Edit tour

Windows Analysis Report
PuTTy.exe

Overview

General Information

Sample name:	PuTTy.exe
Analysis ID:	1415345
MD5:	037b72bd0844cb2ce886cd6442c03694
SHA1:	242a11ac80b1370801169997fbf6265a412e61ec
SHA256:	0caa772186814dbf84856293f102c7538980bcd31b70c1836be236e9fa05c48d
Tags:	exeGoLoader
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Installs new ROOT certificates

Potentially malicious time measurement code found

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

PE file contains more sections than normal

PE file contains sections with non-standard names

Stores large binary data to the registry

Tries to load missing DLLs

Classification

Process Tree

System is w10x64

PuTTy.exe (PID: 4920 cmdline: "C:\Users\user\Desktop\PuTTy.exe" MD5: 037B72BD0844CB2CE886CD6442C03694)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PuTTy.exe

ReversingLabs: Detection: 13%

Source: PuTTy.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 4x nop then cmp rdx, rbx	0_2_00007FF775F1C3A0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 4x nop then lock or byte ptr [rdx], r8L	0_2_00007FF775F31420
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 4x nop then shr r10, 0Dh	0_2_00007FF775F3D020
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 4x nop then shr rdi, 0Dh	0_2_00007FF775F3BBA0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 4x nop then cmp rdx, 40h	0_2_00007FF775F30CE0

Source: Joe Sandbox View

IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PuTTy.exe

Code function: 0_2_00007FF775F79180 WSARecv,

0_2_00007FF775F79180

Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /api.php?action=check_ip&ip=102.165.48.43 HTTP/1.1Host: zodiacrealm.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: PuTTy.exe	String found in binary or memory: https://api.ipify.org?format=textpseudo
Source: PuTTy.exe, 00000000.00000002.1270981896.000000C0000B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zodiacrealm.info/api.php?action=check_ip&ip=102.165.48.43
Source: PuTTy.exe	String found in binary or memory: https://zodiacrealm.info/api.php?action=check_ip&ip=Step

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F55E60 NtWaitForSingleObject,	0_2_00007FF775F55E60
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F42E80 RtlAddVectoredContinueHandler,NtWaitForSingleObject,RtlGetCurrentPeb,RtlGetNtVersionNumbers,timeBeginPeriod,timeEndPeriod,WSAGetOverlappedResult,	0_2_00007FF775F42E80
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F795C0 NtWaitForSingleObject,	0_2_00007FF775F795C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4C5E0 NtWaitForSingleObject,	0_2_00007FF775F4C5E0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4C6C0 NtWaitForSingleObject,	0_2_00007FF775F4C6C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4C420 NtWaitForSingleObject,	0_2_00007FF775F4C420
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4C500 NtWaitForSingleObject,	0_2_00007FF775F4C500

Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F38400	0_2_00007FF775F38400
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F1D220	0_2_00007FF775F1D220
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4F300	0_2_00007FF775F4F300
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F390A0	0_2_00007FF775F390A0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F1DDC0	0_2_00007FF775F1DDC0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F559C0	0_2_00007FF775F559C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F45A20	0_2_00007FF775F45A20
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F2B860	0_2_00007FF775F2B860
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F49860	0_2_00007FF775F49860
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F7E880	0_2_00007FF775F7E880
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F1E8C0	0_2_00007FF775F1E8C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F61620	0_2_00007FF775F61620
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F31680	0_2_00007FF775F31680
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F99380	0_2_00007FF775F99380
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F3E440	0_2_00007FF775F3E440
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F59480	0_2_00007FF775F59480
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F674A0	0_2_00007FF775F674A0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F2B4C0	0_2_00007FF775F2B4C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F421C0	0_2_00007FF775F421C0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F25F60	0_2_00007FF775F25F60
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F7EFC0	0_2_00007FF775F7EFC0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F3D020	0_2_00007FF775F3D020
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F49020	0_2_00007FF775F49020
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F3C060	0_2_00007FF775F3C060
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F6AD20	0_2_00007FF775F6AD20
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F5FD80	0_2_00007FF775F5FD80
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F80DE0	0_2_00007FF775F80DE0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F32E00	0_2_00007FF775F32E00
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F71E20	0_2_00007FF775F71E20
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F2AEA0	0_2_00007FF775F2AEA0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F35EC0	0_2_00007FF775F35EC0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F74B49	0_2_00007FF775F74B49
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F98B60	0_2_00007FF775F98B60
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F8FB60	0_2_00007FF775F8FB60
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F3BBA0	0_2_00007FF775F3BBA0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F1AC40	0_2_00007FF775F1AC40
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4CC40	0_2_00007FF775F4CC40
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F2ECE0	0_2_00007FF775F2ECE0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F4FD00	0_2_00007FF775F4FD00
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F5C9E0	0_2_00007FF775F5C9E0
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: 0_2_00007FF775F50AC0	0_2_00007FF775F50AC0

Source: C:\Users\user\Desktop\PuTTy.exe	Code function: String function: 00007FF775F483E0 appears 32 times
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: String function: 00007FF775F608E0 appears 37 times
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: String function: 00007FF775F48300 appears 562 times
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: String function: 00007FF775F4A5C0 appears 579 times
Source: C:\Users\user\Desktop\PuTTy.exe	Code function: String function: 00007FF775F49DA0 appears 66 times

Source: PuTTy.exe

Static PE information: Number of sections : 21 > 10

Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Section loaded: gpapi.dll	Jump to behavior

Source: classification engine

Classification label: mal56.evad.winEXE@1/0@2/2

Source: C:\Users\user\Desktop\PuTTy.exe

Mutant created: \Sessions\1\BaseNamedObjects\??????????????????????????????????????

Source: C:\Users\user\Desktop\PuTTy.exe

File opened: C:\Windows\system32\0a4d4743317859070a9ec403b9aeb5a10379d6544ca48f5868de31371db930e1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: PuTTy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PuTTy.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PuTTy.exe

ReversingLabs: Detection: 13%

Source: PuTTy.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go
Source: PuTTy.exe	String found in binary or memory: -start
Source: PuTTy.exe	String found in binary or memory: -addr
Source: PuTTy.exe	String found in binary or memory: C:/Program Files/Go/src/net/addrselect.go
Source: PuTTy.exe	String found in binary or memory: -start
Source: PuTTy.exe	String found in binary or memory: -addr

Source: PuTTy.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PuTTy.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: PuTTy.exe

Static file information: File size 13198274 > 1048576

Source: PuTTy.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x269000
Source: PuTTy.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x276200
Source: PuTTy.exe	Static PE information: Raw size of /19 is bigger than: 0x100000 < 0x1e8a00
Source: PuTTy.exe	Static PE information: Raw size of /81 is bigger than: 0x100000 < 0x313400

Source: PuTTy.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PuTTy.exe	Static PE information: section name: .xdata
Source: PuTTy.exe	Static PE information: section name: /4
Source: PuTTy.exe	Static PE information: section name: /19
Source: PuTTy.exe	Static PE information: section name: /31
Source: PuTTy.exe	Static PE information: section name: /45
Source: PuTTy.exe	Static PE information: section name: /57
Source: PuTTy.exe	Static PE information: section name: /70
Source: PuTTy.exe	Static PE information: section name: /81
Source: PuTTy.exe	Static PE information: section name: /92
Source: PuTTy.exe	Static PE information: section name: /106

