c00999ee3a6f118fb3e088557
Instruction ID: c8185856c119b2f89d423adf68b3a7465fcfbb6cd92668c9a8f4c565b2c3e8a5
Opcode Fuzzy Hash: d3478d28586b3b591f2bcac79bc20f546f927b3c00999ee3a6f118fb3e088557
Instruction Fuzzy Hash: 24E19031B0AA42A6FB24CB66E4442BD33A1FB44BC8F444032CE5E17699EF3CE505C768

Function 61CC9C55 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172threadCOMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9C66
PyThreadState_Get.PYTHON310 ref: 61CCA331
_Py_CheckFunctionResult.PYTHON310 ref: 61CCA37C

Strings

bad marshal data (set size out of range), xrefs: 61CCABD8
bad marshal data (index list too large), xrefs: 61CCB229
NULL object in marshal data for set, xrefs: 61CCB016

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CheckErr_FunctionOccurredResultState_Thread
String ID: NULL object in marshal data for set$bad marshal data (index list too large)$bad marshal data (set size out of range)
API String ID: 3239669425-600355161
Opcode ID: 63a3907c0991a235b39106478c50d90af575934e1d876a29bcfbe65948725fbd
Instruction ID: 489273441d8a76056ce7026b48c0751f160f17bfcd86733764e484616f548976
Opcode Fuzzy Hash: 63a3907c0991a235b39106478c50d90af575934e1d876a29bcfbe65948725fbd
Instruction Fuzzy Hash: 5D716C32606A80C2EA548BAAE44875F3762F7C5F94F08C615C96E43764FF39C859C342

Function 00007FF6DFF71CD0 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 139COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6DFF71D5B
fread.MSVCRT ref: 00007FF6DFF71DC1
free.MSVCRT ref: 00007FF6DFF71DE9
fclose.MSVCRT ref: 00007FF6DFF71E26
fclose.MSVCRT ref: 00007FF6DFF71E2E

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

Strings

fread, xrefs: 00007FF6DFF71DD5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6DFF71EB3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6DFF71E63
malloc, xrefs: 00007FF6DFF71F08
Failed to extract %s: failed to open target file!, xrefs: 00007FF6DFF71EE9
Failed to create symbolic link %s!, xrefs: 00007FF6DFF71E4C
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6DFF71F01
fseek, xrefs: 00007FF6DFF71EBA
fopen, xrefs: 00007FF6DFF71EF0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6DFF71DCE
pyi_arch_extract2fs was called before temporary directory was C7Dlwp4kd!, xrefs: 00007FF6DFF71ED0
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6DFF71E93
fwrite, xrefs: 00007FF6DFF71E9A

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fclose$_wfopenfreadfreemalloc
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was C7Dlwp4kd!
API String ID: 414440483-498630463
Opcode ID: b13408b76eb0e99141bddfd40189e88921ac34e572f765c0f0b36de1127ee201
Instruction ID: 05246da2006250e099fa28456880935e3c98904ff6c2c717346b15934599d74d
Opcode Fuzzy Hash: b13408b76eb0e99141bddfd40189e88921ac34e572f765c0f0b36de1127ee201
Instruction Fuzzy Hash: AB518F61F0D54361FA259726A8506FE9341AF05BD8F980137DE3D8B3D6EE2CF9698380

Function 61CCDA70 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 473fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CCDCF5
PyErr_SetString.PYTHON310 ref: 61CCDF88
fwrite.MSVCRT ref: 61CCE1B0

Strings

too many objects, xrefs: 61CCDF7E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: fwrite$Err_String
String ID: too many objects
API String ID: 4210527972-4209268247
Opcode ID: cb3ee314a1d694b2752704733d0a291bc67a21529ac4d4e6903c36ec7d2abc66
Instruction ID: f116a3932838a3b2e9aafb9b8b07f600ac53492979bee5ddfd5ed1b35b93c02b
Opcode Fuzzy Hash: cb3ee314a1d694b2752704733d0a291bc67a21529ac4d4e6903c36ec7d2abc66
Instruction Fuzzy Hash: 26128DB2241B84C6DB14CFA9E0507AD77B1F349FA8F548216CA2D17B48EB79C992C3C1

Function 00007FF6DFF7EEB0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00007FF6DFF7EECF
_strdup.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EEE6
setlocale.MSVCRT ref: 00007FF6DFF7EEFE
mbstowcs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EF35
mbstowcs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7EFA6
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F0AD
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F0E6
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F115
realloc.MSVCRT ref: 00007FF6DFF7F130
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F15C
setlocale.MSVCRT ref: 00007FF6DFF7F16D
free.MSVCRT ref: 00007FF6DFF7F179
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F1A2
realloc.MSVCRT ref: 00007FF6DFF7F1BD
wcstombs.MSVCRT(?,?,?,?,?,?,?,?,_MEIPASS2,00000000,00007FF6DFF741F0), ref: 00007FF6DFF7F1E1
setlocale.MSVCRT ref: 00007FF6DFF7F1F2
free.MSVCRT ref: 00007FF6DFF7F1FE

Strings

_MEIPASS2, xrefs: 00007FF6DFF7EEB1

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
String ID: _MEIPASS2
API String ID: 1093732947-3944641314
Opcode ID: 148a141ac75870572ce124d50f5ef97fb7e269a6faeb8a9cf2d919f537363541
Instruction ID: 78298ad18791df875224fbdfa184275dc51ee32a66e523a363780aab3cab1705
Opcode Fuzzy Hash: 148a141ac75870572ce124d50f5ef97fb7e269a6faeb8a9cf2d919f537363541
Instruction Fuzzy Hash: 58A14966F08B6688EB509BA6D8442FD27B0FB08B98F404536DE6C97B99DF3DD421C350

Function 61CC8810 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

_PyFloat_Unpack8.PYTHON310 ref: 61CC8841
PyBuffer_FillInfo.PYTHON310 ref: 61CC8896
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC88A4
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC88C4
PyNumber_AsSsize_t.PYTHON310 ref: 61CC88E3
PyErr_SetString.PYTHON310 ref: 61CC8A11

Strings

marshal data too short, xrefs: 61CC8A07
EOF read where not expected, xrefs: 61CC8972
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC89E5

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFloat_FromInfoMemoryMethodNumber_Object_SizeSsize_tStringUnpack8View_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3670709071-4172231876
Opcode ID: 9e3eb5a2e51a8e3cb397f0a0a2d88eeda0ca6e461148420a7ef6f19f85d433e5
Instruction ID: d1e5cae50fcfcc34495485b6916299a7f5cad9b0e458749cd60be4b81cf9351e
Opcode Fuzzy Hash: 9e3eb5a2e51a8e3cb397f0a0a2d88eeda0ca6e461148420a7ef6f19f85d433e5
Instruction Fuzzy Hash: 91516131302A44C5EB459FAAE840B9E3371B785FE9F088315C96D577A8EF39C899D342

Function 61CC8A40 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8AC6
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8AD4
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8AF4
PyNumber_AsSsize_t.PYTHON310 ref: 61CC8B13
PyErr_SetString.PYTHON310 ref: 61CC8C41

Strings

marshal data too short, xrefs: 61CC8C37
EOF read where not expected, xrefs: 61CC8BA2
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC8C15

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFromInfoMemoryMethodNumber_Object_SizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3120701247-4172231876
Opcode ID: 069d7c9843d34cceb35874ba53cc2781da4af9a1019af3747f7b5d1852b76400
Instruction ID: 18e182607388718ae9b691add699b97fca9bf19069238830b87ccf0ff41d3862
Opcode Fuzzy Hash: 069d7c9843d34cceb35874ba53cc2781da4af9a1019af3747f7b5d1852b76400
Instruction Fuzzy Hash: BF415FB1306A04C1EE058BA9D854B8E3361B749FF8F588715CA2D47BE8EF39C956D342

Function 61CC8DA0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8E22
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8E30
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8E50
PyNumber_AsSsize_t.PYTHON310 ref: 61CC8E72
PyErr_Occurred.PYTHON310 ref: 61CC8E8B
PyErr_Format.PYTHON310 ref: 61CC8EBA
PyErr_SetString.PYTHON310 ref: 61CC8F63

Strings

marshal data too short, xrefs: 61CC8F57
EOF read where not expected, xrefs: 61CC8F37
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC8EB0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$BufferBuffer_CallFillFormatFromInfoMemoryMethodNumber_Object_OccurredSizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 2192429850-4172231876
Opcode ID: c7346fb6996e7c2f8c201d6470266c9c80c04d70d021b80e6eec92837ae56c6b
Instruction ID: f8c14aa7dc123b7ca5645f98113710212d6f8a8419f30d235480831a169d7329
Opcode Fuzzy Hash: c7346fb6996e7c2f8c201d6470266c9c80c04d70d021b80e6eec92837ae56c6b
Instruction Fuzzy Hash: 55416F31302A05C5EA158FAAE840B9E3362B799FE4F4C87258E2D477E4EF39C895D351

Function 61CC329E Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 94COMMON

Download Yara Rule

APIs

_PyObject_CallFunction_SizeT.PYTHON310 ref: 61CC32E8
PyErr_Clear.PYTHON310 ref: 61CC3304
PyErr_Format.PYTHON310 ref: 61CC3364
_PyObject_CallMethod_SizeT.PYTHON310(?,?,?,?,?,?), ref: 61CC33A3
_PyObject_CallMethod_SizeT.PYTHON310(?,?,?,?,?,?), ref: 61CC33B5
PySys_GetObject.PYTHON310 ref: 61CC3517
_Py_Dealloc.PYTHON310 ref: 61CC3573
getenv.MSVCRT ref: 61CC3647

Strings

PYARMOR_RKEY, xrefs: 61CC3640
close, xrefs: 61CC33AB
read, xrefs: 61CC3392
%s (%d:%d), xrefs: 61CC335D
%s/%s, xrefs: 61CC3652
%U.%s, xrefs: 61CC3523
executable, xrefs: 61CC3510
%U/%s, xrefs: 61CC32BF

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CallObject_Size$Err_Method_$ClearDeallocFormatFunction_ObjectSys_getenv
String ID: %U.%s$%U/%s$%s (%d:%d)$%s/%s$PYARMOR_RKEY$close$executable$read
API String ID: 2643494441-891831584
Opcode ID: f24a4c5e35f79677641a6c5f84d36f3c74eede24517995edd29c0d23837b3723
Instruction ID: 58e1ce739c980e848d4a1ef7a77c9949308e1e1f252faeedab31fb35bc8dc6e7
Opcode Fuzzy Hash: f24a4c5e35f79677641a6c5f84d36f3c74eede24517995edd29c0d23837b3723
Instruction Fuzzy Hash: 52313971741A54E1FA02DB66FC903D926A2BB85FC4F8C9422CD0A57764EF3EC956C381

Function 61CD06C0 Relevance: 27.2, APIs: 18, Instructions: 153COMMON

Download Yara Rule

APIs

PyObject_Call.PYTHON310 ref: 61CD0772
PyErr_CheckSignals.PYTHON310 ref: 61CD07A7
_Py_Dealloc.PYTHON310 ref: 61CD07C5
_Py_Dealloc.PYTHON310 ref: 61CD07D3
_Py_Dealloc.PYTHON310 ref: 61CD07E3

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dealloc$CallCheckErr_Object_Signals
String ID:
API String ID: 356930793-0
Opcode ID: 667a1198ef97de2a89fb9c356cea458a08b69397164a7e688454c2dbf018b660
Instruction ID: bb2d6defe0d13d62e1bbbd1944d7ec1414b5cf94b4e82e0540f19027898d74f3
Opcode Fuzzy Hash: 667a1198ef97de2a89fb9c356cea458a08b69397164a7e688454c2dbf018b660
Instruction Fuzzy Hash: BE516336A46A44D6EA099FAE994436D3775BB46F94F0EC125CF098AB10FF39C075C740

Function 00007FF8A8511150 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 188COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A85111DF
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A85111F7
PyType_IsSubtype.PYTHON310 ref: 00007FF8A851121A

Part of subcall function 00007FF8A85112F0: PyMem_Malloc.PYTHON310 ref: 00007FF8A8511372

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A8513617
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A851362D
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8513644
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A85136AD
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8513771

Strings

argument 1, xrefs: 00007FF8A851375C
invalid normalization form, xrefs: 00007FF8A851373D
str, xrefs: 00007FF8A8513763
normalize, xrefs: 00007FF8A851360A, 00007FF8A851376A
argument 2, xrefs: 00007FF8A8513753

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Unicode_$Equal$Arg_Ready$ArgumentCheckMallocMem_PositionalSubtypeType_
String ID: argument 1$argument 2$invalid normalization form$normalize$str
API String ID: 3079088272-4140678229
Opcode ID: 043ca2d8424091de15f9a914ae84487fadada3a8c3722cd01a5ffe64d96a38c2
Instruction ID: bcb3ba3bca2f37a95a70bc2c0f85966a4cb7b4abc501bb3e1bd831546feeae19
Opcode Fuzzy Hash: 043ca2d8424091de15f9a914ae84487fadada3a8c3722cd01a5ffe64d96a38c2
Instruction Fuzzy Hash: 8F81D220E4E682A1FBA0AB12DC147B96391FF49BC4F446171CE9E87795EF6CE405C328

Function 61CD2360 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2383
HeapAlloc.KERNEL32 ref: 61CD2397
GetAdaptersAddresses.IPHLPAPI ref: 61CD23BC
GetProcessHeap.KERNEL32 ref: 61CD242F
HeapFree.KERNEL32 ref: 61CD2439
GetProcessHeap.KERNEL32 ref: 61CD2450
HeapFree.KERNEL32 ref: 61CD245A
GetProcessHeap.KERNEL32 ref: 61CD2461
HeapAlloc.KERNEL32 ref: 61CD246B
GetAdaptersAddresses.IPHLPAPI ref: 61CD2487

Strings

%02x:%02x:%02x:%02x:%02x:%02x, xrefs: 61CD23F9
../src/platforms/windows/hdinfo.c, xrefs: 61CD24B7
Too small size, xrefs: 61CD24B0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree
String ID: %02x:%02x:%02x:%02x:%02x:%02x$../src/platforms/windows/hdinfo.c$Too small size
API String ID: 1283795797-3992030336
Opcode ID: ca2f2d58f6ccc6fa38a4598bcc9428a79d4f29ec2d6dcd793aaaf0ab3d192cb3
Instruction ID: 65c3b981a2463817d86091baf114bc3dd958c453a1b73d780c0d27a190a77a2d
Opcode Fuzzy Hash: ca2f2d58f6ccc6fa38a4598bcc9428a79d4f29ec2d6dcd793aaaf0ab3d192cb3
Instruction Fuzzy Hash: 6131AA317055518AD724DBBB681076E6BA2AB89B94F088126BE5C83798FF3CC541D750

Function 00007FF6DFF79070 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6DFF790A7
OpenProcessToken.ADVAPI32 ref: 00007FF6DFF790B8
free.MSVCRT ref: 00007FF6DFF790D0
CloseHandle.KERNEL32 ref: 00007FF6DFF790E0
_snwprintf.MSVCRT ref: 00007FF6DFF79108
LocalFree.KERNEL32 ref: 00007FF6DFF79111
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6DFF79137
CreateDirectoryW.KERNEL32 ref: 00007FF6DFF7914B
GetTokenInformation.ADVAPI32(?,?,?,00000000,?,00000012,00007FF6DFF7459C,00000000,00007FF6DFF783B5,?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000), ref: 00007FF6DFF79191
GetLastError.KERNEL32 ref: 00007FF6DFF79197
calloc.MSVCRT ref: 00007FF6DFF791B2
GetTokenInformation.ADVAPI32(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF791D8
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6DFF791ED

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6DFF790FA
S-1-3-4, xrefs: 00007FF6DFF790EB

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 1339360106-2855260032
Opcode ID: 0f7ef2776a1702e153f9070e199a20aa48cd80c646a4a307b911eb60a5f6c4ff
Instruction ID: 48a51b509f4d847f11b596faf44128210a837b704dd3b94994606d07f91fbb39
Opcode Fuzzy Hash: 0f7ef2776a1702e153f9070e199a20aa48cd80c646a4a307b911eb60a5f6c4ff
Instruction Fuzzy Hash: DE315021A08A4242E7209F62B8047AE6361FB85BA8F544236EE7D87BD4DF7DE419C700

Function 61CC1DF0 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61CC1E39
strncmp.MSVCRT ref: 61CC1E5F
strncmp.MSVCRT ref: 61CC1E7F
strncmp.MSVCRT ref: 61CC1E9C
strncmp.MSVCRT ref: 61CC1EB9
strncmp.MSVCRT ref: 61CC1ED6
PyErr_Format.PYTHON310 ref: 61CC1F3D
strlen.MSVCRT ref: 61CC1FAB
memcpy.MSVCRT ref: 61CC1FBF
free.MSVCRT ref: 61CC1FC7
strncmp.MSVCRT ref: 61CC1FD5
PyErr_Format.PYTHON310 ref: 61CC2057
strncmp.MSVCRT ref: 61CC2105
strncmp.MSVCRT ref: 61CC2143
strncmp.MSVCRT ref: 61CC235C
strncmp.MSVCRT ref: 61CC241C
strncmp.MSVCRT ref: 61CC24DC
_errno.MSVCRT ref: 61CC27A5
_errno.MSVCRT ref: 61CC27B7

Strings

*HARDDISK:, xrefs: 61CC1E4F
*IFIPV4:, xrefs: 61CC1E8C
%s (%d:%d), xrefs: 61CC1F36
*IFMAC:, xrefs: 61CC1E6F
*DOMAIN:, xrefs: 61CC1EC6
5(, xrefs: 61CC1F28
*IFIPV6:, xrefs: 61CC1EA9
*MID:, xrefs: 61CC1E2C

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strncmp$Err_Format_errno$freememcpystrlen
String ID: %s (%d:%d)$*DOMAIN:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*MID:$5(
API String ID: 3958490578-1731549688
Opcode ID: 7f386ca90869f4e7a942387e88c80bd49a34fdcf9a6c9116e47703f723d03f89
Instruction ID: a295d38a22b741a44c6a8958617485d58d30e48dd0c6ae9cb19b640851d97f5f
Opcode Fuzzy Hash: 7f386ca90869f4e7a942387e88c80bd49a34fdcf9a6c9116e47703f723d03f89
Instruction Fuzzy Hash: E1210F21310644A4FF10C727E85079A1AB1B78AFE9FC89119CC194B7E0EF3EC555C311

Function 61CD0080 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CD00B9
PyTuple_New.PYTHON310 ref: 61CD0123
PyList_New.PYTHON310 ref: 61CD0182
_PyList_Extend.PYTHON310 ref: 61CD01D0
_Py_Dealloc.PYTHON310 ref: 61CD01E4
PyDict_New.PYTHON310 ref: 61CD01F0
PyDict_Update.PYTHON310 ref: 61CD026F
_Py_Dealloc.PYTHON310 ref: 61CD0285

Strings

Invalid type for op_build, xrefs: 61CD02DC

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: List_$DeallocDict_$ExtendTuple_Update
String ID: Invalid type for op_build
API String ID: 3794787204-1006902009
Opcode ID: 8b848b1ebe1e0401444f0c0f79537a9a1f1e2d3ca6736aa3fc494c1ed3025b8f
Instruction ID: 8e60d559d8e50625d9406e054790ea63dc141bf61cfa479a7877722f45df768a
Opcode Fuzzy Hash: 8b848b1ebe1e0401444f0c0f79537a9a1f1e2d3ca6736aa3fc494c1ed3025b8f
Instruction Fuzzy Hash: 015171B2F46A15D2FA158BEDA94039E3761AB46BD4F49C025CF59C7714FE39C066C340

Function 61CD1530 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD1577
PyUnicode_New.PYTHON310 ref: 61CD1594
PyObject_Format.PYTHON310 ref: 61CD16BE
_Py_Dealloc.PYTHON310 ref: 61CD16E3
_Py_Dealloc.PYTHON310 ref: 61CD1778

Strings

Too many format strings, xrefs: 61CD156D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dealloc$Err_FormatObject_StringUnicode_
String ID: Too many format strings
API String ID: 3094464462-2091874682
Opcode ID: e76b4efb92dd775607a95ed8de22b90207bf7536f0e0b4de8b8ee96f2ebf8171
Instruction ID: 38a034a55f0220bc92c7ee0eb4041a51d8e3925213b29a6f58bed41b99d2c704
Opcode Fuzzy Hash: e76b4efb92dd775607a95ed8de22b90207bf7536f0e0b4de8b8ee96f2ebf8171
Instruction Fuzzy Hash: 4E514C32E49A44D1EA159FAEAA843AD6371E785BC4F4D8125CB1E47B24FF3DC056C340