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\PuTTy.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\PuTTy.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\PuTTy.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\PuTTy.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\PuTTy.exe

Code function: 0_2_00007FF775F77880 rdtscp

0_2_00007FF775F77880

Source: C:\Users\user\Desktop\PuTTy.exe

API coverage: 5.3 %

Source: PuTTy.exe, 00000000.00000002.1273684816.00000225B0153000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\PuTTy.exe

Code function: 0_2_00007FF775F77880 Start: 00007FF775F77889 End: 00007FF775F7789F

0_2_00007FF775F77880

Source: C:\Users\user\Desktop\PuTTy.exe

Code function: 0_2_00007FF775F77880 rdtscp

0_2_00007FF775F77880

Source: C:\Users\user\Desktop\PuTTy.exe

Code function: 0_2_00007FF775F11190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,

0_2_00007FF775F11190

Source: C:\Users\user\Desktop\PuTTy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Configuration Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PuTTy.exe	13%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://zodiacrealm.info/api.php?action=check_ip&ip=Step	0%	Avira URL Cloud	safe
https://zodiacrealm.info/api.php?action=check_ip&ip=102.165.48.43	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zodiacrealm.info	91.198.166.79	true	false		unknown
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://zodiacrealm.info/api.php?action=check_ip&ip=102.165.48.43	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/?format=text	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org?format=textpseudo	PuTTy.exe	false		high
https://zodiacrealm.info/api.php?action=check_ip&ip=Step	PuTTy.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.198.166.79	zodiacrealm.info	Gibraltar		41578	LEVEL-NEXTGI	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1415345
Start date and time:	2024-03-25 18:25:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PuTTy.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@1/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 10 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PuTTy.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	#U00f6deme onaylama.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	a7cM5MqeLl8qfNe.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Payment_Advice.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Statement of Accounts.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	QUOTE0001113456250324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Definitive Itinerary.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Resqust for Quote.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	I_DEC.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	SecuriteInfo.com.PWSX-gen.17424.6091.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	microzx.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL-NEXTGI	bxH7w08kAN	Get hash	malicious	Mirai	Browse	195.34.78.104
CLOUDFLARENETUS	https://eTransaction@6412c866.5c79da8e904785696236898f.workers.dev/?qrc=test@test.com	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	8uWQgkZ8o7.exe	Get hash	malicious	LummaC	Browse	104.21.61.80
	NzzLT6kipw.exe	Get hash	malicious	LummaC	Browse	172.67.143.65
	https://hwoyu369d6b4ab5c706a3f6835282bbf38f5.gjhutchings11.workers.dev/	Get hash	malicious	Unknown	Browse	1.1.1.1
	R7piqpsoTx.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	172.67.75.166
	MJ2Ltjq5mk.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	104.26.4.15
	2024SCBC-#U00e9nergies et b#U00e2timent(1).pptx	Get hash	malicious	Unknown	Browse	104.17.25.14
	#U00f6deme onaylama.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	a7cM5MqeLl8qfNe.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	GSO3357.exe	Get hash	malicious	FormBook	Browse	23.227.38.74

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.5584052613325055
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PuTTy.exe
File size:	13'198'274 bytes
MD5:	037b72bd0844cb2ce886cd6442c03694
SHA1:	242a11ac80b1370801169997fbf6265a412e61ec
SHA256:	0caa772186814dbf84856293f102c7538980bcd31b70c1836be236e9fa05c48d
SHA512:	a4ee635a38a3f781a6d8b4994eed2f3ba2102ce3085615914f6a8148bdd9351878dfa20fd11ba65379b9d7670b8d4246ac0083237318120a70a7ec6a841813e2
SSDEEP:	98304:lS949otHsw/xmF4EMz5YA8/cwumyz5E/qfOeXtOqmSr2fvYFgaH3e:E2OtHswYxMHzq7v
TLSH:	28D64903FA948AEECA559279896246C27771FC442F16A7C36B04F63C6DB37D86EB4304
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........L..H,....&....$..&...R................@.....................................y....`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4025e980, 0x1, 0x4025e950, 0x1, 0x402623e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	8c893e679774af99b3a5f251a00677ac

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [005114B5h]
mov dword ptr [eax], 00000001h
call 00007FCB5517CCEFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00511495h]
mov dword ptr [eax], 00000000h
call 00007FCB5517CCCFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FCB553E527Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FCB5517D009h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and cl, byte ptr [ebp+76h]
dec ecx
inc edx
push 00000053h
push 31735374h
jnbe 00007FCB5517D085h
inc ebp
pop eax
imul edx, dword ptr [esi+56h], 44h
das
dec ecx
insb
popad
jnc 00007FCB5517D07Fh
xor eax, 5F337378h
imul ebp, dword ptr [ebx+4Ah], 65415163h
xor al, byte ptr [ebx+2Fh]
xor al, 6Dh
xor dword ptr [ecx+6Ah], ecx
imul esp, dword ptr [esi+48h], 4F504543h
cmp byte ptr [ebp+00h], dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x581000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x582000	0x13f8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x586000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x514000	0xeb2c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x587000	0xb5c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5122e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x582484	0x448	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x268f10	0x269000	dc4ae12b72f9ad6d7fc13727a94acec2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x26a000	0x32430	0x32600	842a01ad79e5d0c051e0ac998678c6ff	False	0.43207196029776673	data	5.422676002804889	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x29d000	0x276130	0x276200	2b325774687a759c1b3395686f6d95c1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x514000	0xeb2c	0xec00	183a5214c192f26d08ad0bade15315b0	False	0.4116459216101695	data	5.625120123755757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x523000	0xc6c	0xe00	5d3c2db7a4636306050d271a16985661	False	0.2592075892857143	data	4.003135362268442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x524000	0x5ce00	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x581000	0x4e	0x200	3fbef6c2c10ad17866afee8e96a85c08	False	0.130859375	data	0.8186529123118903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x582000	0x13f8	0x1400	6ccf508aa61e38da1aefff1abc9f32df	False	0.319140625	data	4.5684469491694895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x584000	0x70	0x200	87484b07d3cd3d74b1dfc4c401bcd909	False	0.083984375	data	0.47773273182820153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x585000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x586000	0x4e8	0x600	4dc4024472776c624fa9b45490fef639	False	0.3333333333333333	data	4.783628429040189	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x587000	0xb5c0	0xb600	037b2f6f246d5a83521fa7a16d309031	False	0.27210679945054944	data	5.435342683198044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x593000	0x8c0	0xa00	d457633a9513a84a8dd5dee55c245fe9	False	0.195703125	data	1.8947153873522524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x594000	0x1e88b1	0x1e8a00	518118c9e545484f6b8acc102d0343e7	False	0.3647492165515477	data	6.135702868320386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x77d000	0x3e2a	0x4000	0dacb109edd129b7f0e00efec779b81a	False	0.20306396484375	data	4.725794528343116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x781000	0xd1cb2	0xd1e00	4561b53efcd87a13d78cd44e4651426f	False	0.4843843061346039	data	5.99056910607981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x853000	0x48e18	0x49000	a0772c55597ae79b98fc6d3d234ea16f	False	0.2630832619863014	data	4.307187692841097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x89c000	0xa4d	0xc00	139f5e740769e48ee340d7a599a84a6e	False	0.3717447916666667	data	4.658994799629712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x89d000	0x3132dc	0x313400	3c8180cc73b631c9ece95b685874abac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/92	0xbb1000	0xd98a0	0xd9a00	961171de91ff24e7473afc98913bf74d	False	0.16003172566053991	data	2.362236568413847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/106	0xc8b000	0x30	0x200	40cca7c46fc713b4f088e5d440ca7931	False	0.103515625	data	0.8556848540171443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x586058	0x48f	XML 1.0 document, ASCII text			0.40102827763496146