Function 61CC1A30 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

PyEval_GetFrame.PYTHON310 ref: 61CC1A3E
PyUnicode_AsUTF8.PYTHON310 ref: 61CC1A96
PyModule_GetDict.PYTHON310 ref: 61CC1AAD
PyDict_GetItemString.PYTHON310 ref: 61CC1AC6
PyCFunction_GetSelf.PYTHON310 ref: 61CC1AD4
PyErr_Format.PYTHON310 ref: 61CC1B3A

Strings

%s (%d:%d), xrefs: 61CC1B25
__dict__, xrefs: 61CC1B8A
protection exception (%d), xrefs: 61CC1B57, 61CC1C66
__pyarmor__, xrefs: 61CC1ABC

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DictDict_Err_Eval_FormatFrameFunction_ItemModule_SelfStringUnicode_
String ID: %s (%d:%d)$__dict__$__pyarmor__$protection exception (%d)
API String ID: 3372622024-629680938
Opcode ID: 15c7fc33f5896b93769883d5e010b8e3bf1f1a198a9880ae34083bee89e35c38
Instruction ID: 4610eeff55b00fdfb2644be5fd803623954e208b5ea6f0da658819c4d6b11469
Opcode Fuzzy Hash: 15c7fc33f5896b93769883d5e010b8e3bf1f1a198a9880ae34083bee89e35c38
Instruction Fuzzy Hash: F6514B76701A44C5FF058BABD8947A82BB2EB88FD4F498426CE1D07764EE39C895C741

Function 61CD1EB0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON310 ref: 61CD1F1D
PyTuple_GetItem.PYTHON310 ref: 61CD1F49
PyType_IsSubtype.PYTHON310 ref: 61CD1F70
PyCMethod_New.PYTHON310 ref: 61CD1FC5
PyTuple_SetItem.PYTHON310 ref: 61CD1FDF
_Py_Dealloc.PYTHON310 ref: 61CD1FF3
_Py_Dealloc.PYTHON310 ref: 61CD200A
_Py_Dealloc.PYTHON310 ref: 61CD2057
PyCMethod_New.PYTHON310 ref: 61CD209C
Py_BuildValue.PYTHON310 ref: 61CD20B8

Strings

(O), xrefs: 61CD20B1

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dealloc$ItemMethod_Tuple_$BuildFunction_NameQualSubtypeType_ValueWith
String ID: (O)
API String ID: 593819998-4232840684
Opcode ID: a1d07191438c3203df9ef576c3f00bf2fc71539523c6d8a7c2afa6daa930401c
Instruction ID: 1115c37438059fc215d4035e6f29341d819684576f4c77d41474cbac9e7ff887
Opcode Fuzzy Hash: a1d07191438c3203df9ef576c3f00bf2fc71539523c6d8a7c2afa6daa930401c
Instruction Fuzzy Hash: BD519F32A46A40D2FA1A8F76A96479E77B3FB46B90F08C015CF5A46B14FF3AD054C340

Function 61CCED20 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_Py_fstat_noraise.PYTHON310 ref: 61CCED3D
PyMem_Malloc.PYTHON310 ref: 61CCED66
PyList_New.PYTHON310 ref: 61CCED91
PyErr_Occurred.PYTHON310 ref: 61CCEDAB
PyMem_Free.PYTHON310 ref: 61CCEDDB
fread.MSVCRT ref: 61CCEDFE
PyMarshal_ReadObjectFromString.PYTHON310 ref: 61CCEE09
PyMem_Free.PYTHON310 ref: 61CCEE15

Strings

XXX readobject called with exception set, xrefs: 61CCEE7D
NULL object in marshal data for object, xrefs: 61CCEE54

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Mem_$Free$Err_FromList_MallocMarshal_ObjectOccurredPy_fstat_noraiseReadStringfread
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 149595394-3392712392
Opcode ID: f3e1f9886c6417d397217a8bc0752abc05a9d312b5abb8e395e19855e5f03d6a
Instruction ID: 21c33ed99e0a5f421431a52060c602b0c8c3f8a4e93a71f1f5e3c9415696b905
Opcode Fuzzy Hash: f3e1f9886c6417d397217a8bc0752abc05a9d312b5abb8e395e19855e5f03d6a
Instruction Fuzzy Hash: E0319C31306A40C5EA068BABE8057AD6B61AB87FD8F088135DE0E47764EF3DC895C742

Function 00007FF6DFF73270 Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 203stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF73200: strcpy.MSVCRT(?,_MEIPASS2,00000000,?,00007FF6DFF7373B), ref: 00007FF6DFF73243

Part of subcall function 00007FF6DFF721D0: strlen.MSVCRT ref: 00007FF6DFF721E7

strcmp.MSVCRT ref: 00007FF6DFF733EA

Strings

%s%c%s, xrefs: 00007FF6DFF734BE
%s%c%s.exe, xrefs: 00007FF6DFF73499
_MEIPASS2, xrefs: 00007FF6DFF73279
Failed to open archive %s!, xrefs: 00007FF6DFF735EA
%s%c%s%c%s%c%s, xrefs: 00007FF6DFF73309, 00007FF6DFF73338
%s%c%s%c%s.pkg, xrefs: 00007FF6DFF7339A
Archive not found: %s, xrefs: 00007FF6DFF735A7
\, xrefs: 00007FF6DFF73358
\, xrefs: 00007FF6DFF733A4
pyi-contents-directory, xrefs: 00007FF6DFF732E1
Failed to extract %s, xrefs: 00007FF6DFF735CB
Failed to copy %s, xrefs: 00007FF6DFF73472
Archive path exceeds PATH_MAX, xrefs: 00007FF6DFF73590
pyi-contents-directory option not found in onedir bundle archive!, xrefs: 00007FF6DFF735D9

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strcmpstrcpystrlen
String ID: %s%c%s$%s%c%s%c%s%c%s$%s%c%s%c%s.pkg$%s%c%s.exe$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$_MEIPASS2$pyi-contents-directory$pyi-contents-directory option not found in onedir bundle archive!
API String ID: 895318938-736835633
Opcode ID: 702e52b45027c17a06724986362fbdf0f4889759a24ad9d8c37057623cd7ba2b
Instruction ID: 69450164bd7b0be1878251386ee4e2e1f836275fae7cd77695b9bee0338588af
Opcode Fuzzy Hash: 702e52b45027c17a06724986362fbdf0f4889759a24ad9d8c37057623cd7ba2b
Instruction Fuzzy Hash: 97915C61E08A82A1FA209B22E8406BEA750FF44B84F944533EE6DD7796DF3CE565C740

Function 61CC85F0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON310 ref: 61CC8643
PyMemoryView_FromBuffer.PYTHON310 ref: 61CC8655
_PyObject_CallMethodId_SizeT.PYTHON310 ref: 61CC8679
PyNumber_AsSsize_t.PYTHON310 ref: 61CC869B
PyErr_Occurred.PYTHON310 ref: 61CC86C4
PyErr_Format.PYTHON310 ref: 61CC86EF
PyMem_Realloc.PYTHON310 ref: 61CC8723
_Py_Dealloc.PYTHON310 ref: 61CC8768
PyMem_Malloc.PYTHON310 ref: 61CC8793
PyErr_NoMemory.PYTHON310 ref: 61CC87A5

Strings

EOF read where not expected, xrefs: 61CC8747
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CC86DF

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Mem_Memory$BufferBuffer_CallDeallocFillFormatFromInfoMallocMethodNumber_Object_OccurredReallocSizeSsize_tView_
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3190434935-3742967138
Opcode ID: 5e161c6b4e4cd385d4a1f359dcec4206cc105c1bb8b5ea6bb6f7c86bc9254928
Instruction ID: 07661c27151aa4aa4d3acd962b0b75fb0ac51764c83f53eefcd66fd08d5b843b
Opcode Fuzzy Hash: 5e161c6b4e4cd385d4a1f359dcec4206cc105c1bb8b5ea6bb6f7c86bc9254928
Instruction Fuzzy Hash: 71416371302A04C5FB019BA6E9447AE23A1B744FE8F488625DD2D57B94FF3DC4AAD341

Function 00007FF6DFF78680 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6DFF786CA
GetStartupInfoW.KERNEL32 ref: 00007FF6DFF786EC
_get_osfhandle.MSVCRT ref: 00007FF6DFF7873F
_fileno.MSVCRT ref: 00007FF6DFF7875C
_get_osfhandle.MSVCRT ref: 00007FF6DFF78763
_fileno.MSVCRT ref: 00007FF6DFF78780
_get_osfhandle.MSVCRT ref: 00007FF6DFF78787
GetCommandLineW.KERNEL32 ref: 00007FF6DFF78799
CreateProcessW.KERNEL32 ref: 00007FF6DFF787E1
WaitForSingleObject.KERNEL32 ref: 00007FF6DFF787F8
GetExitCodeProcess.KERNEL32 ref: 00007FF6DFF7880B

Strings

Error creating child process!, xrefs: 00007FF6DFF78828
CreateProcessW, xrefs: 00007FF6DFF7882F

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _get_osfhandle$Process_fileno$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2399235724-3524285272
Opcode ID: 3b0030d9226d0a67f6fd8a2a69a505053b30f609f3f5ca2460bb49168f4bcb83
Instruction ID: 7497dc90e2b607b2816a67bf43f3d738e048929d37efd09c1e4e18974d51fb92
Opcode Fuzzy Hash: 3b0030d9226d0a67f6fd8a2a69a505053b30f609f3f5ca2460bb49168f4bcb83
Instruction Fuzzy Hash: A8415E32A08B8245EB209B65F8147AEB360EB857A4F404736EABD877D4DF7CD094CB40

Function 00007FF6DFF74870 Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 203stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF7488D
strncmp.MSVCRT ref: 00007FF6DFF74911
strcmp.MSVCRT ref: 00007FF6DFF7492B

Strings

_MEIPASS2, xrefs: 00007FF6DFF74874
hash_seed, xrefs: 00007FF6DFF74B40
utf8, xrefs: 00007FF6DFF749FC
verbose, xrefs: 00007FF6DFF748C2
pyi-, xrefs: 00007FF6DFF748BB
unbuffered, xrefs: 00007FF6DFF748D1
dev, xrefs: 00007FF6DFF74A03
optimize, xrefs: 00007FF6DFF74978

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: callocstrcmpstrncmp
String ID: _MEIPASS2$dev$hash_seed$optimize$pyi-$unbuffered$utf8$verbose
API String ID: 3864021093-2470803696
Opcode ID: 1ebc1015cd89388c44d796f0e6af0bbaf2b2aa1507eb9976b7d4d29af4bb5d45
Instruction ID: d99546f7bad84ca07176bd2b7acb97aea0931cbe8399712e4d2665b26defed9f
Opcode Fuzzy Hash: 1ebc1015cd89388c44d796f0e6af0bbaf2b2aa1507eb9976b7d4d29af4bb5d45
Instruction Fuzzy Hash: 1181C262E0C653C6FB759F22A40437EEBA1AF45B98F048077CA6D87695DE3CE660C314

Function 61CDE440 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CDE680
calloc.MSVCRT ref: 61CDE697
free.MSVCRT ref: 61CDE6D8
free.MSVCRT ref: 61CDE6E0

Strings

kA != NULL, xrefs: 61CDEB4C
src/pk/ecc/ltc_ecc_map.c, xrefs: 61CDE5EA
A != NULL, xrefs: 61CDEB97
src/pk/ecc/ltc_ecc_mul2add.c, xrefs: 61CDEB13, 61CDEB2C, 61CDEB45, 61CDEB5E, 61CDEB77, 61CDEB90
P != NULL, xrefs: 61CDE5F1
C != NULL, xrefs: 61CDEB65
modulus != NULL, xrefs: 61CDEB1A
B != NULL, xrefs: 61CDEB7E
kB != NULL, xrefs: 61CDEB33

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: callocfree
String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
API String ID: 306872129-190324370
Opcode ID: abc542e885870fcf4d22c6f1b590d1024fc0e268d8b4cbd7982386b59b1c3973
Instruction ID: ee07c7d038212181e2c21ef639dc70789a937539cbc6d329731993a24f2b1c57
Opcode Fuzzy Hash: abc542e885870fcf4d22c6f1b590d1024fc0e268d8b4cbd7982386b59b1c3973
Instruction Fuzzy Hash: DAC16936A04A91C6EB60DFA6E84479EA765F789BD4F458022DF8D97708FF78C444C740

Function 61CDFEE0 Relevance: 21.3, APIs: 9, Strings: 5, Instructions: 254COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61CDFFBC
free.MSVCRT ref: 61CE0014
malloc.MSVCRT ref: 61CE004C
free.MSVCRT ref: 61CE00A1
free.MSVCRT ref: 61CE00AB
memcmp.MSVCRT ref: 61CE019D
memcmp.MSVCRT ref: 61CE0362
memcmp.MSVCRT ref: 61CE038B
free.MSVCRT ref: 61CE03A0

Strings

src/pk/rsa/rsa_verify_hash.c, xrefs: 61CE0130, 61CE0149, 61CE0162, 61CE017B
hash != NULL, xrefs: 61CE0182
stat != NULL, xrefs: 61CE0150
sig != NULL, xrefs: 61CE0169
key != NULL, xrefs: 61CE0137

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: free$memcmp$malloc
String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
API String ID: 2896619906-237625700
Opcode ID: cdf0dc33b3989645c12b7f16457730b6b26fd51d57ea4b930ad23a656de39b68
Instruction ID: 9c14a3dc1c968d2cb75374ac11061886468046beaf7aaf1018f8a0833cfe5a10
Opcode Fuzzy Hash: cdf0dc33b3989645c12b7f16457730b6b26fd51d57ea4b930ad23a656de39b68
Instruction Fuzzy Hash: 6BB15B726086C1CAE721CF52E44879EBBB1F385B88F448115DE8987B58EF7ED459CB80

Function 61CD134E Relevance: 21.1, APIs: 14, Instructions: 96COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CD1391
PyErr_Fetch.PYTHON310 ref: 61CD13CF
PyErr_NormalizeException.PYTHON310 ref: 61CD13E7
PyException_SetTraceback.PYTHON310 ref: 61CD1409
_Py_Dealloc.PYTHON310 ref: 61CD142B
PyErr_NormalizeException.PYTHON310 ref: 61CD143A
PyException_SetContext.PYTHON310 ref: 61CD1449
PyErr_Restore.PYTHON310 ref: 61CD145E
PyErr_Restore.PYTHON310 ref: 61CD148B
_Py_Dealloc.PYTHON310 ref: 61CD1493
PyEval_GetFrame.PYTHON310 ref: 61CD14A0
PyErr_Restore.PYTHON310 ref: 61CD14C8
PyTraceBack_Here.PYTHON310 ref: 61CD14D3
PyErr_Fetch.PYTHON310 ref: 61CD14E7

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Restore$DeallocExceptionException_FetchNormalize$Back_ContextEval_FrameHereOccurredTraceTraceback
String ID:
API String ID: 4214459649-0
Opcode ID: bc279d095d71dc5958acd298bddca9d93a9f204cec5f1c4559cb61f5e757b790
Instruction ID: 6a2b7a11836fbb89ac9e199c894cc2afa61d4b9108abfd94e2f95958890eb8e5
Opcode Fuzzy Hash: bc279d095d71dc5958acd298bddca9d93a9f204cec5f1c4559cb61f5e757b790
Instruction Fuzzy Hash: 3D41F876609B8095DA248B9AF84479EB772FB86BD4F488016DE8D43B28DF39C045CB41

Function 00007FF6DFF72AA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6DFF72AC8
memset.MSVCRT ref: 00007FF6DFF72B16
_wcsdup.MSVCRT ref: 00007FF6DFF72B26
_wcsdup.MSVCRT ref: 00007FF6DFF72B36
_wcsdup.MSVCRT ref: 00007FF6DFF72B46
DialogBoxIndirectParamW.USER32 ref: 00007FF6DFF72B68
free.MSVCRT ref: 00007FF6DFF72B78
free.MSVCRT ref: 00007FF6DFF72B85
free.MSVCRT ref: 00007FF6DFF72B92
DeleteObject.GDI32 ref: 00007FF6DFF72BA4
DestroyIcon.USER32 ref: 00007FF6DFF72BB7

Strings

Unhandled exception in script, xrefs: 00007FF6DFF72AD8

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
String ID: Unhandled exception in script
API String ID: 3963799495-2699770090
Opcode ID: 1399e865f07fc0c0e19deaee63d058363e1597f9915b3dc934ac45d2a049b452
Instruction ID: 62d9a89a007efd88d56bebd8bfefc60b244f0990eda904e135b20b255dddf3d2
Opcode Fuzzy Hash: 1399e865f07fc0c0e19deaee63d058363e1597f9915b3dc934ac45d2a049b452
Instruction Fuzzy Hash: 61215172A0DA8281EA219F62F8556FE6760FB85B84F440137EE5E87B55DF3CD025CB40

Function 00007FF8A8512500 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON310 ref: 00007FF8A8512520
PyType_FromSpec.PYTHON310 ref: 00007FF8A8512535
PyModule_AddType.PYTHON310 ref: 00007FF8A851254D
_Py_Dealloc.PYTHON310 ref: 00007FF8A8513F0D

Part of subcall function 00007FF8A8512650: _PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A8512563), ref: 00007FF8A8512656
Part of subcall function 00007FF8A8512650: PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A8512563), ref: 00007FF8A8512688

PyModule_AddObject.PYTHON310 ref: 00007FF8A8512582
PyModule_AddObjectRef.PYTHON310 ref: 00007FF8A85125AA
_Py_Dealloc.PYTHON310 ref: 00007FF8A8513F1C
_Py_Dealloc.PYTHON310 ref: 00007FF8A8513F3A

Part of subcall function 00007FF8A85125E0: PyMem_Malloc.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A85125EB
Part of subcall function 00007FF8A85125E0: PyCapsule_New.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A8512628

Strings

13.0.0, xrefs: 00007FF8A851250F
ucd_3_2_0, xrefs: 00007FF8A8512578
_ucnhash_CAPI, xrefs: 00007FF8A85125A0
unidata_version, xrefs: 00007FF8A8512519

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
String ID: 13.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 288921926-2302946913
Opcode ID: 7bbd23ebe987af1e45d56d99bc958bd3be6f45c1a216322346f2f04b6fdbad98
Instruction ID: 82b136e498e7ce5ac0605811737f126c10a5e05540389cc932fd8a0ca27bad41
Opcode Fuzzy Hash: 7bbd23ebe987af1e45d56d99bc958bd3be6f45c1a216322346f2f04b6fdbad98
Instruction Fuzzy Hash: 76215E34E0F607A1FA14BB61EC6017862E4FF49BD2F094134DE4E8A696DF2DE445C328

Function 61CD24F0 Relevance: 19.6, APIs: 13, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD2513
HeapAlloc.KERNEL32 ref: 61CD2527
GetAdaptersAddresses.IPHLPAPI ref: 61CD254F
inet_ntoa.WS2_32 ref: 61CD2587
GetProcessHeap.KERNEL32 ref: 61CD25A2
HeapFree.KERNEL32 ref: 61CD25AC
GetProcessHeap.KERNEL32 ref: 61CD25C0
HeapFree.KERNEL32 ref: 61CD25CA
GetProcessHeap.KERNEL32 ref: 61CD25D0
HeapAlloc.KERNEL32 ref: 61CD25DA
GetAdaptersAddresses.IPHLPAPI ref: 61CD25F9

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree$inet_ntoa
String ID:
API String ID: 4108032510-0
Opcode ID: 0a193b1382c6ee67ce8b200a9a45184054f27719d668eb37d67997e2c14390e3
Instruction ID: ffce72e93d11d0278465436b82118428d82e4efe2c04a4905c7ec913ddfb64a4
Opcode Fuzzy Hash: 0a193b1382c6ee67ce8b200a9a45184054f27719d668eb37d67997e2c14390e3
Instruction Fuzzy Hash: 1321F662B0574096E714D7BBAC20B5E6692BB8ABD4F08C235AE1D473A4FF38C442C750

Function 61CC4D71 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163threadCOMMON

Download Yara Rule

APIs

Part of subcall function 61CCEFA0: PyList_New.PYTHON310 ref: 61CCEFDB
Part of subcall function 61CCEFA0: PyErr_Occurred.PYTHON310 ref: 61CCEFFA
Part of subcall function 61CCEFA0: PyMem_Free.PYTHON310 ref: 61CCF028

_PyDict_GetItemIdWithError.PYTHON310 ref: 61CCFA72
PyThreadState_Get.PYTHON310 ref: 61CCFAD5
_Py_CheckFunctionResult.PYTHON310 ref: 61CCFB1F
_Py_Dealloc.PYTHON310 ref: 61CCFB53
_PyObject_MakeTpCall.PYTHON310 ref: 61CCFBAA
_Py_Dealloc.PYTHON310 ref: 61CCFBC0
_PyLong_AsInt.PYTHON310 ref: 61CCFC03
PyImport_ImportModuleLevelObject.PYTHON310 ref: 61CCFC2B
_Py_Dealloc.PYTHON310 ref: 61CCFC5D

Strings

__import__ not found, xrefs: 61CCFBDC

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dealloc$CallCheckDict_Err_ErrorFreeFunctionImportImport_ItemLevelList_Long_MakeMem_ModuleObjectObject_OccurredResultState_ThreadWith
String ID: __import__ not found
API String ID: 1209477609-2199325508
Opcode ID: b90bd15760f08aeab28d1177f723d9691f3df14adbb9ce0193edb1d4bb711379
Instruction ID: 32a19a13ac0aedeaea35100d4ec3dff813b3b0ae98b73214a5e592fd659831ca
Opcode Fuzzy Hash: b90bd15760f08aeab28d1177f723d9691f3df14adbb9ce0193edb1d4bb711379
Instruction Fuzzy Hash: 21517A32205B84D6EB458F66E96039E67A1F749FE4F089126DE4E07B64EF3DC8A5C300

Function 00007FF6DFF76BD0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF76BF9
memcpy.MSVCRT ref: 00007FF6DFF76C3D
strlen.MSVCRT ref: 00007FF6DFF76C57
strlen.MSVCRT ref: 00007FF6DFF76C64
strlen.MSVCRT ref: 00007FF6DFF76C90
free.MSVCRT ref: 00007FF6DFF76CE3
strncpy.MSVCRT ref: 00007FF6DFF76D3D
strncpy.MSVCRT ref: 00007FF6DFF76D6A
strncpy.MSVCRT ref: 00007FF6DFF76DD9

Strings

SPLASH: Cannot extract requirement %s., xrefs: 00007FF6DFF76DA3
_MEIPASS2, xrefs: 00007FF6DFF76BD9
SPLASH: Cannot find requirement %s in archive., xrefs: 00007FF6DFF76CCF

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlenstrncpy$callocfreememcpy
String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
API String ID: 4189425833-927121926
Opcode ID: fcb698b9ce71179655e8d018370367643db60866aa6261040852d0da1733547b
Instruction ID: 1ade13fce3f264ad864ed2fc2948badbf84ee6a50d2d58c2a3da47ddf2bdf5ae
Opcode Fuzzy Hash: fcb698b9ce71179655e8d018370367643db60866aa6261040852d0da1733547b
Instruction Fuzzy Hash: F641C551F0C64295EA24EA23A8146FEA755FF44FC8F444132EE2DC7786DE2CE265C300

Function 00007FF6DFF769E0 Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 00007FF6DFF76A41
strncpy.MSVCRT ref: 00007FF6DFF76A57
strncpy.MSVCRT ref: 00007FF6DFF76A6D
calloc.MSVCRT ref: 00007FF6DFF76AA3
malloc.MSVCRT ref: 00007FF6DFF76AC3
malloc.MSVCRT ref: 00007FF6DFF76AE3
memcpy.MSVCRT ref: 00007FF6DFF76B17
memcpy.MSVCRT ref: 00007FF6DFF76B2C
memcpy.MSVCRT ref: 00007FF6DFF76B41
free.MSVCRT ref: 00007FF6DFF76B49

Strings

_MEIPASS2, xrefs: 00007FF6DFF769E4
Cannot allocate memory for necessary files., xrefs: 00007FF6DFF76B61

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: memcpystrncpy$malloc$callocfree
String ID: Cannot allocate memory for necessary files.$_MEIPASS2
API String ID: 1819673767-1389504347
Opcode ID: 787acaf8368f2bd4104b9299faa6259621256a267846ec07b1dfe6e80cc8ca8b
Instruction ID: 5b382e8a35e4ef0be4d43a2509c60334f842d77a650e38e39b54c8b68744ae19
Opcode Fuzzy Hash: 787acaf8368f2bd4104b9299faa6259621256a267846ec07b1dfe6e80cc8ca8b
Instruction Fuzzy Hash: B14108A2F0964157EA28EB22A5441EDA761FB45B84F444432DF2D87781DF7CF1718304

Function 61D40300 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,61CC1278), ref: 61D4042D

Strings

Unknown pseudo relocation bit size %d., xrefs: 61D4059A
Unknown pseudo relocation protocol version %d., xrefs: 61D405AE

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 59c0639059f1de7426e42343b308dab7926fc0ad809ccbc59e74e43cdf97b45a
Instruction ID: d2df6a0a1c7d14db71b0b873ac793081304a4f184ed108e8b27f747019f9d7ee
Opcode Fuzzy Hash: 59c0639059f1de7426e42343b308dab7926fc0ad809ccbc59e74e43cdf97b45a
Instruction Fuzzy Hash: 99913371B1024187FB008BB598807CE2772ABA97E8F64C515CE6EC77A8EB3DD482C751

Function 61CD4130 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD414A
malloc.MSVCRT ref: 61CD4156
memcpy.MSVCRT ref: 61CD4175
strchr.MSVCRT ref: 61CD4254
free.MSVCRT ref: 61CD4286

Strings

http://, xrefs: 61CD41E1
or,, xrefs: 61CD418A
and,, xrefs: 61CD4183
local, xrefs: 61CD41C3

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: freemallocmemcpystrchrstrlen
String ID: and,$http://$local$or,
API String ID: 3771145599-2506292620
Opcode ID: cac4630ccfb9731fb3f67555f3dd105eaa784011ba8c730ed969294854159610
Instruction ID: 05d5f84868cb5772b7d5b5c9e0ff3ce35dd773275e609616f31cc00333977d42
Opcode Fuzzy Hash: cac4630ccfb9731fb3f67555f3dd105eaa784011ba8c730ed969294854159610
Instruction Fuzzy Hash: 3C31E621B06658D1FA118BA3A9003AD6B65E742BF8F88C7258F3817FD4FB3AD056C351

Function 00007FF6DFF72410 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6DFF72431
SelectObject.GDI32 ref: 00007FF6DFF72488
DrawTextW.USER32 ref: 00007FF6DFF724AB
SelectObject.GDI32 ref: 00007FF6DFF724C1
ReleaseDC.USER32 ref: 00007FF6DFF724D1
MoveWindow.USER32 ref: 00007FF6DFF7251D
MoveWindow.USER32 ref: 00007FF6DFF7255C
MoveWindow.USER32 ref: 00007FF6DFF725AD
MoveWindow.USER32 ref: 00007FF6DFF725EA

Strings

P%, xrefs: 00007FF6DFF72491

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 634056c5d82886171c5826ebe08236f1ab83107b6a9b60c113236062154ca025
Instruction ID: a392f66cc7a4393c07e568f2692e8b0165ab0fb2e4dec9662cfd9cf96ebf50ec
Opcode Fuzzy Hash: 634056c5d82886171c5826ebe08236f1ab83107b6a9b60c113236062154ca025
Instruction Fuzzy Hash: 4A4165766146A18AD7208F26E44876D77A1F788F99F084232EE8987B59DF3CD145CB20

Function 00007FF8A8514744 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A8514777
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A85147AC
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A85147BF
_PyUnicode_ToDigit.PYTHON310 ref: 00007FF8A851485D
PyErr_SetString.PYTHON310 ref: 00007FF8A851487D
PyLong_FromLong.PYTHON310 ref: 00007FF8A8514891

Strings

digit, xrefs: 00007FF8A8514770, 00007FF8A851479E
a unicode character, xrefs: 00007FF8A8514797
argument 1, xrefs: 00007FF8A85147A5
not a digit, xrefs: 00007FF8A8514873

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_Unicode_$ArgumentCheckDigitErr_FromLongLong_PositionalReadyString
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 2437920334-4278345224
Opcode ID: ccb09f388915106ffe9f25cd2f8b5f89e24ca1c0215dd7662e71457763ebd078
Instruction ID: 1d1866d25da5f06ffa420e034cc97bc46438aded201c775176e3550acf2a3b31
Opcode Fuzzy Hash: ccb09f388915106ffe9f25cd2f8b5f89e24ca1c0215dd7662e71457763ebd078
Instruction Fuzzy Hash: DB416C31F1A686B1FB50AB55DC5027923A2FF84BC4F54A435CE1D87A94DF2DE846C328

Function 61CC9BB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9BC1
PyList_New.PYTHON310 ref: 61CCA424

Strings

bad marshal data (list size out of range), xrefs: 61CCA911
NULL object in marshal data for list, xrefs: 61CCAFC7

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_List_Occurred
String ID: NULL object in marshal data for list$bad marshal data (list size out of range)
API String ID: 1902535023-3453879413
Opcode ID: 869f04f9993b646e28468f1d71b9ecd04acc7ee3c5e1653433e89f15c32e4b80
Instruction ID: 4acf48295f5d4d2d0bd595fcecad967f2ca8683d7aaec8b9391213bc3d45cd8d
Opcode Fuzzy Hash: 869f04f9993b646e28468f1d71b9ecd04acc7ee3c5e1653433e89f15c32e4b80
Instruction Fuzzy Hash: 72312D31646A40C6EA15CFAAE58C79E67A2BBC5FC8F09D415C90E47724FF3AC859C341

Function 61CC9E04 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9E15
PyTuple_New.PYTHON310 ref: 61CCA3BF

Strings

NULL object in marshal data for tuple, xrefs: 61CCADFB
bad marshal data (tuple size out of range), xrefs: 61CCABF9

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_OccurredTuple_
String ID: NULL object in marshal data for tuple$bad marshal data (tuple size out of range)
API String ID: 3674511531-3094253248
Opcode ID: 1334e0673d9c89cb7a7049411a0caaba6fbb731a10c7b1f1db972c729159dde3
Instruction ID: 299701401bb9393f3e24d90e1baca591a7132edfb7ce92f726f11b4f58dfb253
Opcode Fuzzy Hash: 1334e0673d9c89cb7a7049411a0caaba6fbb731a10c7b1f1db972c729159dde3
Instruction Fuzzy Hash: F3212B31246A40C1EE14CFAAD59C75E27A6BBC5F95F0AC414CD0E57324FE39C896C382

Function 61CD8B30 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 356stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD8CF6

Strings

8, xrefs: 61CD9029
?, xrefs: 61CD8BD9
src/hashes/md5.c, xrefs: 61CD8C47, 61CD8C60
md != NULL, xrefs: 61CD8C4E
?, xrefs: 61CD8D4C
@, xrefs: 61CD8CAD
MD5, xrefs: 61CD8D87
in != NULL, xrefs: 61CD8C67

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strlen
String ID: 8$?$?$@$MD5$in != NULL$md != NULL$src/hashes/md5.c
API String ID: 39653677-3461814546
Opcode ID: c50d777c546e1ed56edb68ea0b9bf3e93e1026468edbe4b7871622637cec59c4
Instruction ID: 79f021dadd2eaa991624bd799e1ed7055a4ea2aa32b8075367629a0c3cc96ed7
Opcode Fuzzy Hash: c50d777c546e1ed56edb68ea0b9bf3e93e1026468edbe4b7871622637cec59c4
Instruction Fuzzy Hash: 96D103B3A082C1CAF705CB9AE454B6EBFA1E395388F44A009DF821BB44E77DD445DB42

Function 00007FF8A8512740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A8512768
__scrt_initialize_crt.LIBCMT ref: 00007FF8A85127AD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A85127BA
_RTC_Initialize.LIBCMT ref: 00007FF8A85127E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A851280E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A8512839

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: d9075fb2b0ba11a0ca4eca901d47b6c9aa6f7dca5772fbcecca27907c885e73c
Instruction ID: 3cd910bc548db668a688bb09891fb9436149a1a44dfc4f591d8cca86cd1bec6e
Opcode Fuzzy Hash: d9075fb2b0ba11a0ca4eca901d47b6c9aa6f7dca5772fbcecca27907c885e73c
Instruction Fuzzy Hash: 9181AC21E0E243BAFA94FB65AC512B966D1EF857C0F148035DE4C43BA6DF7CE8458728

Function 00007FF8A86E71FD Relevance: 16.7, APIs: 4, Strings: 7, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A888ACA8
strchr.VCRUNTIME140 ref: 00007FF8A888AD52
strchr.VCRUNTIME140 ref: 00007FF8A888ADB2
strchr.VCRUNTIME140 ref: 00007FF8A888ADCA

Strings

https, xrefs: 00007FF8A888ACF2
..\s\crypto\ocsp\ocsp_lib.c, xrefs: 00007FF8A888AC7F, 00007FF8A888AD57, 00007FF8A888ADE1, 00007FF8A888ADFF, 00007FF8A888AE1C, 00007FF8A888AE54, 00007FF8A888AE69, 00007FF8A888AE7B, 00007FF8A888AE90, 00007FF8A888AEAA
[, xrefs: 00007FF8A888AD9F
/, xrefs: 00007FF8A888AD37
/, xrefs: 00007FF8A888AD2D
443, xrefs: 00007FF8A888AD17
http, xrefs: 00007FF8A888ACBC

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: strchr
String ID: ..\s\crypto\ocsp\ocsp_lib.c$/$/$443$[$http$https
API String ID: 2830005266-535551730
Opcode ID: 3599b5d8e7b23bca4aa89a6d289242b8b2e1b5dd0b052be938d3549ec404f259
Instruction ID: 9a574c47553e30fd8e5216530393d84a67cacc4aa789c29c35e19f618c7f2bcb
Opcode Fuzzy Hash: 3599b5d8e7b23bca4aa89a6d289242b8b2e1b5dd0b052be938d3549ec404f259
Instruction Fuzzy Hash: E561A925B0AB42AAFB15DB15E8182B93761FB85BC0F894031DA8D07392EF3DE545C739

Function 61CDD9E0 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDDA0B
strcmp.MSVCRT ref: 61CDDA35
strcmp.MSVCRT ref: 61CDDA54
strcmp.MSVCRT ref: 61CDDA73
strcmp.MSVCRT ref: 61CDDA92
strcmp.MSVCRT ref: 61CDDAAD
strcmp.MSVCRT ref: 61CDDAC8
strcmp.MSVCRT ref: 61CDDAE3

Strings

aes, xrefs: 61CDD9E3
name != NULL, xrefs: 61CDDB18
src/misc/crypt/crypt_find_hash.c, xrefs: 61CDDB11

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strcmp
String ID: aes$name != NULL$src/misc/crypt/crypt_find_hash.c
API String ID: 1004003707-455514378
Opcode ID: a2a4b03777c91be731f4a5a861865b9b9e5ca0b06c2674fbe3e03d9027fade8a
Instruction ID: 3b6290dc194937907d646660ff824a9932a5119ea06ec433b4bcb1f250da228a
Opcode Fuzzy Hash: a2a4b03777c91be731f4a5a861865b9b9e5ca0b06c2674fbe3e03d9027fade8a
Instruction Fuzzy Hash: 93314F61B0668699FF15CFA6CA947FE6725AB81BD8F04C110CF2A8B984FF14E109C751

Function 61CC9E90 Relevance: 16.6, APIs: 11, Instructions: 85COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON310 ref: 61CC9E90
PyList_Append.PYTHON310 ref: 61CCA126
PyDict_SetItem.PYTHON310 ref: 61CCA186
_Py_Dealloc.PYTHON310 ref: 61CCA1AB

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dict_$AppendDeallocItemList_
String ID:
API String ID: 2970173465-0
Opcode ID: 3750ea80905449795f0ed7eb0e2e69e055f61f8138e482fa179e90dc0206f2e8
Instruction ID: 82137f028307a987bb4f44fe7386923eb422282a4fb6defb855b8119da67335d
Opcode Fuzzy Hash: 3750ea80905449795f0ed7eb0e2e69e055f61f8138e482fa179e90dc0206f2e8
Instruction Fuzzy Hash: B7313831646A80D5EA158FA6E84835E23B5BBCAFD4F08C024CE4E56724FE3EC891C342

Function 61CD28F0 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61CD290B
HeapAlloc.KERNEL32 ref: 61CD291F
GetNetworkParams.IPHLPAPI ref: 61CD2957
GetProcessHeap.KERNEL32 ref: 61CD2979
HeapFree.KERNEL32 ref: 61CD2983
GetProcessHeap.KERNEL32 ref: 61CD29A0
HeapFree.KERNEL32 ref: 61CD29AA
GetProcessHeap.KERNEL32 ref: 61CD29B1
HeapAlloc.KERNEL32 ref: 61CD29BB
GetProcessHeap.KERNEL32 ref: 61CD29D6
HeapFree.KERNEL32 ref: 61CD29E0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$NetworkParams
String ID:
API String ID: 3483679945-0
Opcode ID: d9f1ccaa99a51a1757a863b0196e384b4b9e305eaa7d108583507cf1e9d094f6
Instruction ID: 0065ee97b67677d9e6fe9ecf7907c02b5863d38fa8f4cb2ca61862724a1e87b7
Opcode Fuzzy Hash: d9f1ccaa99a51a1757a863b0196e384b4b9e305eaa7d108583507cf1e9d094f6
Instruction Fuzzy Hash: 2C11B66170565694EA14E7F77C107AE96926BCABE8F4CC136AE2C973A4FE38C142C311

Function 61CC1660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC16ED
PyErr_Occurred.PYTHON310 ref: 61CC178E

Strings

%s (%d:%d), xrefs: 61CC16DB

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: %s (%d:%d)
API String ID: 4038069558-1595188566
Opcode ID: ab844dd0573c5d4e5db60297e75af00a480c6ebc469f50d619f5e798285aab1f
Instruction ID: a1357b21aacc039950d7f2b264206db2938625585142f03a64017ec67e299faf
Opcode Fuzzy Hash: ab844dd0573c5d4e5db60297e75af00a480c6ebc469f50d619f5e798285aab1f
Instruction Fuzzy Hash: F241AE72615780C6EB048BAFA4513AE7B71F78AFD8F4D8025CE4E07B24EE29C941C781

Function 61D40850 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 61D408A9
signal.MSVCRT ref: 61D40902
signal.MSVCRT ref: 61D4095E
signal.MSVCRT ref: 61D40A13

Strings

CCG , xrefs: 61D40865

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 3fd33f9d0d8be5c47111497dc89fdfb5665315b94049332a99d209a55ae08ee2
Instruction ID: 1086af72c84e07eb131889e1e483c2ba92bf57371fd9bb8d3e6ea21d20e2bb0b
Opcode Fuzzy Hash: 3fd33f9d0d8be5c47111497dc89fdfb5665315b94049332a99d209a55ae08ee2
Instruction Fuzzy Hash: A6318E24B4A00185FF1953F944603E915616BEF3F8F1CCB1A8ABEC73E5DE6C98D04652

Function 61CC9890 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC98A0
PyUnicode_DecodeUTF8.PYTHON310 ref: 61CCA06F

Strings

surrogatepass, xrefs: 61CCA065
bad marshal data (string size out of range), xrefs: 61CCA846

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DecodeErr_OccurredUnicode_
String ID: bad marshal data (string size out of range)$surrogatepass
API String ID: 1138423624-4021928140
Opcode ID: 45ebbcbf1cf93850d7e84a196a691875e40f79ef29fc15d5c5264f980fa23018
Instruction ID: 609a780dbf2ee67ae141395d6db29a95697d82223c69f8486f53894b4b69ddb5
Opcode Fuzzy Hash: 45ebbcbf1cf93850d7e84a196a691875e40f79ef29fc15d5c5264f980fa23018
Instruction Fuzzy Hash: 88314D326466A0C2EA168F16D44879F7365FB89FD4F09C510CE4917728FE39D88AC785

Function 00007FF8A8514AFC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514B29
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A8514B5B
PyUnicode_Compare.PYTHON310 ref: 00007FF8A8514BBE
_Py_Dealloc.PYTHON310 ref: 00007FF8A8514BCF
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A8514BE3
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A8514C03
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A8514C1B
PyErr_SetString.PYTHON310 ref: 00007FF8A8514C3E

Strings

invalid normalization form, xrefs: 00007FF8A8514C34

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
String ID: invalid normalization form
API String ID: 3010910608-2281882113
Opcode ID: db7500ed328ea89a7218ce296b7fc290dacc1b6cdf2a18ecf46c4dd9d09d4559
Instruction ID: 71a0c33618609e0fe7cb48fe522598173810ebf1de50c0076266791099363cdd
Opcode Fuzzy Hash: db7500ed328ea89a7218ce296b7fc290dacc1b6cdf2a18ecf46c4dd9d09d4559
Instruction Fuzzy Hash: 65418B35B0EA43A5EE54AB52AC4433963A2FF48BC8F845435CE4E473A0DF2DE404C328

Function 61CC7FE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65stringCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON310 ref: 61CC800E
PyErr_Fetch.PYTHON310 ref: 61CC8023
PyErr_Restore.PYTHON310 ref: 61CC8038
PyObject_Str.PYTHON310 ref: 61CC8048
strerror.MSVCRT ref: 61CC8055
PyErr_Format.PYTHON310 ref: 61CC8091