Imports

DLL

Import

KERNEL32.dll

AddAtomA, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateProcessA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler

msvcrt.dll

___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen

Exports

Name	Ordinal	Address
_cgo_dummy_export	1	0x140580030

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 28
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 18:26:47.829035997 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:47.829077959 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:47.829159021 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:47.829468966 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:47.829483986 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.038125038 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.038302898 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.038336039 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.038424015 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.038430929 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.040083885 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.040148020 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.146459103 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.146569967 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.146630049 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.193877935 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.193897963 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.241816998 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.339881897 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.339962959 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.340606928 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.340671062 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.340686083 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.340749025 CET	49706	443	192.168.2.11	172.67.74.152
Mar 25, 2024 18:26:48.340756893 CET	443	49706	172.67.74.152	192.168.2.11
Mar 25, 2024 18:26:48.752593040 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:48.752624035 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:48.755170107 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:48.755170107 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:48.755209923 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.350279093 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.350642920 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.350666046 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.350876093 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.350888968 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.352093935 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.352175951 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.359204054 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.359282017 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.359298944 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.404228926 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.406424999 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.406450987 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.454802990 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.569518089 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.569607973 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.569701910 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.584438086 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.584438086 CET	49707	443	192.168.2.11	91.198.166.79
Mar 25, 2024 18:26:49.584458113 CET	443	49707	91.198.166.79	192.168.2.11
Mar 25, 2024 18:26:49.584467888 CET	443	49707	91.198.166.79	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2024 18:26:47.673950911 CET	65491	53	192.168.2.11	1.1.1.1
Mar 25, 2024 18:26:47.769783974 CET	53	65491	1.1.1.1	192.168.2.11
Mar 25, 2024 18:26:48.348526001 CET	50640	53	192.168.2.11	1.1.1.1
Mar 25, 2024 18:26:48.749798059 CET	53	50640	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2024 18:26:47.673950911 CET	192.168.2.11	1.1.1.1	0xcb83	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 25, 2024 18:26:48.348526001 CET	192.168.2.11	1.1.1.1	0x7a91	Standard query (0)	zodiacrealm.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 25, 2024 18:26:47.769783974 CET	1.1.1.1	192.168.2.11	0xcb83	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 25, 2024 18:26:47.769783974 CET	1.1.1.1	192.168.2.11	0xcb83	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 25, 2024 18:26:47.769783974 CET	1.1.1.1	192.168.2.11	0xcb83	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 25, 2024 18:26:48.749798059 CET	1.1.1.1	192.168.2.11	0x7a91	No error (0)	zodiacrealm.info	91.198.166.79	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

zodiacrealm.info

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49706	172.67.74.152	443	4920	C:\Users\user\Desktop\PuTTy.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-25 17:26:48 UTC	106	OUT	GET /?format=text HTTP/1.1 Host: api.ipify.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-03-25 17:26:48 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 25 Mar 2024 17:26:48 GMT Content-Type: text/plain Content-Length: 13 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 86a09ba74f3381d9-IAD
2024-03-25 17:26:48 UTC	13	IN	Data Raw: 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 Data Ascii: 102.165.48.43

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49707	91.198.166.79	443	4920	C:\Users\user\Desktop\PuTTy.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-25 17:26:49 UTC	137	OUT	GET /api.php?action=check_ip&ip=102.165.48.43 HTTP/1.1 Host: zodiacrealm.info User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-03-25 17:26:49 UTC	157	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Mon, 25 Mar 2024 17:26:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13 Connection: close
2024-03-25 17:26:49 UTC	13	IN	Data Raw: 55 6e 73 75 63 63 65 73 73 66 75 6c 6c Data Ascii: Unsuccessfull

Statistics

CPU Usage

• PuTTy.exe

Click to jump to process

Memory Usage

• PuTTy.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Target ID:	0
Start time:	18:26:45
Start date:	25/03/2024
Path:	C:\Users\user\Desktop\PuTTy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PuTTy.exe"
Imagebase:	0x7ff775f10000
File size:	13'198'274 bytes
MD5 hash:	037B72BD0844CB2CE886CD6442C03694
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.7%
Total number of Nodes:	919
Total number of Limit Nodes:	80

Executed Functions

Function 00007FF775F42E80 Relevance: 45.3, Strings: 36, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WSAGetOv, xrefs: 00007FF775F4332E
dResult, xrefs: 00007FF775F43352
Numbers, xrefs: 00007FF775F43178
Handler, xrefs: 00007FF775F42F24
AddVecto, xrefs: 00007FF775F42EEE
timeEndP, xrefs: 00007FF775F4326F
verlappe, xrefs: 00007FF775F43340
nPeriod, xrefs: 00007FF775F4322B
ine_get_, xrefs: 00007FF775F433B4
ForSingl, xrefs: 00007FF775F43091
version, xrefs: 00007FF775F433C3
ws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in goselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong Ptrace: out of memoryheader line too longGetAdaptersAddresses, xrefs: 00007FF775F43412
ws2_32.dll, xrefs: 00007FF775F432E6
wine_get, xrefs: 00007FF775F433A5
SystemFu, xrefs: 00007FF775F42FBD
eObject, xrefs: 00007FF775F430A3
WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepani, xrefs: 00007FF775F43401
advapi32.dll not foundduplicated defer entryruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type trace: alloc too largenon-Go function at, xrefs: 00007FF775F43458
RtlGetNt, xrefs: 00007FF775F43154
timeBegi, xrefs: 00007FF775F4321C
NtWaitFo, xrefs: 00007FF775F4307F
RtlGetCu, xrefs: 00007FF775F430ED
advapi32.dll, xrefs: 00007FF775F42F75
tVersion, xrefs: 00007FF775F43166
dPeriod, xrefs: 00007FF775F4327E
kernel32.dll not foundadvapi32.dll not foundduplicated defer entryruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type trace: alloc too l, xrefs: 00007FF775F43469
rentPeb, xrefs: 00007FF775F4310B
tlGetCur, xrefs: 00007FF775F430FC
stemFunc, xrefs: 00007FF775F42FCF
winmm.dll, xrefs: 00007FF775F431CF
Continue, xrefs: 00007FF775F42F12
tion036, xrefs: 00007FF775F42FE1
timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too longinvalid function symbol tableinvalid length of trace even, xrefs: 00007FF775F43425
redConti, xrefs: 00007FF775F42F00
ntdll.dll, xrefs: 00007FF775F43032
kernel32.dll, xrefs: 00007FF775F42E9A