Strings

%s (%d:%d), xrefs: 61CC8084

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$FetchFormatFromObject_RestoreWindowsstrerror
String ID: %s (%d:%d)
API String ID: 2858978339-1595188566
Opcode ID: d63ce9bf5b9824030ec72d4fa0ff26b3671df568a50a260d73afc1111a553404
Instruction ID: 8635a65c7f948038af4ff0fac613359872b2aa091ba8cd86f5b7a600d28d4a10
Opcode Fuzzy Hash: d63ce9bf5b9824030ec72d4fa0ff26b3671df568a50a260d73afc1111a553404
Instruction Fuzzy Hash: E8219A32A05A44C1EB018B69E8507DE7761FB8AF84F8A8026CE4E13364DF3EC846D380

Function 61CCEFA0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 58fileCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CCEFDB
PyErr_Occurred.PYTHON310 ref: 61CCEFFA
PyMem_Free.PYTHON310 ref: 61CCF028
fwrite.MSVCRT ref: 61CCF072
PyErr_Occurred.PYTHON310 ref: 61CCF080
PyErr_SetString.PYTHON310 ref: 61CCF098

Strings

XXX readobject called with exception set, xrefs: 61CCF05D
NULL object in marshal data for object, xrefs: 61CCF08E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Occurred$FreeList_Mem_Stringfwrite
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 4281374468-3392712392
Opcode ID: 8438a1c87a4b2bbec939fc54df27e198a94b133ca46fb1e5dc5b828edf7629eb
Instruction ID: 9f368714134e026e18bc32ba3b626a9dbb47166204ea6cc415a7d1c5f63f9fa7
Opcode Fuzzy Hash: 8438a1c87a4b2bbec939fc54df27e198a94b133ca46fb1e5dc5b828edf7629eb
Instruction Fuzzy Hash: F121B431206B40C9EB148BA5F84439E7771FB85F88F188029D98E43768EF7EC855C751

Function 00007FF8A8514A10 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A8514A3C
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514A71
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514A81
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514AC0
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514AD0

Strings

is_normalized, xrefs: 00007FF8A8514A2F, 00007FF8A8514A63, 00007FF8A8514AB2
argument 1, xrefs: 00007FF8A8514A6A
str, xrefs: 00007FF8A8514A5C, 00007FF8A8514AAB
argument 2, xrefs: 00007FF8A8514AB9

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: 9d1203bcce706692093d0a19077d82ede6903c2045b72994e20d8ca9bfefa43b
Instruction ID: df559062510526490ef9e563ad499807edfbd4c9cb1d8fd49c5b0f64c139288d
Opcode Fuzzy Hash: 9d1203bcce706692093d0a19077d82ede6903c2045b72994e20d8ca9bfefa43b
Instruction Fuzzy Hash: 8921D320A09A87A5E750AB65EC442B92392FF44BD9F496131DE1D077E4CF2CE446C32C

Function 61CCEEB0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON310 ref: 61CCEED3
PyErr_Occurred.PYTHON310 ref: 61CCEEED
PyMem_Free.PYTHON310 ref: 61CCEF1B
fwrite.MSVCRT ref: 61CCEF62
PyErr_Occurred.PYTHON310 ref: 61CCEF70
PyErr_SetString.PYTHON310 ref: 61CCEF88

Strings

XXX readobject called with exception set, xrefs: 61CCEF4D
NULL object in marshal data for object, xrefs: 61CCEF7E

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Occurred$FreeList_Mem_Stringfwrite
String ID: NULL object in marshal data for object$XXX readobject called with exception set
API String ID: 4281374468-3392712392
Opcode ID: 9bc73786e3ecb989be935dd0012c40977b2ce73ccc74614b09afcfdd4326b992
Instruction ID: 64225f5ed26077c81b9016baf140bed9add4601898762622e0a93ee42f2a24d3
Opcode Fuzzy Hash: 9bc73786e3ecb989be935dd0012c40977b2ce73ccc74614b09afcfdd4326b992
Instruction Fuzzy Hash: D811BF31206A41C1FA059BAAF8457AD7B70BB8AF88F1C8125ED4D02724FF3DC856C741

Function 61CCEB90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 61CCEB9F
fread.MSVCRT ref: 61CCEBC2
PyMem_Free.PYTHON310 ref: 61CCEBE2
PyErr_Occurred.PYTHON310 ref: 61CCEBF2
PyErr_Format.PYTHON310 ref: 61CCEC22
PyErr_NoMemory.PYTHON310 ref: 61CCEC50

Strings

EOF read where not expected, xrefs: 61CCEC37
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CCEC18

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: 2b034edb9111519eb2c38ac10b8020e403966ed57b39285113f5faf58694faca
Instruction ID: c0313f20954674310e1336330b1018cc10dadb7061bd36615e2f3d7424ba42db
Opcode Fuzzy Hash: 2b034edb9111519eb2c38ac10b8020e403966ed57b39285113f5faf58694faca
Instruction Fuzzy Hash: 5B110830705650C1FB144BBBE8567A92B62B74AFD8F0C8221CD5E437A4EE2D8955C351

Function 00007FF6DFF78B30 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF6DFF78B72
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78BB2
GetLastError.KERNEL32 ref: 00007FF6DFF78BF8

Strings

No error messages generated., xrefs: 00007FF6DFF78BD0
WideCharToMultiByte, xrefs: 00007FF6DFF78B36, 00007FF6DFF78C17
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6DFF78C23
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6DFF78C10
FormatMessageW, xrefs: 00007FF6DFF78BD7
PyInstaller: FormatMessageW failed., xrefs: 00007FF6DFF78BE3

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 1653872744-2573406579
Opcode ID: a444a6fb349bc4707b2cf69bc53a33dba0618e531a6d6d2ca6af9caf27ae63ed
Instruction ID: ce4d7e3390e0c1b346711bc6b0ea684389290f9c303fafd0d7a854543b9cda1d
Opcode Fuzzy Hash: a444a6fb349bc4707b2cf69bc53a33dba0618e531a6d6d2ca6af9caf27ae63ed
Instruction Fuzzy Hash: 3121AFB1E0CB0391F7209B15F8547AE6361AF88388F548636E96D836A4DF3CE569C700

Function 61CCEC60 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 61CCEC6F
fread.MSVCRT ref: 61CCEC92
PyMem_Free.PYTHON310 ref: 61CCECA5
PyErr_Occurred.PYTHON310 ref: 61CCECB5
PyErr_Format.PYTHON310 ref: 61CCECE5
PyErr_NoMemory.PYTHON310 ref: 61CCED10

Strings

EOF read where not expected, xrefs: 61CCECF7
read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61CCECDB

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: 3477522f7a73a7e805cebe6f75efecb249884f426556225bb1a19a5bf86c3ee7
Instruction ID: ba75690b0b350f410aea896e419c8a424035a26e753449f3c745279abe3ab9c4
Opcode Fuzzy Hash: 3477522f7a73a7e805cebe6f75efecb249884f426556225bb1a19a5bf86c3ee7
Instruction Fuzzy Hash: BD115271701620C1FA059BABEC417992722B74AFE8F0D8625CD1E477E4EE3E8D95C782

Function 61CDDE60 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61CDDE93
memcmp.MSVCRT ref: 61CDDEB3
memcmp.MSVCRT ref: 61CDDED5
memcmp.MSVCRT ref: 61CDDEF5
memcmp.MSVCRT ref: 61CDDF15
memcmp.MSVCRT ref: 61CDDF35
memcmp.MSVCRT ref: 61CDDF55
memcmp.MSVCRT ref: 61CDDF75

Strings

src/misc/crypt/crypt_register_hash.c, xrefs: 61CDE0C7
hash != NULL, xrefs: 61CDE0CE

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: memcmp
String ID: hash != NULL$src/misc/crypt/crypt_register_hash.c
API String ID: 1475443563-1465673959
Opcode ID: 23304dcb6f6b2e463d06cef35dbdc4f0435497564c5e55eaef9bda98584721be
Instruction ID: f67a9552f36335049468a1464f3bd13140078a7f81233298d52548c2696c8649
Opcode Fuzzy Hash: 23304dcb6f6b2e463d06cef35dbdc4f0435497564c5e55eaef9bda98584721be
Instruction Fuzzy Hash: EC615932611B4486E751CF66E884B9EB7B8F344BD8F448026CF9987B90EF39E15AD350

Function 61CDE0F0 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61CDE123
memcmp.MSVCRT ref: 61CDE140
memcmp.MSVCRT ref: 61CDE162
memcmp.MSVCRT ref: 61CDE182
memcmp.MSVCRT ref: 61CDE1A2
memcmp.MSVCRT ref: 61CDE1C2
memcmp.MSVCRT ref: 61CDE1E2
memcmp.MSVCRT ref: 61CDE202

Strings

prng != NULL, xrefs: 61CDE326
src/misc/crypt/crypt_register_prng.c, xrefs: 61CDE31F

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: memcmp
String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
API String ID: 1475443563-58737364
Opcode ID: d52c40c2f8ab3e1bffc00e7a528043fc524f9a0f27976295338e7d2b1a0a2e0f
Instruction ID: 00fa670c53afa90a9a723fea116c108a251473a458131eb1eedea962d0caa373
Opcode Fuzzy Hash: d52c40c2f8ab3e1bffc00e7a528043fc524f9a0f27976295338e7d2b1a0a2e0f
Instruction Fuzzy Hash: 3F51CF32B40B959AE710CB62D9C4BDEB768FB44BD4F858125CF6983780EB34E259C750

Function 61CDDB30 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDDB5B
strcmp.MSVCRT ref: 61CDDB7F
strcmp.MSVCRT ref: 61CDDB9B
strcmp.MSVCRT ref: 61CDDBBA
strcmp.MSVCRT ref: 61CDDBD9
strcmp.MSVCRT ref: 61CDDBF4
strcmp.MSVCRT ref: 61CDDC0F
strcmp.MSVCRT ref: 61CDDC2A

Strings

src/misc/crypt/crypt_find_prng.c, xrefs: 61CDDC58
name != NULL, xrefs: 61CDDC5F

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
API String ID: 1004003707-2030105502
Opcode ID: d520ad8b05880d225481b273f22ec4db285ebc539b38e689d553a9564bf13922
Instruction ID: 0a5f0588ef1d779fe449bfa63e9af13c0c2f039a3a77354b653da8ae6f1009e6
Opcode Fuzzy Hash: d520ad8b05880d225481b273f22ec4db285ebc539b38e689d553a9564bf13922
Instruction Fuzzy Hash: DD316E21B0264689FE29CFA685D07BD6722AFC6BD8F048014CF2A8B984FB58F106C750

Function 61CDD890 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61CDD8BB
strcmp.MSVCRT ref: 61CDD8E5
strcmp.MSVCRT ref: 61CDD904
strcmp.MSVCRT ref: 61CDD923
strcmp.MSVCRT ref: 61CDD942
strcmp.MSVCRT ref: 61CDD95D
strcmp.MSVCRT ref: 61CDD978
strcmp.MSVCRT ref: 61CDD993

Strings

name != NULL, xrefs: 61CDD9C8
src/misc/crypt/crypt_find_cipher.c, xrefs: 61CDD9C1

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: strcmp
String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
API String ID: 1004003707-679692990
Opcode ID: 8544638b329b133ad2665c7a4cf68f1f4ce9b95be7c49f8288f5b50d7f5a5f55
Instruction ID: 5c243ba1a0a07064c2db14693f94eeeb513b35ae0b1e50c05e0a24ff184205d3
Opcode Fuzzy Hash: 8544638b329b133ad2665c7a4cf68f1f4ce9b95be7c49f8288f5b50d7f5a5f55
Instruction Fuzzy Hash: A0313E21B026C689FF15CF9699D47BD6726EB80BD8F05C110CF6A8BA84FF15E109C790

Function 00007FF6DFF78500 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF744D0: _wfopen.MSVCRT ref: 00007FF6DFF74515

fread.MSVCRT ref: 00007FF6DFF78571
ferror.MSVCRT ref: 00007FF6DFF78581
clearerr.MSVCRT(00000000,00000000,?,00007FF6DFF7346A,?,00000000), ref: 00007FF6DFF7858D
fwrite.MSVCRT ref: 00007FF6DFF785A3
ferror.MSVCRT ref: 00007FF6DFF785B0
clearerr.MSVCRT(00000000,00000000,?,00007FF6DFF7346A,?,00000000), ref: 00007FF6DFF785BC
fclose.MSVCRT ref: 00007FF6DFF785C9
fclose.MSVCRT ref: 00007FF6DFF785D1
fclose.MSVCRT ref: 00007FF6DFF785F4
fclose.MSVCRT ref: 00007FF6DFF78601

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fclose$clearerrferror$_wfopenfreadfwrite
String ID:
API String ID: 4075948245-0
Opcode ID: 895416de5551a69e53d05cbcb296a47d0632e6c273903f1e70700b8bddf1312c
Instruction ID: 95f8fdbfcdebfce42eee78c5c4ca8aa1c58bedf5173b6ee43e8a39638485038d
Opcode Fuzzy Hash: 895416de5551a69e53d05cbcb296a47d0632e6c273903f1e70700b8bddf1312c
Instruction Fuzzy Hash: F5212C51F0D24301F92566275A112FD87810F46FE9E688937EC3EEB7C6ED1DE9259340

Function 00007FF6DFF82C0B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF6DFF82CAE
fwprintf.MSVCRT ref: 00007FF6DFF82CE3
memset.MSVCRT ref: 00007FF6DFF82DCA
strlen.MSVCRT ref: 00007FF6DFF82DE2

Part of subcall function 00007FF6DFF88D2E: ___mb_cur_max_func.MSVCRT ref: 00007FF6DFF88D64
Part of subcall function 00007FF6DFF88D2E: ___lc_codepage_func.MSVCRT ref: 00007FF6DFF88D6B

fwprintf.MSVCRT ref: 00007FF6DFF82D0B

Part of subcall function 00007FF6DFF82B80: fputwc.MSVCRT ref: 00007FF6DFF82BD0

Strings

%.*S, xrefs: 00007FF6DFF82D01
%*.*S, xrefs: 00007FF6DFF82CA4
%-*.*S, xrefs: 00007FF6DFF82CD9

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 1485978544-2115465065
Opcode ID: d2eb4217ddd9504e58b3f4f9667a6e8988adc284b89a5f1a388818bb5d907d71
Instruction ID: 8346da720d5201c6fc96e484d1fa1164e6fc85b14c2ad6ccce1c1c233f15eb46
Opcode Fuzzy Hash: d2eb4217ddd9504e58b3f4f9667a6e8988adc284b89a5f1a388818bb5d907d71
Instruction Fuzzy Hash: AE81DDB6B04B498AE710CF2AC8806AC77E0F748B9CB118536EE5D87B58DF38E510CB40

Function 61CC13C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON310 ref: 61CC158B
PyUnicode_AsUTF8AndSize.PYTHON310 ref: 61CC159B
getenv.MSVCRT ref: 61CC15BB

Strings

LANG, xrefs: 61CC15B4
PYARMOR_LANG, xrefs: 61CC1565
_PARLANG, xrefs: 61CC1584, 61CC162C

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ObjectSizeSys_Unicode_getenv
String ID: LANG$PYARMOR_LANG$_PARLANG
API String ID: 223123148-1822377752
Opcode ID: d249efbf808a52a0e06fbd264aa83bcb98b08bffaac0ad04f1c1028cbb22d494
Instruction ID: dd5041a78eaaffa0c309ed477b0fe588d4f873330c17524261c29f2f35813320
Opcode Fuzzy Hash: d249efbf808a52a0e06fbd264aa83bcb98b08bffaac0ad04f1c1028cbb22d494
Instruction Fuzzy Hash: A451C0B26092E0C5EB02CBAF91903ADBFB3A742F85F4CC016CA9947355E729C895C352

Function 00007FF8A86E41D3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8A87AA71E
WSAGetLastError.WS2_32 ref: 00007FF8A87AA728

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A87AA6AE, 00007FF8A87AA73E, 00007FF8A87AA75A, 00007FF8A87AA7C3, 00007FF8A87AA7DF, 00007FF8A87AA83B, 00007FF8A87AA857
o, xrefs: 00007FF8A87AA84F

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 4436fc6254bc72a54972405be3f68e9f830346a03ab368bea1c244b879c7c278
Instruction ID: 90ebfcc737244310c7dd339f5361fb5ed40b07ed1f56bf7819e32d710cf587cf
Opcode Fuzzy Hash: 4436fc6254bc72a54972405be3f68e9f830346a03ab368bea1c244b879c7c278
Instruction Fuzzy Hash: 2751A131B0A54296F720DF21E8087BEB3A0FB84B84F184139E65907A95EF7DE545CB29

Function 00007FF8A86E1D48 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8922E5B
GetModuleHandleA.KERNEL32 ref: 00007FF8A8922E6D
GetModuleHandleW.KERNEL32 ref: 00007FF8A8922E7A
GetProcAddress.KERNEL32 ref: 00007FF8A8922EE2

Strings

_ssl_d.pyd, xrefs: 00007FF8A8922E66
OPENSSL_Uplink(%p,%02X): , xrefs: 00007FF8A8922DF2
OPENSSL_Applink, xrefs: 00007FF8A8922EDB
_ssl.pyd, xrefs: 00007FF8A8922E54

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
API String ID: 1883125708-1130596517
Opcode ID: d7003f0cb0e0d0039ea82a20f93083a2f03f09b28b401cdfd41ce747ed1fa16f
Instruction ID: 5420de5f2de9c1b2395b92ae75d84972f032d13e606d17f783ca281995fc91a8
Opcode Fuzzy Hash: d7003f0cb0e0d0039ea82a20f93083a2f03f09b28b401cdfd41ce747ed1fa16f
Instruction Fuzzy Hash: B2515E22D0BB82A2E7218F24E805174B3A0FF587E9F185335D96D162A5FF7CB595C328

Function 00007FF6DFF78D20 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78D68
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78DBA
calloc.MSVCRT ref: 00007FF6DFF78DD0

Strings

WideCharToMultiByte, xrefs: 00007FF6DFF78E07, 00007FF6DFF78E27
Failed to get UTF-8 buffer size., xrefs: 00007FF6DFF78E20
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6DFF78E00
Out of memory., xrefs: 00007FF6DFF78DE1
win32_utils_to_utf8, xrefs: 00007FF6DFF78DE8

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 1374691127-27947307
Opcode ID: c28c0e6c5d8874854bbcf17be2a90bb230ec35532378af5f2a3c060bcab11e97
Instruction ID: 0c7d5e9bc210586d3266d7fa33d153b834d967358e801053244ef3e995094e7e
Opcode Fuzzy Hash: c28c0e6c5d8874854bbcf17be2a90bb230ec35532378af5f2a3c060bcab11e97
Instruction Fuzzy Hash: E12171A1E0DB4284EB209B66E85037EA751EF48394F544637DA6E877D5EF3CD014C740

Function 00007FF6DFF78C30 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78C72
calloc.MSVCRT ref: 00007FF6DFF78C82
WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78CB7

Strings

WideCharToMultiByte, xrefs: 00007FF6DFF78CD7, 00007FF6DFF78CF7
win32_wcs_to_mbs, xrefs: 00007FF6DFF78D0E
Out of memory., xrefs: 00007FF6DFF78D07
Failed to get ANSI buffer size., xrefs: 00007FF6DFF78CD0
Failed to encode filename as ANSI., xrefs: 00007FF6DFF78CF0

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
API String ID: 1374691127-3831141058
Opcode ID: 70b0f69a5f29bccdbde79e00c8141b456ca76900c87d9a96fa50ccaa8911fad9
Instruction ID: 1e02d4b8b2572cbe69a01b1a892fed694666fc1bfe4374e98ca6aa1d9704d815
Opcode Fuzzy Hash: 70b0f69a5f29bccdbde79e00c8141b456ca76900c87d9a96fa50ccaa8911fad9
Instruction Fuzzy Hash: CD21AE61E0CB4684FB209B56E85476EA791EF48394F54823BEE6E872D5EF3CE114C700

Function 00007FF6DFF78850 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6DFF7886B
_strdup.MSVCRT ref: 00007FF6DFF7889C
_errno.MSVCRT ref: 00007FF6DFF788D0
strerror.MSVCRT ref: 00007FF6DFF788D8
_errno.MSVCRT ref: 00007FF6DFF788F5
strerror.MSVCRT ref: 00007FF6DFF788FD

Strings

LOADER: failed to allocate argv_pyi: %s, xrefs: 00007FF6DFF78902
LOADER: failed to strdup argv[%d]: %s, xrefs: 00007FF6DFF788DF

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: _errnostrerror$_strdupcalloc
String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
API String ID: 4278403329-2782260415
Opcode ID: 1d9ac3ccfa277b8f64417ff6ae261a12fd7eef427e7f1ea7b4c48e259a183636
Instruction ID: 988da3331115488e609a45b75c5a7114608f4476b182f52658dd46157a018ff0
Opcode Fuzzy Hash: 1d9ac3ccfa277b8f64417ff6ae261a12fd7eef427e7f1ea7b4c48e259a183636
Instruction Fuzzy Hash: 1311AF62E0960395F7249F55E841ABDA790BF44B45F64463ADD3EC7391EE3CA464C300

Function 61CE7D50 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61CE7DC3
malloc.MSVCRT ref: 61CE7DCD

Strings

seed != NULL, xrefs: 61CE7F80
mask != NULL, xrefs: 61CE7F99
src/pk/pkcs1/pkcs_1_mgf1.c, xrefs: 61CE7F79, 61CE7F92

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: malloc
String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
API String ID: 2803490479-2931318352
Opcode ID: 89b38fa943132528f07c6caaf7e5e3050e5e2c9f0bbd36ffc81d130a959c7cf9
Instruction ID: 99ff88b78ed93a5240882111bcf7f0c170129438062cf49d5ad44a0a7ce73eff
Opcode Fuzzy Hash: 89b38fa943132528f07c6caaf7e5e3050e5e2c9f0bbd36ffc81d130a959c7cf9
Instruction Fuzzy Hash: C55114327483C18AEB11CB76A8087BE7F61EB41B88F08C044DE5647B46FB3AD516E790

Function 00007FF6DFF78EF0 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26
MultiByteToWideChar.KERNEL32 ref: 00007FF6DFF78F68
calloc.MSVCRT ref: 00007FF6DFF78F7E

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF6DFF78FA8
MultiByteToWideChar, xrefs: 00007FF6DFF78FAF, 00007FF6DFF78FCF
Out of memory., xrefs: 00007FF6DFF78F8B
%s%s: %s, xrefs: 00007FF6DFF78EF0
Failed to get wchar_t buffer size., xrefs: 00007FF6DFF78FC8
win32_utils_from_utf8, xrefs: 00007FF6DFF78F92

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharMultiWide$calloc
String ID: %s%s: %s$Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 1374691127-2292745976
Opcode ID: ae36a3af2c446c5ec232e177f4e3447b6ea882bf452ebd8e328b24314d8fb46a
Instruction ID: a06bbc942f7b06f367d388c3c42a3877dee9169ef41c31f784d905c65db84865
Opcode Fuzzy Hash: ae36a3af2c446c5ec232e177f4e3447b6ea882bf452ebd8e328b24314d8fb46a
Instruction Fuzzy Hash: A711A561F0974284FA209B66EC502BD9352AF487A4F588637DE2DC76D1DE7CE124C300

Function 00007FF8A86E60CD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FF8A87A3731
CreateFiber.KERNEL32 ref: 00007FF8A87A37A9
memmove.VCRUNTIME140 ref: 00007FF8A87A380B
SwitchToFiber.KERNEL32 ref: 00007FF8A87A3831
DeleteFiber.KERNEL32 ref: 00007FF8A87A391B

Strings

..\s\crypto\async\async.c, xrefs: 00007FF8A87A3651, 00007FF8A87A3668, 00007FF8A87A36B0, 00007FF8A87A37DD, 00007FF8A87A3849, 00007FF8A87A38CF, 00007FF8A87A3906, 00007FF8A87A3927, 00007FF8A87A3955
*, xrefs: 00007FF8A87A366F

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: Fiber$Switch$CreateDeletememmove
String ID: *$..\s\crypto\async\async.c
API String ID: 81049052-1471988776
Opcode ID: 494a5ead15e9286cf7091b0957f8f1a7f3de55a7eaba4cdd55d047e97a87598e
Instruction ID: 0159488b5fe990154dd534aaf79f9b7e3e26fcd5c9180cf14680fe1051e95c85
Opcode Fuzzy Hash: 494a5ead15e9286cf7091b0957f8f1a7f3de55a7eaba4cdd55d047e97a87598e
Instruction Fuzzy Hash: 79A15F32A0AB42A6FB24DF26E458279B3A0FB44BC4F444435DA4D47B91EF3CE555C724

Function 00007FF8A8511720 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A85117F5
PyUnicode_FromString.PYTHON310 ref: 00007FF8A8511859
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A851391E
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A851392F

Strings

a unicode character, xrefs: 00007FF8A8513909
category, xrefs: 00007FF8A8513917
argument, xrefs: 00007FF8A8513910

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$category
API String ID: 2803103377-2068800536
Opcode ID: 5f462ffedad45deb0981e3602ffe955f9611f4bc9ee03e43466de6ab20229954
Instruction ID: c7e59bef8993eb47b81371cbd37618eadc34c7dd61a604bb7e2334500395faae
Opcode Fuzzy Hash: 5f462ffedad45deb0981e3602ffe955f9611f4bc9ee03e43466de6ab20229954
Instruction Fuzzy Hash: 0F51E562F0AA86B2EB549B05DCA027C23A1FF44BD4F045135DE8E87B90DF2CE845C328

Function 00007FF8A8511000 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A85110CE
PyUnicode_FromString.PYTHON310 ref: 00007FF8A85110F3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A85135B0
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A85135C0

Strings

bidirectional, xrefs: 00007FF8A85135A9
a unicode character, xrefs: 00007FF8A851359B
argument, xrefs: 00007FF8A85135A2

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$bidirectional
API String ID: 2803103377-2110215792
Opcode ID: 7fb371fac5a4976876b5a0aa1cb6a1478627d4ac754c8c031e7e31938689ba61
Instruction ID: 55862cc4e73b09f8c3cf155ed03dec47429ec67342a0d3309e87894d9f580304
Opcode Fuzzy Hash: 7fb371fac5a4976876b5a0aa1cb6a1478627d4ac754c8c031e7e31938689ba61
Instruction Fuzzy Hash: 02410261F4AA82A2EB189B15CCA437963A1FF44FD5F445034DE8E836D0DF2DE884C368

Function 61CC9900 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

PyUnicode_FromKindAndData.PYTHON310 ref: 61CC9949
PyErr_SetString.PYTHON310 ref: 61CCA2A9

Strings

EOF read where object expected, xrefs: 61CCA29C

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DataErr_FromKindStringUnicode_
String ID: EOF read where object expected
API String ID: 3898585613-3634523442
Opcode ID: 2a4bee291be284b1d0bf09b3e4e8a717c5567653c1dd38e9cef45f84b753e4a6
Instruction ID: 4b0be669fdc08cb22a6ecb13d8ae4541e58c331579156d915b9c1ad1fcbaa473
Opcode Fuzzy Hash: 2a4bee291be284b1d0bf09b3e4e8a717c5567653c1dd38e9cef45f84b753e4a6
Instruction Fuzzy Hash: EF315732605A91C1EA16CF59D448B9F2766FB85FD4F0AC511CE4D17368FB39D886C382

Function 00007FF8A85145DC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A8514613
PyUnicode_FromString.PYTHON310 ref: 00007FF8A851462F
memcpy.VCRUNTIME140 ref: 00007FF8A85146AB
PyOS_snprintf.PYTHON310 ref: 00007FF8A85146ED
PyUnicode_FromStringAndSize.PYTHON310 ref: 00007FF8A851471A

Strings

, xrefs: 00007FF8A85146C3
%04X, xrefs: 00007FF8A85146D8

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
String ID: $%04X
API String ID: 762632776-4013080060
Opcode ID: 99f4d1507ef4c0457aed7c3cfe67c5ab37577bd27693eb2c59433b0cb40ea54e
Instruction ID: 414be4841e3a7ea0ae4d236bfe0854d643f45357d671034130a87acad990fd12
Opcode Fuzzy Hash: 99f4d1507ef4c0457aed7c3cfe67c5ab37577bd27693eb2c59433b0cb40ea54e
Instruction Fuzzy Hash: D031C172A09A8161EA21AB14DC543B963A2FF45BE8F881234CEAE076D5CF2CD549C324

Function 00007FF8A85141A4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A85141DD
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A85141F3
PyErr_Occurred.PYTHON310 ref: 00007FF8A851428D
PyLong_FromLong.PYTHON310 ref: 00007FF8A851429E

Strings

a unicode character, xrefs: 00007FF8A85141C8
argument, xrefs: 00007FF8A85141CF
combining, xrefs: 00007FF8A85141D6

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: 29f396a6d2780ed47fe1516f31ac2bdb0dc14ce637f69e57af0b062eee8e7792
Instruction ID: eefada0647aae04c0d07ba9572d60b0625a1d0a59d2805b02d9b23da3eef0cf4
Opcode Fuzzy Hash: 29f396a6d2780ed47fe1516f31ac2bdb0dc14ce637f69e57af0b062eee8e7792
Instruction Fuzzy Hash: CE31DF21B0A60662FF946B65DC6137912A2FF58BD4F44A135CE2E873D4DF2CE8858368

Function 00007FF8A8514C78 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514CB1
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514CC7
PyErr_Occurred.PYTHON310 ref: 00007FF8A8514D61
PyLong_FromLong.PYTHON310 ref: 00007FF8A8514D72

Strings

a unicode character, xrefs: 00007FF8A8514C9C
argument, xrefs: 00007FF8A8514CA3
mirrored, xrefs: 00007FF8A8514CAA

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: b02090dbf6a790e07fdcbdc2bdba5f0a3fa41482ead3906e20a0787a734c1b8e
Instruction ID: e1f4bec6acdceb1058abe817b43717c60e64f5b5dbeabebfb0b7011ca8b3c997
Opcode Fuzzy Hash: b02090dbf6a790e07fdcbdc2bdba5f0a3fa41482ead3906e20a0787a734c1b8e
Instruction Fuzzy Hash: DC31BF60B0A64662FF546B11DCA137922A2FF44BD8F4865B5CE1E473D4DF2CE845C368

Function 61CC8C60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 61CC8CB9
PyOS_string_to_double.PYTHON310 ref: 61CC8CCB
PyErr_SetString.PYTHON310 ref: 61CC8D23

Strings

EOF read where object expected, xrefs: 61CC8D19
marshal data too short, xrefs: 61CC8D6C

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_S_string_to_doubleStringmemcpy
String ID: EOF read where object expected$marshal data too short
API String ID: 1651926552-3827827332
Opcode ID: 0c6bdfb1a16e4f5a45784a79f2cf64e101352d1b8c4c2fbf34421d9f351cc171
Instruction ID: 59f9cff026be96a696ab3e4afdb1ef8535b8ee37864cb9a9fb3025f0fc11b8be
Opcode Fuzzy Hash: 0c6bdfb1a16e4f5a45784a79f2cf64e101352d1b8c4c2fbf34421d9f351cc171
Instruction Fuzzy Hash: 22314F72206A14C0EF15DB69E45079A3371B795FD8F5886218E0D07358EF39C9A5E382

Function 61CC3790 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC37ED
_PyObject_CallMethod_SizeT.PYTHON310 ref: 61CC37FF
_Py_Dealloc.PYTHON310 ref: 61CC380B
_Py_Dealloc.PYTHON310 ref: 61CC3883

Strings

close, xrefs: 61CC37F5
read, xrefs: 61CC37DC
%U.%s, xrefs: 61CC3796

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CallDeallocMethod_Object_Size
String ID: %U.%s$close$read
API String ID: 3129687173-1885073756
Opcode ID: 6636278560cdc5956eb2c2b2f870ce0f3a379f1cd1c949072ec38348d3f421b5
Instruction ID: 703e5c1e0f080086152fe566eeecc5a05de9db1630812e07d7b607cb8083b1db
Opcode Fuzzy Hash: 6636278560cdc5956eb2c2b2f870ce0f3a379f1cd1c949072ec38348d3f421b5
Instruction Fuzzy Hash: 5C116576342620E1FA06DB56FC443D923A27B06FD4F4CA5268D0907724EF3EC955C341

Function 00007FF6DFF715E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6DFF715F7
LoadLibraryA.KERNEL32 ref: 00007FF6DFF71608
GetProcAddress.KERNEL32 ref: 00007FF6DFF71626
GetProcAddress.KERNEL32 ref: 00007FF6DFF71635

Strings

libgcc_s_dw2-1.dll, xrefs: 00007FF6DFF715ED
__register_frame_info, xrefs: 00007FF6DFF71615
__deregister_frame_info, xrefs: 00007FF6DFF71628

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
Instruction ID: 2d8f1762d55a027ed8050eb516fbbc40f0398d7230d6ea834721bfb353afd410
Opcode Fuzzy Hash: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
Instruction Fuzzy Hash: 1301DB65E09A1BA1EA159F06BC5027D6364BF48B84F494133C96DC7364EF2CE53AC340

Function 61CC8F80 Relevance: 12.2, APIs: 8, Instructions: 242fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61CC902D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: f3a9fcf0a7bf179d3d669c786ac33edee2f67ffe8dfcee152f2b86ce1c998025
Instruction ID: 20064d6d5826a0ae96f29ebcf6d38c6e8c02b44e8435c0115f2d46ce6c0c3c4f
Opcode Fuzzy Hash: f3a9fcf0a7bf179d3d669c786ac33edee2f67ffe8dfcee152f2b86ce1c998025
Instruction Fuzzy Hash: F39188B2201B80C1DB148FAAD54078D77B1F749FE8F558226CE6D17398EB39C9A0C381

Function 61CE23E0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61CE2451
free.MSVCRT ref: 61CE254F

Strings

src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c, xrefs: 61CE25D9, 61CE25F2, 61CE260B
inlen != 0, xrefs: 61CE25F9
in != NULL, xrefs: 61CE2612
public_key_len != NULL, xrefs: 61CE25E0

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
API String ID: 306872129-3913984646
Opcode ID: 55c03c7d945843d4f48ff6d8705b7a8d405f0244384c4b17b89262f28d3a769a
Instruction ID: f83d5680d0152e3da2c78ba881a9c7298490f925f92b51b185d1553332ea584f
Opcode Fuzzy Hash: 55c03c7d945843d4f48ff6d8705b7a8d405f0244384c4b17b89262f28d3a769a
Instruction Fuzzy Hash: DB416A723092C2DAE731CB66E8647DAB7A5F3C8788F4481198E9947B98EB7DC044CF50

Function 61D40100 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61D401AB

Strings

Address %p has no image-section, xrefs: 61D402E9
VirtualQuery failed for %d bytes at address %p, xrefs: 61D402D8
VirtualProtect failed with code 0x%x, xrefs: 61D4028A

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-2123141913
Opcode ID: 245c402e0037b43b7d39f4a39895440efb5a4181a42af94f23be7376f21a9bd0
Instruction ID: 14627c187cf57d0ab7290cc314b188b48f31dd8febbed587d23453907ee6c935
Opcode Fuzzy Hash: 245c402e0037b43b7d39f4a39895440efb5a4181a42af94f23be7376f21a9bd0
Instruction Fuzzy Hash: EB51D072711B8186EB118F65E8807DD7BB2BB99BE8F08C225DE6D873A4DB38C145C340

Function 00007FF6DFF77210 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF7738B

Strings

tclInit, xrefs: 00007FF6DFF7726B
exit, xrefs: 00007FF6DFF772C2
_image_data, xrefs: 00007FF6DFF77369
rename ::source ::_source, xrefs: 00007FF6DFF772E0
tcl_findLibrary, xrefs: 00007FF6DFF7728D
source, xrefs: 00007FF6DFF77309

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
API String ID: 1294909896-1126984729
Opcode ID: 4f97813898d0e82c68c1b43f910c7e0772f53d5d16a6d67dba98679f5fe9d432
Instruction ID: 33d603ea0ea8db5aa824c65d07c9247fe9ad312b5d5ffe7f46b8351212428843
Opcode Fuzzy Hash: 4f97813898d0e82c68c1b43f910c7e0772f53d5d16a6d67dba98679f5fe9d432
Instruction Fuzzy Hash: B571D67AA18A4695EB109F22E8543AD7360FB48F89F444537DEAE87364DF7CD528C340

Function 00007FF8A86E3CFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A88D6519
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A88D6534
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A88D654D

Strings

file, xrefs: 00007FF8A88D64E1, 00007FF8A88D6526
T, xrefs: 00007FF8A88D65CA
..\s\crypto\store\store_lib.c, xrefs: 00007FF8A88D65AB, 00007FF8A88D65C3

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: _stricmpstrchrstrncmp
String ID: ..\s\crypto\store\store_lib.c$T$file
API String ID: 3017659097-909561481
Opcode ID: 94695937190c370bd88603ba5bc26eacff36c81e81dd62bae27b8822d5c22d59
Instruction ID: a4610bac923c62ccdf45b1595aa8bf270fece5c9fbeb41cfc65a4723f27db540
Opcode Fuzzy Hash: 94695937190c370bd88603ba5bc26eacff36c81e81dd62bae27b8822d5c22d59
Instruction Fuzzy Hash: 88416D32B0AA46AAEE11DF12E8445A973A4FF88BC4F444035DE4D07B55EF3CE505CB68

Function 00007FF8A8514310 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A851434B
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514380
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514394

Strings

decimal, xrefs: 00007FF8A8514344, 00007FF8A8514372
a unicode character, xrefs: 00007FF8A851436B
argument 1, xrefs: 00007FF8A8514379

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: 012e52d84fab340038f5fd1d65e5c1f6b6d5bcf4fe07dedc07daed0958e62186
Instruction ID: 07408b9db59ae43c2d3d38c1a341fa61696cedf5292792903e271e148be57904
Opcode Fuzzy Hash: 012e52d84fab340038f5fd1d65e5c1f6b6d5bcf4fe07dedc07daed0958e62186
Instruction Fuzzy Hash: AC318E25B0A656A2FB50AB15E88037D6362FF84BC4F949131DE0D47B94DF3DE892C368

Function 00007FF8A8514DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A8514E27
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514E5C
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A8514E70

Strings

name, xrefs: 00007FF8A8514E20, 00007FF8A8514E4E
a unicode character, xrefs: 00007FF8A8514E47
argument 1, xrefs: 00007FF8A8514E55

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: 47084e6ccdc459a5d60dfcf5406ef7f9b64166578da1376eda7b7de69ad12f09
Instruction ID: d62328926d151a8a151b7edb7ac57a86536187a94af4a1d754da9322c9747d45
Opcode Fuzzy Hash: 47084e6ccdc459a5d60dfcf5406ef7f9b64166578da1376eda7b7de69ad12f09
Instruction Fuzzy Hash: 6C318E21B1A646A1EB50AB46D89037923A2FF84BC4F589131DE0D47B95DF3DE896C328

Function 00007FF8A8514FB8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A8514FF3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8515028
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A851503C

Strings

numeric, xrefs: 00007FF8A8514FEC, 00007FF8A851501A
a unicode character, xrefs: 00007FF8A8515013
argument 1, xrefs: 00007FF8A8515021

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: be80234e51299d3dba1d27007bdc3e3ec6a2cb79f5516fc0aff3a1b583224e1a
Instruction ID: 95d2dd09fa3431227d456fb25de7344664e8b5d7b620a75e23faf9307b89ca65
Opcode Fuzzy Hash: be80234e51299d3dba1d27007bdc3e3ec6a2cb79f5516fc0aff3a1b583224e1a
Instruction Fuzzy Hash: 01317E25B1A646E6FB60AB95DC503792361EB84FC4F948431DE0D47794DF3EE842C3A8

Function 00007FF6DFF780B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

wcslen.MSVCRT ref: 00007FF6DFF78100
wcscat.MSVCRT ref: 00007FF6DFF7812E
_wrmdir.MSVCRT ref: 00007FF6DFF7814C
wcscat.MSVCRT ref: 00007FF6DFF7817E

Strings

_MEIPASS2, xrefs: 00007FF6DFF780B9

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
String ID: _MEIPASS2
API String ID: 3789554339-3944641314
Opcode ID: cac3fac06264cf2f5e23da05bebe8a757f603e3afced9d60fe56963d829627f6
Instruction ID: 3a79807f60ce151809273daf3a539580d4314bc22d292cbdff9c23e7b4075070
Opcode Fuzzy Hash: cac3fac06264cf2f5e23da05bebe8a757f603e3afced9d60fe56963d829627f6
Instruction Fuzzy Hash: 8D21DD51F0854244EA60AA13AC056BE9751BB85FE5FD88933EE2E877C6DE7CE461C304

Function 61CC97B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CC9884

Strings

EOF read where object expected, xrefs: 61CC9877
recursion limit exceeded, xrefs: 61CC9EF0
bad marshal data (unknown type code), xrefs: 61CC9EC7