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: AddVecto$Continue$ForSingl$Handler$NtWaitFo$Numbers$RtlGetCu$RtlGetNt$SystemFu$WSAGetOv$WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepani$advapi32.dll$advapi32.dll not foundduplicated defer entryruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type trace: alloc too largenon-Go function at$dPeriod$dResult$eObject$ine_get_$kernel32.dll$kernel32.dll not foundadvapi32.dll not foundduplicated defer entryruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type trace: alloc too l$nPeriod$ntdll.dll$redConti$rentPeb$stemFunc$tVersion$timeBegi$timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too longinvalid function symbol tableinvalid length of trace even$timeEndP$tion036$tlGetCur$verlappe$version$wine_get$winmm.dll$ws2_32.dll$ws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in goselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong Ptrace: out of memoryheader line too longGetAdaptersAddresses
API String ID: 0-3729139115
Opcode ID: 4b96316937aaaf55366d587bc97639c8c6c77cecc9b9da070cad624ebc4d8915
Instruction ID: ab02e35ea9221be998824d3ecf9864e18fdd8c14b706713de73f4047f9f6c15c
Opcode Fuzzy Hash: 4b96316937aaaf55366d587bc97639c8c6c77cecc9b9da070cad624ebc4d8915
Instruction Fuzzy Hash: 76E14272A38B8680EA50EB12FC447AAB3A5FB45BC0F848135D98C47BA9DF7DD544C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F1D220 Relevance: 12.9, Strings: 10, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: , xrefs: 00007FF775F1D954
out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi, xrefs: 00007FF775F1D5D6
out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit, xrefs: 00007FF775F1D5C5
end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerrunt, xrefs: 00007FF775F1D8BD
, xrefs: 00007FF775F1D8AD
arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p , xrefs: 00007FF775F1D5E7
base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c, xrefs: 00007FF775F1D88F
memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new , xrefs: 00007FF775F1D97E
out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescsuspendG from non-preempti, xrefs: 00007FF775F1D5F8
region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m, xrefs: 00007FF775F1D863

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: $) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: $arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p $base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c$end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerrunt$memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new $out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit$out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescsuspendG from non-preempti$out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi$region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m
API String ID: 0-2908405890
Opcode ID: a9b7e242114ce2353f5a8305fe4ff356203a124d2fc32717b350ddc33b941b85
Instruction ID: 2152431c1c02fe61e644c348ac0d3321dc639ae5dc851a4e0bd3c6038281b9e2
Opcode Fuzzy Hash: a9b7e242114ce2353f5a8305fe4ff356203a124d2fc32717b350ddc33b941b85
Instruction Fuzzy Hash: F6029123A29BC182EB90AB11E4407BAB765FB85F94F844532EE9D43799CF3CE544C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F1DDC0 Relevance: 8.0, Strings: 6, Instructions: 514COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00007FF775F1E10D
mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 00007FF775F1E58C
mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largecrypto/cipher: incorrect nonce length given to GCMchacha20: , xrefs: 00007FF775F1E5BF
malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=, xrefs: 00007FF775F1E59D
delayed zeroing on data that may contain pointerssweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnableecdsa: internal error: truncated hash is too longcrypto/elliptic, xrefs: 00007FF775F1E547
malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = recovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=]morebuf={pc:: no frame (sp=runtime: frame runti, xrefs: 00007FF775F1E5AE

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$delayed zeroing on data that may contain pointerssweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnableecdsa: internal error: truncated hash is too longcrypto/elliptic$malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = recovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=]morebuf={pc:: no frame (sp=runtime: frame runti$malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=$mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largecrypto/cipher: incorrect nonce length given to GCMchacha20: $mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno=
API String ID: 0-850241918
Opcode ID: 7418a724594f3a7d8b132c04ac9dbcc95f31f3450cc7d1f2792c9ed302844d8c
Instruction ID: 6fac0f4dbea73263a160af56cb601f2ddbd8954e3cc7f28a2fb1c468f0a21b96
Opcode Fuzzy Hash: 7418a724594f3a7d8b132c04ac9dbcc95f31f3450cc7d1f2792c9ed302844d8c
Instruction Fuzzy Hash: 8132B163A386C282EB50AB15E4407BAAB65FB45F94F844936EF8D47795CF3CE940C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F45A20 Relevance: 4.0, Strings: 3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

runtime.preemptM: duplicatehandle faileddeferproc: d.panic != nil after newdefermust be able to track idle limiter eventruntime: SyscallN has too many argumentsevictOldest(%v) on table with %v entriescrypto/cipher: message too large for GCMcrypto/cipher: outpu, xrefs: 00007FF775F45E85
runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=x509: X25519 key encoded with illegal parametersx509: SAN uniformResourceIdentifier is malformedx509: IP constraint contained value of length %dx509: internal error, xrefs: 00007FF775F45E5D
self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch (sensitive)RevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot poll, xrefs: 00007FF775F45E96

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=x509: X25519 key encoded with illegal parametersx509: SAN uniformResourceIdentifier is malformedx509: IP constraint contained value of length %dx509: internal error$runtime.preemptM: duplicatehandle faileddeferproc: d.panic != nil after newdefermust be able to track idle limiter eventruntime: SyscallN has too many argumentsevictOldest(%v) on table with %v entriescrypto/cipher: message too large for GCMcrypto/cipher: outpu$self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatch (sensitive)RevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot poll
API String ID: 0-542705066
Opcode ID: 12041f36b5bcdd64a5b60cc9a79a6675a181f3390e4ebdcaadb0fb12dc4b4419
Instruction ID: 3be0a17f93f45a55bb56eba6ea0ff96eed2788e5e7659cc20f582f9cbba29f06
Opcode Fuzzy Hash: 12041f36b5bcdd64a5b60cc9a79a6675a181f3390e4ebdcaadb0fb12dc4b4419
Instruction Fuzzy Hash: 85D17033A29B8281DA51FB25E8803BAA760FB46F94F949235DE9C43795DF3CE481C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F390A0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryunfinished open-coded defers in deferreturnruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=ru, xrefs: 00007FF775F39602

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryunfinished open-coded defers in deferreturnruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=ru
API String ID: 0-3045916205
Opcode ID: 6ff496ac22c371e283768d8e957b3ca929ef14b242b2014f054f468a03a525b7
Instruction ID: 22e8a8875545458aac51b8527972dfddda71c1ea51900fd182500b9f644a73f4
Opcode Fuzzy Hash: 6ff496ac22c371e283768d8e957b3ca929ef14b242b2014f054f468a03a525b7
Instruction Fuzzy Hash: 5CE18F63A3DBC681EA60AF15E5807AAE7A0FB85F90F945135DA8D43B99CF3CD450CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F79180 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007FF775F791F3