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_String
String ID: EOF read where object expected$bad marshal data (unknown type code)$recursion limit exceeded
API String ID: 1450464846-1585441539
Opcode ID: de466e8691c2841b711b24101c2ffa991241660d26798b20a140f24b12d9d672
Instruction ID: 617e1c40f20c2c93dd7c44c53c1b8285d5333b994cca347de4f28e64ef40b031
Opcode Fuzzy Hash: de466e8691c2841b711b24101c2ffa991241660d26798b20a140f24b12d9d672
Instruction Fuzzy Hash: 7331A432204A84D1EB118F1DE8847DE77B1FB89B99F458611DE4917374EF39C89AC301

Function 00007FF6DFF76600 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF76614

Strings

strict, xrefs: 00007FF6DFF76619
Installing PYZ: Could not get sys.path!, xrefs: 00007FF6DFF766AC
%U?%llu, xrefs: 00007FF6DFF76639
path, xrefs: 00007FF6DFF76665
utf-8, xrefs: 00007FF6DFF76623
Failed to append PYZ entry to sys.path!, xrefs: 00007FF6DFF76690

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen
String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
API String ID: 39653677-372213108
Opcode ID: ad6469434e16e444b467f2237217c5c1b6908c5ff4eac4261832d946bacd06fa
Instruction ID: 8e58cf26accd32eb8e2fb2244b0d440959714c56669f2723740acffded19ea13
Opcode Fuzzy Hash: ad6469434e16e444b467f2237217c5c1b6908c5ff4eac4261832d946bacd06fa
Instruction Fuzzy Hash: 3D112C66E09A1691EA109F2AF8540AD6360AF89FD4B844133DD2EC73A0EE3CE525C700

Function 61CC9BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9BEB
PyBytes_FromStringAndSize.PYTHON310 ref: 61CCA4A4
memcpy.MSVCRT ref: 61CCA4E1

Strings

bad marshal data (bytes object size out of range), xrefs: 61CCA932

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Bytes_Err_FromOccurredSizeStringmemcpy
String ID: bad marshal data (bytes object size out of range)
API String ID: 2675459810-66224825
Opcode ID: dff7100d27f901b6f3801151527ff4bee7996ec9a93b319a330600d7ccb6ade7
Instruction ID: 32a8ee8a2e76f99a537618dde77a53313870455b16a145b637b65764c125f254
Opcode Fuzzy Hash: dff7100d27f901b6f3801151527ff4bee7996ec9a93b319a330600d7ccb6ade7
Instruction Fuzzy Hash: CB11F671646691C2EA14DF56D48CB9F2766B78AFC8F05C514CA0E07728FF39D886C386

Function 61CD0D60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CD0D8D
_Py_Dealloc.PYTHON310 ref: 61CD0DA3
PyNumber_Positive.PYTHON310 ref: 61CD0DB4
PyNumber_Invert.PYTHON310 ref: 61CD0DC0
PyNumber_Negative.PYTHON310 ref: 61CD0DD0

Strings

Invalid operator, xrefs: 61CD0D83

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Number_$DeallocErr_InvertNegativePositiveString
String ID: Invalid operator
API String ID: 4031754375-2676212410
Opcode ID: b941b830091611690a514e88646ff26d2903e98a8aaccfee036b41733de4cc1a
Instruction ID: d5549f671c1fd6101b3d545849d467217fe7ac589684bfcc9a50431fecc9b5df
Opcode Fuzzy Hash: b941b830091611690a514e88646ff26d2903e98a8aaccfee036b41733de4cc1a
Instruction Fuzzy Hash: 59F06D30A55A00C1EA544BBDEC8436D7772B78AB89F4C8422DB5986228EF3990B8C342

Function 61D412D0 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61D412ED
_stat64.MSVCRT ref: 61D4133B
malloc.MSVCRT ref: 61D41453
memcpy.MSVCRT ref: 61D41468
_stat64.MSVCRT ref: 61D4147B
free.MSVCRT ref: 61D41490

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: _stat64$freemallocmemcpystrlen
String ID:
API String ID: 4289191721-0
Opcode ID: 2e8b4db83b12a41ffbe3facdde420b2ac2544ea1a3acc10374bbb150b9bb6a37
Instruction ID: 64dd7a0734dff31e6108067c1acd4805725a5123beaf2230c0f424fdc2296807
Opcode Fuzzy Hash: 2e8b4db83b12a41ffbe3facdde420b2ac2544ea1a3acc10374bbb150b9bb6a37
Instruction Fuzzy Hash: 8D51E366509790C9E7108F62E04436E7BB2E78EBD9F44C012DAD807B59E73EE069CB52

Function 00007FF8A86949F0 Relevance: 9.1, APIs: 6, Instructions: 107COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FF8A8694A42
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FF8A8694A4F
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FF8A8694A8F
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FF8A8694A9C
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FF8A8694ADF
X509_get_signature_info.LIBCRYPTO-1_1 ref: 00007FF8A8694B0B

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: X509_get0_pubkeyY_security_bits$X509_get_extension_flagsX509_get_signature_info
String ID:
API String ID: 3342971904-0
Opcode ID: 57c433630263e826098e8d087384db3c34246c5951d235796df77858b70895b9
Instruction ID: d594a3c899263e8606cd65be3edb3d0af67d709ca359814add672d255c13cc37
Opcode Fuzzy Hash: 57c433630263e826098e8d087384db3c34246c5951d235796df77858b70895b9
Instruction Fuzzy Hash: F041D421F0EA8262FAA0AA52B409BB97691FF807D4F046034ED4D47BCADF3CD401872C

Function 00007FF6DFF783E0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75COMMON

Download Yara Rule

Strings

\, xrefs: 00007FF6DFF78408
%s%c%s, xrefs: 00007FF6DFF783F1
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6DFF78498
WARNING: file already exists but should not: %s, xrefs: 00007FF6DFF78472
ERROR: file already exists but should not: %s, xrefs: 00007FF6DFF784D3

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$_wfopenstrcpystrtok
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 1482442392-3501660386
Opcode ID: 18c2ca3e78db836f2b3fe8a3d0f4bf4cc57b38fe68348610c0a1eebdd24d09e8
Instruction ID: 66986095362532970fccddaa31adabbbff24812e6ffd96b8422ebce680953f0d
Opcode Fuzzy Hash: 18c2ca3e78db836f2b3fe8a3d0f4bf4cc57b38fe68348610c0a1eebdd24d09e8
Instruction Fuzzy Hash: CE219461E0C60354F6209F23A9402BEA7919F447D5F648933ED3EC72D5EE6CE535C250

Function 61CD0320 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

PyEval_GetGlobals.PYTHON310 ref: 61CD0331
PyDict_SetItem.PYTHON310 ref: 61CD03A9
PyDict_GetItem.PYTHON310 ref: 61CD03CD
PyDict_DelItem.PYTHON310 ref: 61CD03E6

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Dict_Item$Eval_Globals
String ID:
API String ID: 298195719-0
Opcode ID: 9db0bfdc82bb039ba27e762e529bab07152fa7c5a080c6e59e8e8447cb2a1ebe
Instruction ID: 67e9b758069d16cb66af9f01e9e3db2be819ff5a8ee34a710bc67822fb20f2b0
Opcode Fuzzy Hash: 9db0bfdc82bb039ba27e762e529bab07152fa7c5a080c6e59e8e8447cb2a1ebe
Instruction Fuzzy Hash: EF1151A2F06611C3FD4A97AE7C5438E1152AB88FD4F4DC531CE0986714FE39C8E2C210

Function 00007FF8A8648920 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FF8A8648955
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A864897E
EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FF8A8648997
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A86489D3
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A86489F2
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A8648A03

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: Y_free$X_ctrlX_freeX_new_idY_new
String ID:
API String ID: 1769623012-0
Opcode ID: b53d1716d785c333dc753c8b2c9d948b5c220320da8a2cf2c78b6077238e4766
Instruction ID: f2d8a22dbaaf8170fc5a568a2e355d81a436533cb5800ab569c8f142ed05a4ca
Opcode Fuzzy Hash: b53d1716d785c333dc753c8b2c9d948b5c220320da8a2cf2c78b6077238e4766
Instruction Fuzzy Hash: 83219231A0AA4250FA90AB19A15537E6AA0DF867C4F182034FE9D877D6DF7CE4918728

Function 00007FF6DFF781F0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF6DFF7823A
wcscat.MSVCRT ref: 00007FF6DFF78250

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: wcscatwcscmp
String ID:
API String ID: 3846154227-0
Opcode ID: 974bd8c1c9debbc482e50048efbc0f4631982c5f6d31e8f5a8375c716da2798c
Instruction ID: aa7d4edda39be45c0bbf673dc59b7a66e14ec0891eec208b7a0d38cf84aaa781
Opcode Fuzzy Hash: 974bd8c1c9debbc482e50048efbc0f4631982c5f6d31e8f5a8375c716da2798c
Instruction Fuzzy Hash: CE116650F4CA4244FA64AB62AC106FD97805F44FCAF688933ED2ED7682EE6CF565C200

Function 00007FF8A863191F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A867BDEE, 00007FF8A867C191

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 0-1507966698
Opcode ID: 4a20fbfa3d0e027faae482f5d9e1c92d8031dc91055f4ded3c6d5328e2221402
Instruction ID: 9e7e7ec38e9f8b68264e179c1aed83e90190eea3562d953995f7a5cbb2e1cebd
Opcode Fuzzy Hash: 4a20fbfa3d0e027faae482f5d9e1c92d8031dc91055f4ded3c6d5328e2221402
Instruction Fuzzy Hash: E5B182A1A0E642A5FB609E22D8183BA6794EF84FC8F186031DE8D477C5DF3DE5418768

Function 61CCFC80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 61CCFC89
VirtualAlloc.KERNEL32 ref: 61CCFDAB
memcpy.MSVCRT ref: 61CCFDCB

Strings

Failed to alloc memory for spp code, xrefs: 61CCFECB

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: AllocVirtualexitmemcpy
String ID: Failed to alloc memory for spp code
API String ID: 693558432-822294455
Opcode ID: 980d77be96267a13e111807d9adfdb519b4df5e23e6beef7f6a54f4d3dcc0297
Instruction ID: 2e5d4c67a655602b0c4cf759806697e50ec1714fa4de9cd705a68a0fb86fb571
Opcode Fuzzy Hash: 980d77be96267a13e111807d9adfdb519b4df5e23e6beef7f6a54f4d3dcc0297
Instruction Fuzzy Hash: 75517AB2702B44C6EB158F4AE88479C77A5FB48FD4F48812ADE6C07794EB38C861C741

Function 00007FF6DFF82F08 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF6DFF82FAB
fwprintf.MSVCRT ref: 00007FF6DFF82FE0

Part of subcall function 00007FF6DFF82B80: fputwc.MSVCRT ref: 00007FF6DFF82BD0

Strings

%-*.*s, xrefs: 00007FF6DFF82FD6
%.*s, xrefs: 00007FF6DFF82FFE
%*.*s, xrefs: 00007FF6DFF82FA1

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fwprintf$fputwc
String ID: %*.*s$%-*.*s$%.*s
API String ID: 2988249585-4054516066
Opcode ID: d6417dfda2078b4447efd06462b0ebb0257d965d566ff2bcbec1a803eaf523e4
Instruction ID: 470a58fe9e66724bbe8e8a8e223da522ea5263e7df3ead5fb2985e6253d07bb7
Opcode Fuzzy Hash: d6417dfda2078b4447efd06462b0ebb0257d965d566ff2bcbec1a803eaf523e4
Instruction Fuzzy Hash: BE71DCB6B04B8ACAD750CF2AC8815AD77E0F748B9CB118526EE5D87768DF38D550CB40

Function 00007FF8A87A6F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF8A87A6733), ref: 00007FF8A87A6FCD
getnameinfo.WS2_32 ref: 00007FF8A87A701B
htons.WS2_32 ref: 00007FF8A87A708B

Strings

, xrefs: 00007FF8A87A7001
..\s\crypto\bio\b_addr.c, xrefs: 00007FF8A87A7034, 00007FF8A87A70B6, 00007FF8A87A70D5, 00007FF8A87A7105, 00007FF8A87A7122, 00007FF8A87A7144

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: getnameinfohtonsmemset
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 165288700-1606403076
Opcode ID: a54a86e0d0d66bceffd3aa82d26d7bd0329323ae4690f52601e7025a57f027ce
Instruction ID: 90db3aada29804f91ab9b446dd0459eb1e601a67e970a41e261ad59c02e233da
Opcode Fuzzy Hash: a54a86e0d0d66bceffd3aa82d26d7bd0329323ae4690f52601e7025a57f027ce
Instruction Fuzzy Hash: 6A51D431A0A647A6FB209B25E4446BAB3A0FF407C4F448035EBCD47695EF3DE855C728

Function 00007FF8A85144EC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A8514525
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A851453B

Strings

a unicode character, xrefs: 00007FF8A8514510
argument, xrefs: 00007FF8A8514517
decomposition, xrefs: 00007FF8A851451E

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: 4c53be9b8f552ee43dd90cc3096167e2a1c9df2ddc1314562ec96646c81930ba
Instruction ID: efcff5ba27cf803361ea9088967e89b313a69a8ca1c6851f7a75297969afd4ba
Opcode Fuzzy Hash: 4c53be9b8f552ee43dd90cc3096167e2a1c9df2ddc1314562ec96646c81930ba
Instruction Fuzzy Hash: 9121E061B0A60662FB54AB11DCA13792292FF44BE6F456535CF0E473C4DF2CE8458368

Function 00007FF8A85148A8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A85148E1
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A85148F7

Strings

east_asian_width, xrefs: 00007FF8A85148DA
a unicode character, xrefs: 00007FF8A85148CC
argument, xrefs: 00007FF8A85148D3

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: fb352311836accbea4a66cd0df6d031baa96ea22bf904cb676007f8a9435163a
Instruction ID: c1bc2983e6a5474f1fad2bcbc4b223fde39c05de947c971d7c54e48fdd3522c0
Opcode Fuzzy Hash: fb352311836accbea4a66cd0df6d031baa96ea22bf904cb676007f8a9435163a
Instruction Fuzzy Hash: 7821BC61B0A64BA2FB64AB15CC613791293FF44BD4F48A435CE4D973C4CF2DE8458368

Function 00007FF6DFF77BB0 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF77BD0
strlen.MSVCRT ref: 00007FF6DFF77BE7
strlen.MSVCRT ref: 00007FF6DFF77BFC
malloc.MSVCRT ref: 00007FF6DFF77C0A

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$malloc
String ID:
API String ID: 3157260142-0
Opcode ID: 99450ef088cafccd7e2f02e1b56cf9c15352fb26ea6aea84f26f586980f0ae0b
Instruction ID: 0675d6db0c8971358b7866bccb280e4f83368b4bbc989daf64ff1b6dfad210ff
Opcode Fuzzy Hash: 99450ef088cafccd7e2f02e1b56cf9c15352fb26ea6aea84f26f586980f0ae0b
Instruction Fuzzy Hash: 2611A042F1F58718FE6AA95329156BF8FC11F49FD8D084432DD6E8F781ED6CA8618340

Function 61CD09B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 61CD09A4
PyErr_GivenExceptionMatches.PYTHON310 ref: 61CD09E6
PyTuple_Size.PYTHON310 ref: 61CD0A93
PyErr_SetString.PYTHON310 ref: 61CD0B01

Strings

catching classes that do not inherit from BaseException is not allowed, xrefs: 61CD0AF5

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$DeallocExceptionGivenMatchesSizeStringTuple_
String ID: catching classes that do not inherit from BaseException is not allowed
API String ID: 1667255942-1287988286
Opcode ID: d312035e6fbfccc0f77266528b43cfea2ee77e8fec05cd5d5d6d73507cc8f0b0
Instruction ID: efa1dc356422e046c7968e6bbeebe0d298c25d9ed391ef1e422e980ed2eb067a
Opcode Fuzzy Hash: d312035e6fbfccc0f77266528b43cfea2ee77e8fec05cd5d5d6d73507cc8f0b0
Instruction Fuzzy Hash: 0C213872B05B80C1EA058B6AE44575E37A1A782F98F089125CF4D87714EF39C4A5C342

Function 00007FF8A85150FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A8515128
_PyUnicode_ToNumeric.PYTHON310 ref: 00007FF8A8515151
PyErr_SetString.PYTHON310 ref: 00007FF8A8515179
PyFloat_FromDouble.PYTHON310 ref: 00007FF8A851518B

Strings

not a numeric character, xrefs: 00007FF8A851516F

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: a5aed27e65b1845b914b44b9553a30306c9ecc744d4ab8f0d532b9cb7582d048
Instruction ID: a236d78e69f18900cb8dc97f05038ca99985b2f749316afec3251da242d5ecb2
Opcode Fuzzy Hash: a5aed27e65b1845b914b44b9553a30306c9ecc744d4ab8f0d532b9cb7582d048
Instruction Fuzzy Hash: 60118F21A4E942B1FB66AB25EC58138A3A1EF44BC0F189130CE9E47755DF3CE8858328

Function 00007FF8A8514454 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A8514480
_PyUnicode_ToDecimalDigit.PYTHON310 ref: 00007FF8A851449F
PyErr_SetString.PYTHON310 ref: 00007FF8A85144BF
PyLong_FromLong.PYTHON310 ref: 00007FF8A85144D3

Strings

not a decimal, xrefs: 00007FF8A85144B5

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 83868f42624fc03e7ef33afa582ccf117a917432c82265fef522e4270e5ff679
Instruction ID: e04d43efcb9ebefd40b199b0da20b962bb84098a596524b8fb2c4505aeb83966
Opcode Fuzzy Hash: 83868f42624fc03e7ef33afa582ccf117a917432c82265fef522e4270e5ff679
Instruction Fuzzy Hash: C211C229B0AA42A1FB54AB52EC9413C63A2FF88BD4F085430CE4E47650DF6CE8858328

Function 00007FF8A8511F20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310(?,?,?,?,?,00007FF8A8511F0C), ref: 00007FF8A8513B91

Part of subcall function 00007FF8A8511FE0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8512018
Part of subcall function 00007FF8A8511FE0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8512036

PyErr_Format.PYTHON310 ref: 00007FF8A8511F87
PyUnicode_FromKindAndData.PYTHON310 ref: 00007FF8A8513BC0

Strings

name too long, xrefs: 00007FF8A8513B87
undefined character name '%s', xrefs: 00007FF8A8511F7A

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Err_strncmp$DataFormatFromKindStringUnicode_
String ID: name too long$undefined character name '%s'
API String ID: 2291325159-4056717002
Opcode ID: 81effdfe3f462414053b1b5a6252b44d90fbb8fd9dbad0e5fc44ef7eb271089f
Instruction ID: 1d404d79dad2f64fabc04e13bc3105bef80282f5c2d22dbbd01d6863bac9c8c4
Opcode Fuzzy Hash: 81effdfe3f462414053b1b5a6252b44d90fbb8fd9dbad0e5fc44ef7eb271089f
Instruction Fuzzy Hash: D7111C71E5A947A1EB40AB54DC942B863A0FF48BD9F411031CF4D472A1EF6DE189C728

Function 00007FF8A85125E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A85125EB
PyCapsule_New.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A8512628
PyErr_NoMemory.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A8513F46
PyMem_Free.PYTHON310(?,?,00000000,00007FF8A8512595), ref: 00007FF8A8513F56

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FF8A851261D

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 4aee792f5c66c47e9953fad9dee25fce8d59659e004b9cbed73430be2ab25bbe
Instruction ID: ca2d0d8823f4b0e3d55e76a097b709d771dd71849b6662b4acfc39e5d05c2c4c
Opcode Fuzzy Hash: 4aee792f5c66c47e9953fad9dee25fce8d59659e004b9cbed73430be2ab25bbe
Instruction Fuzzy Hash: B9F01434A2AB82A5EB01AB51EC541B9A2A4FF08BC5F481431CE4E063A4EF2CE444C338

Function 61CD0F40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CD0F47
PyErr_Format.PYTHON310 ref: 61CD0F76
PyErr_Format.PYTHON310 ref: 61CD0F95

Strings

local variable referenced before assignment, xrefs: 61CD0F8B
No active exception to reraise, xrefs: 61CD0F6C

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$Format$Occurred
String ID: No active exception to reraise$local variable referenced before assignment
API String ID: 1084603930-1116140797
Opcode ID: 3c5676555e1ccbe607c6af97c72af0f3cce02b93529c53c71c53942217867f48
Instruction ID: 48fdd7d66ae0d19eb4855888b33e8f6141d532f6d89b6440b47aa9090c34f2ad
Opcode Fuzzy Hash: 3c5676555e1ccbe607c6af97c72af0f3cce02b93529c53c71c53942217867f48
Instruction Fuzzy Hash: 67F0F870B0170591EE059BF9E88439C23A2AB8CB99F598452C90987229EF2EC0B9C380

Function 00007FF8A86E1064 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 270stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A88EF585
memmove.VCRUNTIME140 ref: 00007FF8A88EF762