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: ae9484ab8339121adab38818ee12098b0ed07cd46f7304dadeff90e65abf235e
Instruction ID: 58187b4dd45749db721fa2ce5397546a727bb6edfe27afb3837ad8f687713bab
Opcode Fuzzy Hash: ae9484ab8339121adab38818ee12098b0ed07cd46f7304dadeff90e65abf235e
Instruction Fuzzy Hash: 35016D36A14F80C1EB109B5AE9413297374E748BE4F644225DFAD57BA4CF39E1A3C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F559C0 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e65949b94060199da2e61c7b20b912fb9e9dc1dace1b101db1f9ffdee3a606f
Instruction ID: 8a3a3899caf234872cca0cb5f41588d12b3b5884bbcc3e2a5581f2d190e799cb
Opcode Fuzzy Hash: 7e65949b94060199da2e61c7b20b912fb9e9dc1dace1b101db1f9ffdee3a606f
Instruction Fuzzy Hash: BBD17133B3DA8286EA04AB16E85427AF7A0FF85B80F845035E58D477A9DF7CE540C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4F300 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a0bec1e240109df92d0a9c99088685e145cdb704f1d5e6f58e8d4d8f06adba
Instruction ID: 05f4824eeaf4cd86b2154f9bef9893675bd1f081d778f0562a57f551ca06cf01
Opcode Fuzzy Hash: 12a0bec1e240109df92d0a9c99088685e145cdb704f1d5e6f58e8d4d8f06adba
Instruction Fuzzy Hash: AA918633E3868286FF14BF16D88477AE691AF84F84FD49035C50D573A5DE2CE9828760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F38400 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af685f71c755950569c5d8edf0092a1eec7ff412b6c08ed56e1c4896b0e83f8
Instruction ID: 0a7ff8d4bb1de355e5c89befb91df6427bd114d2458cdbe04c613e75a816c671
Opcode Fuzzy Hash: 0af685f71c755950569c5d8edf0092a1eec7ff412b6c08ed56e1c4896b0e83f8
Instruction Fuzzy Hash: 4B418277A28B8691E744AB16E8801EEA760FB84F50FC58036DA4E43B69CF3CD646C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F55E60 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a976cbe4cc897a64db5d218d18352369ef04d6662949e968853662eaa32815
Instruction ID: 453642d57818ac6ec5c7f5bd5dd8dc121de16a8e5e193c352864988239ddc10c
Opcode Fuzzy Hash: 08a976cbe4cc897a64db5d218d18352369ef04d6662949e968853662eaa32815
Instruction Fuzzy Hash: D7214C33A28F8581EA00EB25E84117AB7A0FB4AF80F959231EE9C43755DF3DE191C710

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF775F3C060 Relevance: 14.3, Strings: 11, Instructions: 542COMMON

Download Yara Rule

Strings

runtime: p.searchAddr = range partially overlapsbad defer entry in panicbypassed recovery failedstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartidna: disallowed rune %Uchacha20: wrong key sizex509: malformed vali, xrefs: 00007FF775F3C8C5
] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5CANCELGOAWAYPADDEDlistensocketSunday, xrefs: 00007FF775F3C398
, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) base GetACPrdtscppopcntCommonLengthheaderAnswercmd/goSTREETavx512rdrandrdseedAPPDATAfloat32float64UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:sch, xrefs: 00007FF775F3C8E5
, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by HTTPS_PROXYhttps_proxyMoveFil, xrefs: 00007FF775F3C85C
runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon, xrefs: 00007FF775F3C945
runtime: summary[runtime: level = , p.searchAddr = runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff Syste, xrefs: 00007FF775F3C35F, 00007FF775F3C796
, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9avx512fosxsave#internG, xrefs: 00007FF775F3C87A
] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+08, xrefs: 00007FF775F3C7D6
, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 00007FF775F3C965
runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr cleantimers: bad p frames elided..., locked to threadruntime.semacreateruntime.semawakeupdecoding, xrefs: 00007FF775F3C40F
bad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:inva, xrefs: 00007FF775F3C43C, 00007FF775F3CB8C

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: , i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) base GetACPrdtscppopcntCommonLengthheaderAnswercmd/goSTREETavx512rdrandrdseedAPPDATAfloat32float64UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:sch$, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32.5.4.52.5.4.72.5.4.82.5.4.9avx512fosxsave#internG$, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by HTTPS_PROXYhttps_proxyMoveFil$] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+08$] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5CANCELGOAWAYPADDEDlistensocketSunday$bad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:inva$runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflowsemacquire not on the G stackruntime: split stack overflowstring concatenation too lon$runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr cleantimers: bad p frames elided..., locked to threadruntime.semacreateruntime.semawakeupdecoding$runtime: p.searchAddr = range partially overlapsbad defer entry in panicbypassed recovery failedstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartidna: disallowed rune %Uchacha20: wrong key sizex509: malformed vali$runtime: summary[runtime: level = , p.searchAddr = runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff Syste
API String ID: 0-4062963944
Opcode ID: 3db2beec586eaa063211c001e204b84b660399382cd4849b34f70cc8f6eec98e
Instruction ID: 450c877bce0cc37cee56e51607380a453250607742cd799a04a82f5ef1bca211
Opcode Fuzzy Hash: 3db2beec586eaa063211c001e204b84b660399382cd4849b34f70cc8f6eec98e
Instruction Fuzzy Hash: 2C326E77B39BC681FA60AB11E4417EAA325FB49B80F804532DE8D17B9ADE3CD445C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F35EC0 Relevance: 13.3, Strings: 10, Instructions: 756COMMON

Download Yara Rule

Strings

previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:, xrefs: 00007FF775F368CF
sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionpoly1305, xrefs: 00007FF775F367C6
mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgorefl, xrefs: 00007FF775F36833, 00007FF775F36C05
sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt, xrefs: 00007FF775F36919
mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedcould not find QPC syscallsruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSTh, xrefs: 00007FF775F36C2A
mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1, xrefs: 00007FF775F36C3B
mspan.sweep: bad span state after sweepruntime: blocked write on free polldescsuspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function invalid indexed representa, xrefs: 00007FF775F36858
nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/httpgo/build2.5.4.102.5.4.112.5.4.17avx512cdavx5, xrefs: 00007FF775F368B2
sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine HTTP_PROXY, xrefs: 00007FF775F36818, 00007FF775F36BE5
swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runti, xrefs: 00007FF775F367D7

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgorefl$ nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/httpgo/build2.5.4.102.5.4.112.5.4.17avx512cdavx5$ previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:$ sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine HTTP_PROXY$mspan.sweep: bad span state after sweepruntime: blocked write on free polldescsuspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function invalid indexed representa$mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedcould not find QPC syscallsruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSTh$mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1$sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionpoly1305$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = runtime.newosprocruntime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runti
API String ID: 0-4174013723
Opcode ID: dd59ef907015ad3ae028f65bccb02bff8d9ef310fc156e527700ec9f1207c1c2
Instruction ID: ed27ba5b24dc7ea81043d9e98fe46d2d023fec2b168b577181394a9f4d627720
Opcode Fuzzy Hash: dd59ef907015ad3ae028f65bccb02bff8d9ef310fc156e527700ec9f1207c1c2
Instruction Fuzzy Hash: 2A829173A3CAC685EB60AB11E4407BAB7A1FB45B84F855135EA8D03B99DF3CE454C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F2B860 Relevance: 13.1, Strings: 10, Instructions: 645COMMON