Strings

..\s\crypto\x509\x509_obj.c, xrefs: 00007FF8A88EF566, 00007FF8A88EF80F, 00007FF8A88EF84C
NO X509_NAME, xrefs: 00007FF8A88EF578
0123456789ABCDEF, xrefs: 00007FF8A88EF781

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: memmovestrncpy
String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
API String ID: 3054264757-3422593365
Opcode ID: 5eff037eaf7809de7dcaa94f4735428a5fed0677689cfa2f15099d1506398b4d
Instruction ID: f075969f8cf204bef15e5c10be060c5312af8694c544c4f8e918561326ca299c
Opcode Fuzzy Hash: 5eff037eaf7809de7dcaa94f4735428a5fed0677689cfa2f15099d1506398b4d
Instruction Fuzzy Hash: 83B10122B0E686A7FB208F15944477ABB90FB85BC8F0451B5DE9D47795EF3CE4018728

Function 61CD2D90 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61CD2E46
sprintf.MSVCRT ref: 61CD2E70

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61CD2EBC
/%d:, xrefs: 61CD2E1B, 61CD2E2D
No any serial number of harddisk got, xrefs: 61CD2EB5

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: sprintfstrlen
String ID: ../src/platforms/windows/hdinfo.c$/%d:$No any serial number of harddisk got
API String ID: 1090396089-4267867539
Opcode ID: da3c1da5c0e8525cfde91121c83bfcfaaa80724b55f9b6edcbc2cab5bb823525
Instruction ID: 014f1ab4e323cc4482a36d59baa47c7ebf34ec4d477f11de9e80377474f8ac11
Opcode Fuzzy Hash: da3c1da5c0e8525cfde91121c83bfcfaaa80724b55f9b6edcbc2cab5bb823525
Instruction Fuzzy Hash: 57315F63F15450C9E7118BB99C703ED6622A786BE5F4CC221CF154BA88F63985C6D381

Function 61CD1D20 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON310 ref: 61CD1D6C
_Py_Dealloc.PYTHON310 ref: 61CD1DF7

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DeallocFunction_NameQualWith
String ID:
API String ID: 2691592392-0
Opcode ID: 1a55e975d29ee81b9b2da0510e07f74fe34e5236762643575ac595d9569f79da
Instruction ID: a1debf71cb34478efb11a343760c81a56cf4479e1e8dbe757e760aa3bbba9877
Opcode Fuzzy Hash: 1a55e975d29ee81b9b2da0510e07f74fe34e5236762643575ac595d9569f79da
Instruction Fuzzy Hash: 99313D32A46A40C6FA1AAFAEA5483AD66B5F746BD4F08C524DF1906B14FF39C0A1C341

Function 61CE1600 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

src/math/rand_prime.c, xrefs: 61CE1746
N != NULL, xrefs: 61CE174D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID:
String ID: N != NULL$src/math/rand_prime.c
API String ID: 0-3192267683
Opcode ID: 7052025decee00892cf934be965deca4c5149d92bd0ad269c99f97e788122213
Instruction ID: 28b39cec87859f8e912bdf72db03166b7237278cb15c68be84c53a105c20c50c
Opcode Fuzzy Hash: 7052025decee00892cf934be965deca4c5149d92bd0ad269c99f97e788122213
Instruction Fuzzy Hash: D9313822744685C5E711CF5BA8087AE6B79F786BD8F888125ED0A47B94EF3CC492CB00

Function 61CC9CD3 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8C60: memcpy.MSVCRT ref: 61CC8CB9
Part of subcall function 61CC8C60: PyOS_string_to_double.PYTHON310 ref: 61CC8CCB

PyErr_Occurred.PYTHON310 ref: 61CC9CF7
PyErr_Occurred.PYTHON310 ref: 61CC9F9D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_Occurred$S_string_to_doublememcpy
String ID:
API String ID: 282781714-0
Opcode ID: a79a8f89cde281577151578a56506cb0248cbdb42f4f5b33e10a71c30f821eec
Instruction ID: 2e46e54fec06f29881b11d0b9de94a2590a16d0240e26ecce6a49f1c7c968090
Opcode Fuzzy Hash: a79a8f89cde281577151578a56506cb0248cbdb42f4f5b33e10a71c30f821eec
Instruction Fuzzy Hash: 3D115131A46651CAEA158FA5D45C75F3766BB96FC8F05D201C90A37224FF35DC82C382

Function 61CC9E40 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8810: _PyFloat_Unpack8.PYTHON310 ref: 61CC8841

PyErr_Occurred.PYTHON310 ref: 61CC9E64
PyErr_Occurred.PYTHON310 ref: 61CC9F3D

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_Occurred$Float_Unpack8
String ID:
API String ID: 3006406168-0
Opcode ID: a79fc84de640a930197273e5da00a22eee8ce3cf4c63c090c9994fd08baf47ff
Instruction ID: c5d1c756892de9bd193a9fb69795a7da61dfdc2f36cc93905b3f98c2779d9465
Opcode Fuzzy Hash: a79fc84de640a930197273e5da00a22eee8ce3cf4c63c090c9994fd08baf47ff
Instruction Fuzzy Hash: 02116032A46651C6EA168FA6D05C75F3766BB96FD8F09D201C90A27224FF35DC82C782

Function 00007FF6DFF729E0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6DFF72A09
EndDialog.USER32 ref: 00007FF6DFF72A38
GetWindowLongPtrW.USER32 ref: 00007FF6DFF72A45
InvalidateRect.USER32 ref: 00007FF6DFF72A65
SetWindowLongPtrW.USER32 ref: 00007FF6DFF72A84

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: DialogLongWindow$InvalidateRect
String ID:
API String ID: 1200242243-0
Opcode ID: 28415b81cc461644b9bde5041361b6faa17e91a7d6b1d99a581dc0e61d36b3c2
Instruction ID: 758476059aad64da1f9ea33b667355a24cf0f8d91833607470bf6581cebcb866
Opcode Fuzzy Hash: 28415b81cc461644b9bde5041361b6faa17e91a7d6b1d99a581dc0e61d36b3c2
Instruction Fuzzy Hash: AE01B531F1C46742F7782B2A68441BCA382EF99B51F5584B3DD1EC3B95CD3C68E29A01

Function 61D1DCC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61D1DF74
abort.MSVCRT ref: 61D1DF79

Strings

', xrefs: 61D1DFDE
illegal index register, xrefs: 61D1DF5F

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: abortfwrite
String ID: '$illegal index register
API String ID: 1067672060-451399654
Opcode ID: 34c0a7d68c99f4657867cb4da4b6bd9e51cddee9c64334fe5635c42e0776d7cc
Instruction ID: cdff583be676e1dc9e5abdebad16c908837f2d45908dfaafa64aaf6110aa5181
Opcode Fuzzy Hash: 34c0a7d68c99f4657867cb4da4b6bd9e51cddee9c64334fe5635c42e0776d7cc
Instruction Fuzzy Hash: FF91677761AB86C4EB128F3DE885A4C3F65A399F88B9AC112CA8C47714CB7EC556C310

Function 00007FF8A86E2833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

T, xrefs: 00007FF8A87A3453
..\s\crypto\async\async.c, xrefs: 00007FF8A87A32DF, 00007FF8A87A332D, 00007FF8A87A3346, 00007FF8A87A337C, 00007FF8A87A33C6, 00007FF8A87A341C, 00007FF8A87A343D, 00007FF8A87A345B, 00007FF8A87A3495, 00007FF8A87A34BA

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: 6ec075fdda66d5d55aeeb852daaafe16ebb7e8afc92208851d75e406c330d3e0
Instruction ID: 97b5fe5ef871d754cbaef0fed4e48eeedc5bc795a3adda852c74b1efeb15642e
Opcode Fuzzy Hash: 6ec075fdda66d5d55aeeb852daaafe16ebb7e8afc92208851d75e406c330d3e0
Instruction Fuzzy Hash: F2518E31A0AA43A6FB20DF21D4185B9A761FF44BC4F045035EA4D07B95EF3DE649DB28

Function 00007FF6DFF7E490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF6DFF7E4B8

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d250d892eb8f1a517ca8d111c4faaae7f46539765e284bd4c425852093292da5
Instruction ID: e78c2964a53f32d1a9ed32512d217c7ac9fb974b02fb810f8d47eec562e415e2
Opcode Fuzzy Hash: d250d892eb8f1a517ca8d111c4faaae7f46539765e284bd4c425852093292da5
Instruction Fuzzy Hash: 0D412072E18606CAFB208B64C9543BE6361EB44758F114A37CA3DC77E8DE3CE5719641

Function 61CCFEF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 61CCFF49
memcpy.MSVCRT ref: 61CCFF6C
fwrite.MSVCRT ref: 61CCFFFC

Strings

Failed to alloc memory for bcc code, xrefs: 61CCFFE7

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: AllocVirtualfwritememcpy
String ID: Failed to alloc memory for bcc code
API String ID: 1603020442-783995166
Opcode ID: c1d2b6d8259435a2e1127bcb9523e9cf4837a8b5c2099e7085973ed5f713512b
Instruction ID: a7cb90292fa67e4daded98ba1fe623186f73a9f96ad257a8ff56f79de4b78375
Opcode Fuzzy Hash: c1d2b6d8259435a2e1127bcb9523e9cf4837a8b5c2099e7085973ed5f713512b
Instruction Fuzzy Hash: 2C216BB2702B548ADB548F5AE84076D7BA4F70DFD9F488526DE4D43754EA38C4A2C390

Function 61CC9980 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9990
PyErr_SetString.PYTHON310 ref: 61CCA029

Strings

bad marshal data (string size out of range), xrefs: 61CCA01F

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$OccurredString
String ID: bad marshal data (string size out of range)
API String ID: 114435612-3115314950
Opcode ID: cf5d26cb646b6e0b08b9da1f91e8f295e36aedc3bee6580d0cdf0c8c023d297b
Instruction ID: 1e9e0599e04dfd1e3b658787b4d7903d4d35268b1e8a496c898c4af0deabf1ea
Opcode Fuzzy Hash: cf5d26cb646b6e0b08b9da1f91e8f295e36aedc3bee6580d0cdf0c8c023d297b
Instruction Fuzzy Hash: 2A11A332702691C5EA128F59E44479F63A1AB88FD9F09C120CE4D17764FF39D8C6D381

Function 61CC2ECE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC2F4F
exit.MSVCRT(61CC1E15), ref: 61CC3240

Strings

%s (%d:%d), xrefs: 61CC2F48
\(, xrefs: 61CC2F3A

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_Formatexit
String ID: %s (%d:%d)$\(
API String ID: 2212715685-1109738240
Opcode ID: 0c252aa529eea7cdea6bf8b75a94a0a15d0c63d3396d4c66fa634e14f8c3ef93
Instruction ID: 39126b99e556cd882893762b3ee76960c26a8e39c0d8944688790d3b2c7e4532
Opcode Fuzzy Hash: 0c252aa529eea7cdea6bf8b75a94a0a15d0c63d3396d4c66fa634e14f8c3ef93
Instruction Fuzzy Hash: AC11A072352A84C4FB41CB65E89039D3761F785B94F49A412DD1E0B794DF3CC542C741

Function 00007FF6DFF72CD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

MessageBoxW.USER32 ref: 00007FF6DFF72D53
MessageBoxA.USER32 ref: 00007FF6DFF72D7B

Strings

WideCharToMultiByte, xrefs: 00007FF6DFF72CD8
Failed to get UTF-8 buffer size., xrefs: 00007FF6DFF72CD6

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
API String ID: 1878133881-785100509
Opcode ID: 7f5320ca9c022b5a5880cc99aba030728f2a4c067df74a4bd38cf457f7fd81ef
Instruction ID: b926aa467ec84e4f2eb51ee7f183d300fb0ec4147c6839f7f52eaf8f8861ed6f
Opcode Fuzzy Hash: 7f5320ca9c022b5a5880cc99aba030728f2a4c067df74a4bd38cf457f7fd81ef
Instruction Fuzzy Hash: 2501D23270878040EB301B26A8057EEA281A748BD5F488436CE4D57B85DE3CD596CB40

Function 61CC9D20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 61CCA0C4
PyErr_Occurred.PYTHON310 ref: 61CCA2C9
PyErr_SetString.PYTHON310 ref: 61CCACB6

Strings

bad marshal data (invalid reference), xrefs: 61CCA0B7, 61CCACA9

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_$String$Occurred
String ID: bad marshal data (invalid reference)
API String ID: 1118661901-2759865940
Opcode ID: 1320ded661b5327d561ca89795eac828451a0e9d12c6fb8b0c1db9cb0f167219
Instruction ID: 48ab1ab3f1988d9c3c870d33bbe2afdcbf43f48ebcc3fecf7fad068c43c0b578
Opcode Fuzzy Hash: 1320ded661b5327d561ca89795eac828451a0e9d12c6fb8b0c1db9cb0f167219
Instruction Fuzzy Hash: BB111B71600A41D2EA04CF6AD48875F3772F789FD8F05D601CA0917324EF36C899C382

Function 00007FF8A86E139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8A87AACE0
WSAGetLastError.WS2_32 ref: 00007FF8A87AACEB

Strings

2, xrefs: 00007FF8A87AAD15
..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A87AAD01, 00007FF8A87AAD1D

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: e8a12f5860b331eeb5ce7d2c174626199a70c7f9dd546f5556fd5a57dc2f225c
Instruction ID: bbb113bcb9d390ee96baef077aeb74423e51fa49f228ac84f97b08488b6e2ca4
Opcode Fuzzy Hash: e8a12f5860b331eeb5ce7d2c174626199a70c7f9dd546f5556fd5a57dc2f225c
Instruction Fuzzy Hash: D801D231E09542A7F7209B21E4041ADA264FF447D4F604639E7AC47AE5EF3DE901CB68

Function 00007FF6DFF74420 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6DFF74442

Part of subcall function 00007FF6DFF78D20: WideCharToMultiByte.KERNEL32 ref: 00007FF6DFF78D68

Strings

GetModuleFileNameW, xrefs: 00007FF6DFF7447F
Failed to convert executable path to UTF-8., xrefs: 00007FF6DFF74490
Failed to get executable path., xrefs: 00007FF6DFF74478

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 1532159127-1977442011
Opcode ID: 32aec0e32114a87591ef6c700c884524eb8b134af1a94f75ba6e9a037605cee3
Instruction ID: f583215f5a875d78b95783f26efdf387e37190ee78a53fc549733cbb6ba6bcb9
Opcode Fuzzy Hash: 32aec0e32114a87591ef6c700c884524eb8b134af1a94f75ba6e9a037605cee3
Instruction Fuzzy Hash: 3FF049A2F1C50381FA616B22AC453BD83519F497C4F444437EC2EC76AAEE1CEA6A9710

Function 61CD22F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 61CD22F4
FormatMessageA.KERNEL32 ref: 61CD2325
LocalFree.KERNEL32 ref: 61CD2346

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61CD2330

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c
API String ID: 1365068426-2451707101
Opcode ID: 1f1a645403c6812d9335ff6b9acb0e956dbee2b1c85c3c722e2227f5a9c025bb
Instruction ID: 1a7db6b2fbf6c304026f98ba7d31e9012e9d651de69dd5a5a8494e7446dfba3a
Opcode Fuzzy Hash: 1f1a645403c6812d9335ff6b9acb0e956dbee2b1c85c3c722e2227f5a9c025bb
Instruction Fuzzy Hash: 8BF03931314A41D2E7109B51E89438E7B72F7C9B89F544129DA8E43B68EF3EC15ACB80

Function 00007FF6DFF782D0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6DFF78341
strlen.MSVCRT ref: 00007FF6DFF78363
strlen.MSVCRT ref: 00007FF6DFF78379
strcpy.MSVCRT(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF7838A
strtok.MSVCRT(?,?,00000000,00000000,?,00007FF6DFF71C6A,00000000,?,?,00000000,00007FF6DFF71DF5), ref: 00007FF6DFF78394

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: strlen$strcpystrtok
String ID:
API String ID: 3698421117-0
Opcode ID: f2f6744582b3b3a9e2a042d8d2a6c592d89531f91eeef15a632d85d9a8bc4e89
Instruction ID: b8475b2591d12c133d246253e671aff8f744a5e5112a542897883eb47202bfdb
Opcode Fuzzy Hash: f2f6744582b3b3a9e2a042d8d2a6c592d89531f91eeef15a632d85d9a8bc4e89
Instruction Fuzzy Hash: BD21AE61F0960341FA21A616A8153FE97819F45FE5F884533ED2EDB782EE2CE565C240

Function 00007FF8A8511FE0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8512018
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8512036

Strings

HANGUL SYLLABLE , xrefs: 00007FF8A8512005
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A851202C

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: b4ef4179bf0a52eb89c3ccaad0542fa4ed29e9dc5726da8d4cf56c5f82179dfe
Instruction ID: a89e7af3b5c1bc02b79ca51fa328e2256ddae8453f5300478c32177c6067e351
Opcode Fuzzy Hash: b4ef4179bf0a52eb89c3ccaad0542fa4ed29e9dc5726da8d4cf56c5f82179dfe
Instruction Fuzzy Hash: 23612732B1924256E664EF2AEC006BAB6A2FF80BD0F048235EE5D876D9DF3CD505C714

Function 00007FF8A8793900 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A87939C3
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A87939DB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A87939F8

Strings

content-type, xrefs: 00007FF8A879390A

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: strncmp
String ID: content-type
API String ID: 1114863663-3266185539
Opcode ID: 44acbf2d3993856e814bab54a766b8caadb646d7408b06c8891a0bf5bc442f4a
Instruction ID: eb333e9ddec305639529c7fec2fd5a1cabb00c022051af67ab72c7b76bd25a60
Opcode Fuzzy Hash: 44acbf2d3993856e814bab54a766b8caadb646d7408b06c8891a0bf5bc442f4a
Instruction Fuzzy Hash: 92510722B4FD4362FAA09726994477A6291FF84BE4F442230ED5D877D5FF2CE5028328

Function 61CC1010 Relevance: 6.1, APIs: 4, Instructions: 131sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 61CC1057
_amsg_exit.MSVCRT ref: 61CC1081

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 7f94c08730947c6228815dd6f54ce1d050e9b755ec42fe89865a1b7dfa980df4
Instruction ID: c1247ba77791f1ee44de29fcab81c3cea77f09e0862a56a9246b7620ada8c026
Opcode Fuzzy Hash: 7f94c08730947c6228815dd6f54ce1d050e9b755ec42fe89865a1b7dfa980df4
Instruction Fuzzy Hash: E1414936702654C9F7028F9FE85079A22B2B785BD5F488026CE1C87364FE3AD892C351

Function 61CE2270 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 61CE23C2
in != NULL, xrefs: 61CE23C9

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID:
String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
API String ID: 0-85593093
Opcode ID: beb4f0c5486d8670ba3867b5f431a88ebb227414fc786106acc8942ea4ba706f
Instruction ID: bae18420532fec27d8aa8b808620b24d9f3776b00d7648f62387532da45c066b
Opcode Fuzzy Hash: beb4f0c5486d8670ba3867b5f431a88ebb227414fc786106acc8942ea4ba706f
Instruction Fuzzy Hash: EF310432715682CAEB19CF6AE828B5D7629F785B98F488028DE0D47B44EB39C451CB40

Function 00007FF6DFF72BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF72C38
free.MSVCRT ref: 00007FF6DFF72C40
free.MSVCRT ref: 00007FF6DFF72C48

Part of subcall function 00007FF6DFF78EF0: MultiByteToWideChar.KERNEL32(?,?,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,00007FF6DFF72F00), ref: 00007FF6DFF78F26

Strings

Failed to obtain/convert traceback!, xrefs: 00007FF6DFF72C62

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free$ByteCharMultiWide
String ID: Failed to obtain/convert traceback!
API String ID: 3219091393-982972847
Opcode ID: 3a3a8189034183b527b6a3895ff72474e2746a44688793101d2d2c3c010006a0
Instruction ID: fc935b794c4ecc42dae60d055cef241e0147faffa363122169aa5537e3775994
Opcode Fuzzy Hash: 3a3a8189034183b527b6a3895ff72474e2746a44688793101d2d2c3c010006a0
Instruction Fuzzy Hash: 4B018441F1E29205FD6965BB09226BE83424F44FD0E5C8436ED1ECBF83ED2DE4218740

Function 61CC9D83 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8C60: memcpy.MSVCRT ref: 61CC8CB9
Part of subcall function 61CC8C60: PyOS_string_to_double.PYTHON310 ref: 61CC8CCB

PyErr_Occurred.PYTHON310 ref: 61CC9DA3
PyFloat_FromDouble.PYTHON310 ref: 61CC9FC4