Download Yara Rule

Strings

gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun, xrefs: 00007FF775F2C4E9
MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 00007FF775F2C305
MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException , xrefs: 00007FF775F2C2C5
failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedcould not find QP, xrefs: 00007FF775F2C4D8
., xrefs: 00007FF775F2BE34
MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g , xrefs: 00007FF775F2C2E5
gc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGreadpipefileopenStatbindJuneJuly as hourEESTSASTAK, xrefs: 00007FF775F2BEB4
gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5C, xrefs: 00007FF775F2B91A
ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=, xrefs: 00007FF775F2C24B
ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32, xrefs: 00007FF775F2C045

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException $ MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g $ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=$.$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedcould not find QP$gc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGreadpipefileopenStatbindJuneJuly as hourEESTSASTAK$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun$gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5C
API String ID: 0-2256705910
Opcode ID: e77be2a7af6f414896d959af961b8905c40004360d7d1a32399497d972be4a78
Instruction ID: 350fe371915f892e7e1fc531dfb48df27cd1936a2fdcade6f6cdc0262eae39a6
Opcode Fuzzy Hash: e77be2a7af6f414896d959af961b8905c40004360d7d1a32399497d972be4a78
Instruction Fuzzy Hash: 6D623D73A3DBC285EA50BB16E8413BAB765EB49B80FC44131D98D537AADF2CE544C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F5FD80 Relevance: 12.9, Strings: 10, Instructions: 369COMMON

Download Yara Rule

Strings

runtime: frame runtimer: bad ptraceback stuckImpersonateSelfOpenThreadTokenRegCreateKeyExWRegDeleteValueW is unavailableinvalid integerinvalid boolean0601021504Z0700non-minimal tagunknown Go typereflectlite.Setinvalid pointerjstmpllitinterptarinsecurepathzipin, xrefs: 00007FF775F601D4, 00007FF775F6035A
untyped args out of range no module data in goroutine need more dataREQUEST_METHODModule32FirstWunreachable: RegSetValueExWdata truncatedResourceHeaderRCodeNameErrormime/multipartnegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrec, xrefs: 00007FF775F601F7
args stack map entries for invalid runtime symbol tableruntime: no module data for [originating from goroutine invalid byte in chunk lengthinvalid proxy address %q: %vbig: misuse of expNNWindowedx509: invalid RSA public keyx509: invalid DSA public keyx509: in, xrefs: 00007FF775F60136
locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "subtle.XORBytes: dst too shortcrypto/rsa: verification errorx509: invalid ECDSA parametersx509: SAN dNSName is, xrefs: 00007FF775F602C5
bad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192.121.16.228:220123456789ABCDEFX01, xrefs: 00007FF775F6018A, 00007FF775F6031B
and tls: Earlyparsehostsfilesimap2imap3imapspop3sutf-8%s*%dtext/defersweepschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at , xrefs: 00007FF775F6011B, 00007FF775F602A5
(targetpc= , plugin: runtime: g : frame.sp=created by HTTPS_PROXYhttps_proxyMoveFileExWNetShareAddNetShareDelSHA-512/224SHA-512/256BLAKE2s-256BLAKE2b-256BLAKE2b-384BLAKE2b-512authoritiesadditionalsClassHESIODgocachehashgocachetestarchive/tarcrypto/x509archive, xrefs: 00007FF775F60159, 00007FF775F602E8
missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192.121.16.228:22012, xrefs: 00007FF775F60239, 00007FF775F603CF
runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pevictCount overflowSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedunknown hash value negative coordinatex509: malformed OIDx509: trailin, xrefs: 00007FF775F600FD, 00007FF775F60287
untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192., xrefs: 00007FF775F6037D

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: (targetpc= , plugin: runtime: g : frame.sp=created by HTTPS_PROXYhttps_proxyMoveFileExWNetShareAddNetShareDelSHA-512/224SHA-512/256BLAKE2s-256BLAKE2b-256BLAKE2b-384BLAKE2b-512authoritiesadditionalsClassHESIODgocachehashgocachetestarchive/tarcrypto/x509archive$ and tls: Earlyparsehostsfilesimap2imap3imapspop3sutf-8%s*%dtext/defersweepschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at $ args stack map entries for invalid runtime symbol tableruntime: no module data for [originating from goroutine invalid byte in chunk lengthinvalid proxy address %q: %vbig: misuse of expNNWindowedx509: invalid RSA public keyx509: invalid DSA public keyx509: in$ locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "subtle.XORBytes: dst too shortcrypto/rsa: verification errorx509: invalid ECDSA parametersx509: SAN dNSName is$ untyped args out of range no module data in goroutine need more dataREQUEST_METHODModule32FirstWunreachable: RegSetValueExWdata truncatedResourceHeaderRCodeNameErrormime/multipartnegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrec$ untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192.$bad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192.121.16.228:220123456789ABCDEFX01$missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zerolength too largeinvalid dns nameunpacking headerRCodeFormatErroravx512vpclmulqdq192.121.16.228:22012$runtime: frame runtimer: bad ptraceback stuckImpersonateSelfOpenThreadTokenRegCreateKeyExWRegDeleteValueW is unavailableinvalid integerinvalid boolean0601021504Z0700non-minimal tagunknown Go typereflectlite.Setinvalid pointerjstmpllitinterptarinsecurepathzipin$runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pevictCount overflowSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedunknown hash value negative coordinatex509: malformed OIDx509: trailin
API String ID: 0-3617834852
Opcode ID: ac00e82b9245ce306a76b0eb8393c541605139a335cbd378f3ee2d0a5d4c14b1
Instruction ID: cfa1c1a93075a5195150501730aa56cbb9dc6c7ac025b1774d0913c452790592
Opcode Fuzzy Hash: ac00e82b9245ce306a76b0eb8393c541605139a335cbd378f3ee2d0a5d4c14b1
Instruction Fuzzy Hash: 9E025F3763CAC285EA60FB25E4807AAE365FB49B84F944131DA8D4379ADF3CE544C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F11190 Relevance: 12.2, APIs: 8, Instructions: 193sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF775F111F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF775F11268
malloc.MSVCRT ref: 00007FF775F11333
strlen.MSVCRT ref: 00007FF775F11355
malloc.MSVCRT ref: 00007FF775F11361
memcpy.MSVCRT ref: 00007FF775F11379
GetStartupInfoA.KERNEL32 ref: 00007FF775F11463

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: 9d28d8b69045d7985b2ee6a8b57febb3bec335bad0a8f40b9aea03016f51e93e
Instruction ID: 17290eac71d491ddc74870074f47508f6af561c82f20d112dd10298a3f0298e4
Opcode Fuzzy Hash: 9d28d8b69045d7985b2ee6a8b57febb3bec335bad0a8f40b9aea03016f51e93e
Instruction Fuzzy Hash: 2F817F37E39A8685FB50BF12E850BBAA3A1AF45B80FC44935DD0C47799DE2DE904C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F30CE0 Relevance: 7.7, Strings: 6, Instructions: 176COMMON

Download Yara Rule

Strings

runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflo, xrefs: 00007FF775F30EA7
base of <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0, xrefs: 00007FF775F30F1B
objgc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGreadpipefileopenStatbindJuneJuly as hourEESTSAS, xrefs: 00007FF775F30F36
greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has, xrefs: 00007FF775F30F6F
marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [missing deferreturnpanic during mallocpanic holding lockspanic during panic, g->atomics, xrefs: 00007FF775F30F5E
found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gs, xrefs: 00007FF775F30EC5