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: DoubleErr_Float_FromOccurredS_string_to_doublememcpy
String ID:
API String ID: 1362591179-0
Opcode ID: c1c8444b6a1520ac21c139258275c8a804ef87c5cecd8c1be0ff29fad0a9fc91
Instruction ID: a3825be74796af07731b3413b7d5668cb8a4811fbf3d322576535fcef77d58b8
Opcode Fuzzy Hash: c1c8444b6a1520ac21c139258275c8a804ef87c5cecd8c1be0ff29fad0a9fc91
Instruction Fuzzy Hash: 7A015A31B46601C6EA148F66C09CB1F376ABB86FC8F0AD610C90527224FB34E886C7C6

Function 61CC9C81 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61CC8810: _PyFloat_Unpack8.PYTHON310 ref: 61CC8841

PyErr_Occurred.PYTHON310 ref: 61CC9CA1
PyFloat_FromDouble.PYTHON310 ref: 61CC9F64

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Float_$DoubleErr_FromOccurredUnpack8
String ID:
API String ID: 4123378784-0
Opcode ID: 91d52e6d8d877fac242e5bdaa127e5b52f9ed644aa2e048632791fd9bfac9342
Instruction ID: 9d5823a2952c995aa682bd6127ad3b9117c7bf783532fbc9838c87d9eac0c0f2
Opcode Fuzzy Hash: 91d52e6d8d877fac242e5bdaa127e5b52f9ed644aa2e048632791fd9bfac9342
Instruction Fuzzy Hash: B3017C31B42601C6EA058F66C49CB5F376AFB86FC8F1AD604C90527224FB35EC96C786

Function 00007FF8A86E4403 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A88B679B
memmove.VCRUNTIME140 ref: 00007FF8A88B67AF

Strings

$, xrefs: 00007FF8A88B6774
..\s\crypto\rsa\rsa_none.c, xrefs: 00007FF8A88B676D

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: memmovememset
String ID: $$..\s\crypto\rsa\rsa_none.c
API String ID: 1288253900-779172340
Opcode ID: d21027dcd5a9b13bbe407246f7de02450a785e8ee2f8b223aa31a7e0c223aae4
Instruction ID: ad0915487c01003f60eaa6bdb2c5e36ae466b77371e4e4fb198f1e5ad18efcc4
Opcode Fuzzy Hash: d21027dcd5a9b13bbe407246f7de02450a785e8ee2f8b223aa31a7e0c223aae4
Instruction Fuzzy Hash: A401B131B196469AEA10EF26A98816DA361FF847D0F188230FB5C47B96DF3CE5018B08

Function 61CC9B80 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON310 ref: 61CC9B8A
PyLong_FromLong.PYTHON310 ref: 61CCA62F

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_FromLongLong_Occurred
String ID:
API String ID: 4098471257-0
Opcode ID: 02c02cb3908a6d2b22e12145e244b6671a3388e6bac1f093a3c7b303e63e56ae
Instruction ID: f735ef038e4ae872e23670de3f82a1bf7d31cea9617e27448f46489db2e3c8f3
Opcode Fuzzy Hash: 02c02cb3908a6d2b22e12145e244b6671a3388e6bac1f093a3c7b303e63e56ae
Instruction Fuzzy Hash: D7012431B42610C3EA088F66C09CB1F2766FB86FC4F0AD114C9061B220FA39DC42C786

Function 00007FF8A86E6A1E Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

..\s\crypto\engine\eng_ctrl.c, xrefs: 00007FF8A8840209, 00007FF8A88402DD, 00007FF8A884034E, 00007FF8A88403E0, 00007FF8A88404C2, 00007FF8A88404FF, 00007FF8A8840520, 00007FF8A8840540, 00007FF8A8840564, 00007FF8A8840582, 00007FF8A88405AA, 00007FF8A88405D9, 00007FF8A88405FB
b, xrefs: 00007FF8A88403D8

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID:
String ID: ..\s\crypto\engine\eng_ctrl.c$b
API String ID: 0-1836817417
Opcode ID: fb2526c301eb0d32c8b40b06f32727c144aa8e6317cdfcefd3ba865dcecceeb2
Instruction ID: 8182df9fef3b4ada42b6bd7059b5751ada83f6d06429fab5e1256177670b7490
Opcode Fuzzy Hash: fb2526c301eb0d32c8b40b06f32727c144aa8e6317cdfcefd3ba865dcecceeb2
Instruction Fuzzy Hash: C2E1BF32F0A642A3FAA48B51D4047BB26A1FF807C4F544176DA8E47B91DF3CE945DB28

Function 00007FF8A8631933 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A8675C2A
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A8675C65

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A8675D15, 00007FF8A8675D46

Memory Dump Source

Source File: 00000002.00000002.2093934825.00007FF8A8631000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000002.00000002.2093918703.00007FF8A8630000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2093934825.00007FF8A86A3000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094154948.00007FF8A86A5000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094242021.00007FF8A86C8000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86CD000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86D3000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2094274298.00007FF8A86DA000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8630000_zapret.jbxd

Similarity

API ID: L_sk_numL_sk_value
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 557030205-1853348325
Opcode ID: 0228143f2057f377d24a061c11b1217ac11cf72effd14e50a6742f7b32cb5b3d
Instruction ID: 04cb6964ab3d5d43aea5f15a2348fef420bd9ba995dcb2d1741de674027616ba
Opcode Fuzzy Hash: 0228143f2057f377d24a061c11b1217ac11cf72effd14e50a6742f7b32cb5b3d
Instruction Fuzzy Hash: 9451EEB2A0AB9199F7608B11E44C36A77A9FB847C4F559176EE8C07784EF3CE041CB58

Function 00007FF8A86E2743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A878A792

Strings

%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FF8A878A8A5
%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FF8A878A898

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: _time64
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 1670930206-2648760357
Opcode ID: 88c7a490ab53611d14af1a5616270064923f39c73e072f610315bbf64f80b1dd
Instruction ID: 23f102c6703b319b5cf6dff91bdc393490c08f11590ff2cdfbf267a9c2b60339
Opcode Fuzzy Hash: 88c7a490ab53611d14af1a5616270064923f39c73e072f610315bbf64f80b1dd
Instruction Fuzzy Hash: 3C515332A1D7819BE760DF29F44026AF7A0FB88780F444135EA8D87B59EF3CE4818B14

Function 00007FF8A86E1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF8A87A6A8E
getaddrinfo.WS2_32 ref: 00007FF8A87A6ACF

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FF8A87A6AFC, 00007FF8A87A6B43, 00007FF8A87A6B6F

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: b79d4223b6bbc2254cee69598f955535b60997deb526dee558906d47e9ce2c0d
Instruction ID: e49c7003c4bc8cf68960a1bb0dbff5ec7be04fb23e5219d020b79933a1cc1402
Opcode Fuzzy Hash: b79d4223b6bbc2254cee69598f955535b60997deb526dee558906d47e9ce2c0d
Instruction Fuzzy Hash: 1241C772A1968297F7609F22A444ABAB350FB847C4F504139FB8947B85EF3CD845CB58

Function 00007FF6DFF7DA10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Unknown error, xrefs: 00007FF6DFF7DAAA
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 23188349e83ee451bd10b25c6aa65908cd8bb1407ab069ba85c36fe8cde94703
Instruction ID: ea7d7fa1beba4fb9b81b13a6b6b7af66ed2faf8db1383a30a18d23fb41ca7994
Opcode Fuzzy Hash: 23188349e83ee451bd10b25c6aa65908cd8bb1407ab069ba85c36fe8cde94703
Instruction Fuzzy Hash: 38215B66A04F849AEB118F69D8413EE7371FF59798F444622EE8C57724EF38D259C300

Function 61CC80E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 61CC8140

Strings

%s (%d:%d), xrefs: 61CC8133

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: Err_Format
String ID: %s (%d:%d)
API String ID: 376477240-1595188566
Opcode ID: 960d9e82832d80b5d251f78757c6aac51f3874074bb90b2dd8c425cb276a6d53
Instruction ID: 8a989ee0f3e15c76c927350f18d15c2fb209ccf0fc94d46deaad71a0c4290455
Opcode Fuzzy Hash: 960d9e82832d80b5d251f78757c6aac51f3874074bb90b2dd8c425cb276a6d53
Instruction Fuzzy Hash: 4B01F273B00654C9EB0097A9D8807CE37A1EBCAF84F8E8022CD5D173A1DF29C882D381

Function 00007FF6DFF72F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF6DFF72F57

Part of subcall function 00007FF6DFF72CD0: MessageBoxW.USER32 ref: 00007FF6DFF72D53

Strings

Fatal error detected, xrefs: 00007FF6DFF72F8B
%s%s: %s, xrefs: 00007FF6DFF72F74

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: Message_errno
String ID: %s%s: %s$Fatal error detected
API String ID: 1796756983-2410924014
Opcode ID: d1cbbd953ca21beeb29a1fcc411e82e708ae5de07ba7f1a82297aa0e77065503
Instruction ID: 3528331e711ed51f9038acbe8c82439837edfb55d7efaa6888778f9b2227a186
Opcode Fuzzy Hash: d1cbbd953ca21beeb29a1fcc411e82e708ae5de07ba7f1a82297aa0e77065503
Instruction Fuzzy Hash: 07016262A1C681D1F2209B22F8407EE6764FB94BD4F904232DF9C53B99CE3CD666CB44

Function 00007FF6DFF7DA5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Argument domain error (DOMAIN), xrefs: 00007FF6DFF7DA5C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 4bc73b72bde602d50bd6996f048aa5e1ed414ff175956bb87dcdf23f434c2120
Instruction ID: f409264a34dc21a663902793d20d8ef256a9f8a28325509877978cebf4d50623
Opcode Fuzzy Hash: 4bc73b72bde602d50bd6996f048aa5e1ed414ff175956bb87dcdf23f434c2120
Instruction Fuzzy Hash: 43015A66A04F848AE7118F69D8402AE7770FF4DB99F044722EF8D27724DF28C155C300

Function 00007FF6DFF7DA69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Argument singularity (SIGN), xrefs: 00007FF6DFF7DA69
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: ff2b5c5fb687d91f0b221557c7184b2a53967751068dee2070be2c40401cae02
Instruction ID: 4ec232df48cabf016e323973b6fb810d5ee70b24c5a579c74140d1a437babf19
Opcode Fuzzy Hash: ff2b5c5fb687d91f0b221557c7184b2a53967751068dee2070be2c40401cae02
Instruction Fuzzy Hash: 1A014866A04F848AE7118F69D8402AE7770FF4DB99F044622EF8D2B724DF28C155C300

Function 00007FF6DFF7DA76 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF6DFF7DA76
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 4a93ca5e65c98c494370446ff841bccd9ff8d068e8bfda7413ee571c7891f540
Instruction ID: 40f3be69c8f015ed90040d3d59ad8a048c53a61d45ce2618f5cce828a7fa1eb9
Opcode Fuzzy Hash: 4a93ca5e65c98c494370446ff841bccd9ff8d068e8bfda7413ee571c7891f540
Instruction Fuzzy Hash: 28015666A04F888AE7118F69D8402AE7770FF8DB99F048722EF8D6B725DF28C155C300

Function 00007FF6DFF7DA83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF6DFF7DA83
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 0d1aa399085a75b8b072d80d84b44118880c3291a941a9cf13af9718a2cff7b3
Instruction ID: 7426d82e1fda0ca193de79dfe724d53d3241c4aeaeb8e865a7944e1d53d0f0a3
Opcode Fuzzy Hash: 0d1aa399085a75b8b072d80d84b44118880c3291a941a9cf13af9718a2cff7b3
Instruction Fuzzy Hash: 91015A66A04F848AE7118F69D8402AE7770FF8DB99F044722EF8D67724DF28C155C300

Function 00007FF6DFF7DA90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

Total loss of significance (TLOSS), xrefs: 00007FF6DFF7DA90
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: f67ed119eb88b9fe41558e53022155db75d7e3d109680d0b53d5d3a77e47e22f
Instruction ID: 9b497590dbd34f8225aeb5ebe17caa28a98b3b8d6606dc62705535b93449c97f
Opcode Fuzzy Hash: f67ed119eb88b9fe41558e53022155db75d7e3d109680d0b53d5d3a77e47e22f
Instruction Fuzzy Hash: 32015A66A04F848AE7118F69D8402AE7770FF4DB99F044722EF8D67724DF28C155C300

Function 00007FF6DFF7DA9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6DFF7DB0E

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6DFF7DA9D
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6DFF7DB04

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: b97a8a5cf53c8f5fae4f755748c6196fedc78155e63a17b4b90822ca1f009b6f
Instruction ID: 4044260a64d3866eecffe72d0060c1cebcefad0b55a0cc0e23d2225388023843
Opcode Fuzzy Hash: b97a8a5cf53c8f5fae4f755748c6196fedc78155e63a17b4b90822ca1f009b6f
Instruction Fuzzy Hash: 3F014466A04F888AE7118F69D8402AE7770FB8DB99F048622EF9D6B724DF28C155C300

Function 00007FF8A8514F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FF8A8514F80
PyUnicode_FromString.PYTHON310 ref: 00007FF8A8514F97

Strings

no such name, xrefs: 00007FF8A8514F76

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 533e5db2ea8327bb3688227c18eba153aff2050769d382af6a25517e5fc569ab
Instruction ID: 0e2271cafe212c86c6d1dabc6d9b9db96682aae7047e22e5a493dc53085060a1
Opcode Fuzzy Hash: 533e5db2ea8327bb3688227c18eba153aff2050769d382af6a25517e5fc569ab
Instruction Fuzzy Hash: D1016D31A2AA42A1FB61AB21EC103B963A0FF9CBC9F401031DE4E46351EF2CE1498724

Function 61CDD820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 61CDD830
abort.MSVCRT(?,?,?,?,?,61CD7972), ref: 61CDD851

Strings

LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 61CDD836

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: __iob_funcabort
String ID: LTC_ARGCHK '%s' failure on line %d of file %s
API String ID: 1307436159-2823265812
Opcode ID: 7be6efe7e18f20eb3da32b1681c5e69285cb50896b85a805f227e79cadb39564
Instruction ID: 29a98c079027e3afa66e70cbb24ad838e73306ca4f07025700c82559dfb2dc3e
Opcode Fuzzy Hash: 7be6efe7e18f20eb3da32b1681c5e69285cb50896b85a805f227e79cadb39564
Instruction Fuzzy Hash: A4D05B7421065561DB105B156804B955771F799FD8F4C80109D4D47B209B14D115C340

Function 00007FF8A86E6BE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A87AA2D2
WSAGetLastError.WS2_32 ref: 00007FF8A87AA2DE

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A87AA2F4

Memory Dump Source

Source File: 00000002.00000002.2095810127.00007FF8A86E1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A86E0000, based on PE: true

Associated: 00000002.00000002.2094573699.00007FF8A86E0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A86ED000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8745000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8759000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A876A000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A8770000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A877D000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2095810127.00007FF8A892B000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A892D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8958000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A8989000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89AF000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097305023.00007FF8A89D5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097463664.00007FF8A89FC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097485785.00007FF8A8A02000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A04000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2097505992.00007FF8A8A24000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a86e0000_zapret.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: d80158cf191a90923b6d34e95f28d0695f58e7fdc997def954971b504fcc12af
Instruction ID: 84b9f6d4e438e9b8be112fdbeb643a0ddd01aca683832d251ce3188de79132f2
Opcode Fuzzy Hash: d80158cf191a90923b6d34e95f28d0695f58e7fdc997def954971b504fcc12af
Instruction Fuzzy Hash: B0E09A60F0B503A7F7205B60E809BB9A210EF04385F004138E91D82AA0FF3DB6598B29

Function 00007FF8A8512650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A8512563), ref: 00007FF8A8512656
PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A8512563), ref: 00007FF8A8512688

Strings

3.2.0, xrefs: 00007FF8A8512664

Memory Dump Source

Source File: 00000002.00000002.2092803364.00007FF8A8511000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8510000, based on PE: true

Associated: 00000002.00000002.2092785159.00007FF8A8510000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8516000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A8572000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85BE000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A85C2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2092819596.00007FF8A861B000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093881153.00007FF8A861F000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2093901496.00007FF8A8621000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8510000_zapret.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 69c2b4e3579cbbdfeaa96c61cbd88fc537ba55c567b2cadc9d0896fd70d47e88
Instruction ID: 4208d496b5957e3fe3b0bfff838ef12c1b6fa68b5a3c245e19ef1cc86148af76
Opcode Fuzzy Hash: 69c2b4e3579cbbdfeaa96c61cbd88fc537ba55c567b2cadc9d0896fd70d47e88
Instruction Fuzzy Hash: FDE07575E4BB02A5EE15AB61AC4406422A8FF0CBD5F940175CE5D06360EF3CE1A4C268

Function 61D40B30 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61D40B57
free.MSVCRT ref: 61D40BA8
LeaveCriticalSection.KERNEL32 ref: 61D40BB4

Memory Dump Source

Source File: 00000002.00000002.2090267806.0000000061CC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 61CC0000, based on PE: true

Associated: 00000002.00000002.2090249567.0000000061CC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090321178.0000000061D42000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090339482.0000000061D46000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090355770.0000000061D47000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090379600.0000000061D5F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090396791.0000000061D62000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090413205.0000000061D64000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.2090429418.0000000061D68000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61cc0000_zapret.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 3852664fb548eb3690685970ed851e1bbc8a291f89a352196600bd470e0754d9
Instruction ID: ac1c7fe1ee0cb8314eec24b34ba87c16c995642a6f902d7be043287d4afa6cd5
Opcode Fuzzy Hash: 3852664fb548eb3690685970ed851e1bbc8a291f89a352196600bd470e0754d9
Instruction Fuzzy Hash: 31012C71326A01C6EB48CF95E8903D523A2F7A8BC8F98D425C95DC7360EB6AD4A1C784

Function 00007FF6DFF747E0 Relevance: 5.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF7480C
free.MSVCRT ref: 00007FF6DFF7481A
free.MSVCRT ref: 00007FF6DFF7483C
free.MSVCRT ref: 00007FF6DFF7484A

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 14c5883419c611777b0d93c0fb5d87dc536fad9dcc94c105246673673a4a11ed
Instruction ID: 989cc6f2cd2bf04213030c574eaab4401f27d8d3b2eb54f6acaa518a628baea1
Opcode Fuzzy Hash: 14c5883419c611777b0d93c0fb5d87dc536fad9dcc94c105246673673a4a11ed
Instruction Fuzzy Hash: 3601B163E08515C2EB60DB36E4412BDA770FF88F58F258232CE1E87346CD28D8A2C784

Function 00007FF6DFF76EB0 Relevance: 5.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF6DFF76ECD
free.MSVCRT ref: 00007FF6DFF76EDE
free.MSVCRT ref: 00007FF6DFF76EEF
free.MSVCRT ref: 00007FF6DFF76EF7

Memory Dump Source

Source File: 00000002.00000002.2092586742.00007FF6DFF71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6DFF70000, based on PE: true

Associated: 00000002.00000002.2092573171.00007FF6DFF70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092605870.00007FF6DFF8A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092620515.00007FF6DFF8B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092637221.00007FF6DFF95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF97000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092654562.00007FF6DFF99000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092683720.00007FF6DFF9A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2092701130.00007FF6DFF9D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6dff70000_zapret.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a5be05ce9e3df6903c3f459cc244011c381c899b880c6fb27956f4f42c0584c9
Instruction ID: 53d1c5cef05e611de79c153dfbf840d3de36754651e1243659b0dabcad704ec2
Opcode Fuzzy Hash: a5be05ce9e3df6903c3f459cc244011c381c899b880c6fb27956f4f42c0584c9
Instruction Fuzzy Hash: 40F08C91E0A51245FD69AA72E0203BD57205F44F84F148432CB2E97B82CE2DE862C314

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zapret.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\mfc140u.dll

C:\Users\user\AppData\Local\Temp\_MEI60482\Pythonwin\win32ui.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI60482\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI60482\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\_uuid.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI60482\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI60482\libcrypto-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI60482\libffi-7.dll

Windows Analysis Report
zapret.exe

C:\Users\user\AppData\Local\Temp\tmpghbk2ivq\gen_py\init.py

Function 00007FF6DFF77DB0 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 188
COMMON

Function 00007FF6DFF71154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123
COMMON

Function 00007FF6DFF7A940 Relevance: 6.9, Strings: 5, Instructions: 602
COMMON

Function 00007FF6DFF71CD0 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 139
COMMON

Function 00007FF6DFF7F220 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 353
COMMON

Function 00007FF6DFF79070 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96
COMMON

Function 00007FF6DFF71710 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 198
fileCOMMON

Function 00007FF6DFF78680 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99
processsynchronizationCOMMON

Function 00007FF6DFF71F20 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132
COMMON

Function 00007FF6DFF716D0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 298
stringCOMMON