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gs$base of <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0$greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockruntime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has$marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [missing deferreturnpanic during mallocpanic holding lockspanic during panic, g->atomics$objgc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGreadpipefileopenStatbindJuneJuly as hourEESTSAS$runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)LockOSThread nesting overflo
API String ID: 0-3604055129
Opcode ID: 34d1639a8bd55bfebaf196c845dec2b5bf7fcd5d4b8825e325c0601f9ed961fe
Instruction ID: 03972546df5ef7b2164d83821d2834abd85e0a0d2771592b924aa5e7f64b11b7
Opcode Fuzzy Hash: 34d1639a8bd55bfebaf196c845dec2b5bf7fcd5d4b8825e325c0601f9ed961fe
Instruction Fuzzy Hash: 0B719363A38BC286FA50AB11E4403B9E765FB45F84F845136EE8D0779ACF2CE594C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F6AD20 Relevance: 6.7, Strings: 5, Instructions: 440COMMON

Download Yara Rule

Strings

sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-09301562578125int16int32in, xrefs: 00007FF775F6B372
...key???///%25Viaudpdns::1setcgoftpfinobjgc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGrea, xrefs: 00007FF775F6B192
non-Go function at pc=hpack: string too longheader field %q = %q%sidna: invalid label %qRtlLookupFunctionEntryCreateEnvironmentBlock%SystemRoot%\system32\overflowing coordinateinvalid number base %dx509: malformed issuerzero length BIT STRINGreflectlite.Value., xrefs: 00007FF775F6B4A5
fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-09301562578125int16int32int64uint8arra, xrefs: 00007FF775F6B352
pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1, xrefs: 00007FF775F6B392

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-09301562578125int16int32int64uint8arra$ pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1$ sp= sp: lr: fp=) m=xn--ermssse3avx2bmi1bmi2asn1bitsNameTypecx16sse2false<nil>Error:***@Rangeallowrangehttpsclose:path%s %q%s=%sHTTP/socksFound&"'writentohsMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-09301562578125int16int32in$...key???///%25Viaudpdns::1setcgoftpfinobjgc %: gp *(in n= ) - P MPC= < end > ]:pc= G204206304400500adxaesshaavxfmaMD4MD5RSADSAURISET): TTLnetroottruePOSTEtag0x%xdateetagfromhostlinkvaryHostDatehttpgzip%xGone<>idle1080DATAPINGrea$non-Go function at pc=hpack: string too longheader field %q = %q%sidna: invalid label %qRtlLookupFunctionEntryCreateEnvironmentBlock%SystemRoot%\system32\overflowing coordinateinvalid number base %dx509: malformed issuerzero length BIT STRINGreflectlite.Value.
API String ID: 0-1984337319
Opcode ID: bfb9cda0d6dcfe69d6730e784b1b3acb51f86123160cb9a2ee2edd7b6a44c36c
Instruction ID: 048270a0e805a2d462d66b954cf32e768f7120ede912d4dfa981888c0efd2918
Opcode Fuzzy Hash: bfb9cda0d6dcfe69d6730e784b1b3acb51f86123160cb9a2ee2edd7b6a44c36c
Instruction Fuzzy Hash: 18222C3363DBC185E660AB11E4847AAE761FB89B84F944235EACD07B9ACF3CD444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F49020 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function invalid indexed representation index %dcipher: incorrect tag size given to GCMecdsa: public key point is, xrefs: 00007FF775F4954A
, goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32, xrefs: 00007FF775F4946F, 00007FF775F494F7
runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr cleantimers: bad p frames elided..., locked to threadruntime.semacreateruntime.semawakeupdecoding error: %vGetComputerNameExWGetModuleFileNameWuse of c, xrefs: 00007FF775F49451
, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [missing deferreturnpanic during mallocpanic holding lockspanic during , xrefs: 00007FF775F4948F
invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zeroleng, xrefs: 00007FF775F49539

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: , goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32$, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [missing deferreturnpanic during mallocpanic holding lockspanic during $invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:invalid encodingDuplicateTokenExGetCurrentThreadRtlVirtualUnwindGODEBUG: value "division by zeroleng$runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr cleantimers: bad p frames elided..., locked to threadruntime.semacreateruntime.semawakeupdecoding error: %vGetComputerNameExWGetModuleFileNameWuse of c$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function invalid indexed representation index %dcipher: incorrect tag size given to GCMecdsa: public key point is
API String ID: 0-956697974
Opcode ID: 57993fe9ea1cd9c778d63f1d79ea4f06ae8652e0dd7f2565b2a327d64f355945
Instruction ID: 30ba6e27a63d19f1e53bc217e228c91622f783fb2d629d237a11d2a1b587bea2
Opcode Fuzzy Hash: 57993fe9ea1cd9c778d63f1d79ea4f06ae8652e0dd7f2565b2a327d64f355945
Instruction Fuzzy Hash: A1E13033A3C7C186E750EB15E541A7AFB65EB85F90F844175EA9D03B9ACF2CE5408B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F1C3A0 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0, xrefs: 00007FF775F1C4AF
cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactiveso, xrefs: 00007FF775F1C445
packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/, xrefs: 00007FF775F1C465
-> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac, xrefs: 00007FF775F1C485
runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p, xrefs: 00007FF775F1C425

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: -> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac$ cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactiveso$ packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/$lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0$runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p
API String ID: 0-1933805
Opcode ID: 3856d985c366afca65e3fd49458a52b0cb318e9eb278dbca97dbdc71d64d9920
Instruction ID: 6b72f3926187477ed67d5cdf78af0fe4717c43638a7d1049fa9ef25e24251221
Opcode Fuzzy Hash: 3856d985c366afca65e3fd49458a52b0cb318e9eb278dbca97dbdc71d64d9920
Instruction Fuzzy Hash: A1313033A39BC686E600BF10E8415B9E764EB49B80FC85931EE8D477AADF3CD4518720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4FD00 Relevance: 5.7, Strings: 4, Instructions: 744COMMON

Download Yara Rule

Strings

findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r, xrefs: 00007FF775F508FD
findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi, xrefs: 00007FF775F5090E
findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadlinechacha20: outpu, xrefs: 00007FF775F508DB
findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina, xrefs: 00007FF775F508EC

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [origina$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does not support deadlinechacha20: outpu$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfi
API String ID: 0-1197349456
Opcode ID: 459d80f7625579ffe4d1fcada37b87dfe7f26062653bef9645261ddead5b1299
Instruction ID: f7990849ed048665cd1e26d764a80826c111125facf4a7f6879c7d9ef697beb0
Opcode Fuzzy Hash: 459d80f7625579ffe4d1fcada37b87dfe7f26062653bef9645261ddead5b1299
Instruction Fuzzy Hash: 0B728233A3D6C285EB60AB16E8403BAE764EB85F90F845035DA4C17B99DF3CE585C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F2AEA0 Relevance: 5.3, Strings: 4, Instructions: 312COMMON

Download Yara Rule

Strings

flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan, xrefs: 00007FF775F2B375
runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64, xrefs: 00007FF775F2B35A
p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in go, xrefs: 00007FF775F2B3B8
!= sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase, xrefs: 00007FF775F2B390

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase$ flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan$p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in go$runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64
API String ID: 0-3993034679
Opcode ID: 4d357d1d600e82de21b7afe64a60f45d7664b357b80bd4aede827da8016388e3
Instruction ID: 7182ca83fd1c1e1d75af481a1680f65290d91691258b603055b1412d8bc441a9
Opcode Fuzzy Hash: 4d357d1d600e82de21b7afe64a60f45d7664b357b80bd4aede827da8016388e3
Instruction Fuzzy Hash: ABE15073A3DB8286EB44AB25E84026EF761FB49B90F844135DA5D437A9DF3CE944C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4CC40 Relevance: 5.3, Strings: 4, Instructions: 266COMMON

Download Yara Rule

Strings

casgstatus: waiting for Gwaiting but is Grunnableecdsa: internal error: truncated hash is too longcrypto/elliptic: internal error: invalid encodingx509: invalid RDNSequence: invalid attribute typex509: Ed25519 key encoded with illegal parameterschacha20poly130, xrefs: 00007FF775F4CFBB
newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/httpgo/build2.5.4.102.5.4.112.5.4.17avx512cdavx512eravx512pfavx512vlavx5, xrefs: 00007FF775F4D025
runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid , xrefs: 00007FF775F4D007
casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangex509: malformed GeneralizedTimex509: invalid basic constraintsx509: malfor, xrefs: 00007FF775F4D04F

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes if-rangeNO_PROXYno_proxyMD5+SHA1SHA3-224SHA3-256SHA3-384SHA3-512SHA1-RSADSA-SHA1x509sha1DNS nameClassANYQuestionnet/httpgo/build2.5.4.102.5.4.112.5.4.17avx512cdavx512eravx512pfavx512vlavx5$casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangex509: malformed GeneralizedTimex509: invalid basic constraintsx509: malfor$casgstatus: waiting for Gwaiting but is Grunnableecdsa: internal error: truncated hash is too longcrypto/elliptic: internal error: invalid encodingx509: invalid RDNSequence: invalid attribute typex509: Ed25519 key encoded with illegal parameterschacha20poly130$runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid
API String ID: 0-2589707916
Opcode ID: abaa8f00015929c6802137067a68baa2f392418446e2be6dbf39b3681ba6e594
Instruction ID: b07d8fd0dbac2c9dc34ca7c6dea60e6db6914b580bdc1230cc859be52081fa10
Opcode Fuzzy Hash: abaa8f00015929c6802137067a68baa2f392418446e2be6dbf39b3681ba6e594
Instruction Fuzzy Hash: EBC17137A39A8285E614EF26D44176AF761FB4AF90F849132DA5C43799CF3DE441CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F49860 Relevance: 5.2, Strings: 4, Instructions: 224COMMON

Download Yara Rule

Strings

runtime., xrefs: 00007FF775F49A1B
reflect., xrefs: 00007FF775F49A7B
runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff SystemFunction036RegLoadMUIStringW%%!%c(big.Int=%s)invalid BMPStringinval, xrefs: 00007FF775F49A54
bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=store64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine need more dataREQUEST_METHODModule32FirstWunreachable: RegSetVa, xrefs: 00007FF775F49B45

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=store64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine need more dataREQUEST_METHODModule32FirstWunreachable: RegSetVa$reflect.$runtime.$runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff SystemFunction036RegLoadMUIStringW%%!%c(big.Int=%s)invalid BMPStringinval
API String ID: 0-3279910817
Opcode ID: 28187a6240e09010e983808f967cc91d3412a2021f2642f630a539f2f0024913
Instruction ID: ac8a14c1933b43d5d8b697c04e6e53610f3ff8411dfd1d493929b007f5b16bc0
Opcode Fuzzy Hash: 28187a6240e09010e983808f967cc91d3412a2021f2642f630a539f2f0024913
Instruction Fuzzy Hash: 0981A733B3868186EB60AF109140BBEE391FB85F94F988135DA9D47784DF3CE9918720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F31680 Relevance: 3.9, Strings: 3, Instructions: 179COMMON

Download Yara Rule

Strings

(scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32.5.4.52.5.4.72, xrefs: 00007FF775F318A5
MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from gzip, deflateGetTempPath2WModule32NextW, xrefs: 00007FF775F31905
pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in goselectgo: bad wakeupsemaRoot rotateRight, xrefs: 00007FF775F31886

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type SHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:::ffff:answersos/execruntime2.5.4.62.5.4.32.5.4.52.5.4.72$ MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from gzip, deflateGetTempPath2WModule32NextW$pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuewirep: already in goselectgo: bad wakeupsemaRoot rotateRight
API String ID: 0-993857517
Opcode ID: 215edbf313a6bf950c97d45009199267261b342e1997cb594dfe546982cef081
Instruction ID: 4f9cdb3913d5e84e07dce254e92cfa644311539253b705fe4a1901b1d9143eec
Opcode Fuzzy Hash: 215edbf313a6bf950c97d45009199267261b342e1997cb594dfe546982cef081
Instruction Fuzzy Hash: 3F81A13393CF9585E641FB25D8406BAE765FF8AB80F848631E98D1766ACF2CE441C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F59480 Relevance: 3.6, Strings: 2, Instructions: 1095COMMON

Download Yara Rule

Strings

selectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong Ptrace: out of memoryheader line too longGetAdaptersAddressesGetProcessMemoryInfonumber has no digitsx509usefallbackrootsgetCert can't be nilinvalid UTF-8 stringx509: malformed spki, xrefs: 00007FF775F5A0DB
gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff SystemFunction036RegLoadMUIStringW%%!%c(big.Int=%s)invalid BMPStringinvalid IA5Stringinteger too large060102150405Z0700CelestialCodes.exebufio: buffer fullref, xrefs: 00007FF775F5A105

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: gp.waiting != nilunknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff SystemFunction036RegLoadMUIStringW%%!%c(big.Int=%s)invalid BMPStringinvalid IA5Stringinteger too large060102150405Z0700CelestialCodes.exebufio: buffer fullref$selectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong Ptrace: out of memoryheader line too longGetAdaptersAddressesGetProcessMemoryInfonumber has no digitsx509usefallbackrootsgetCert can't be nilinvalid UTF-8 stringx509: malformed spki
API String ID: 0-554060132
Opcode ID: 725a3d3a6519a3224e8ae24bbc57bcbc24ed389ddafd4fa98d18ee223ff4febc
Instruction ID: d11869a8c7799c86051c896e5cf524c1a160c921dac55d4cbd632ba7a3c82549
Opcode Fuzzy Hash: 725a3d3a6519a3224e8ae24bbc57bcbc24ed389ddafd4fa98d18ee223ff4febc
Instruction Fuzzy Hash: 85C28A33639BC182E660AF12E8447AAB7A4FB48F80F958536DE9D43799CF78D950C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F80DE0 Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

reflectlite.Value.IsNil23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodCLIENT_TRAFFIC_SECRET_0SERVER_TRAFFIC_SECRET_0QUICEncryptionLevel(%v)unsupported certificateno application protocolmissing protocol schemeinvalid URI for requestunexpec, xrefs: 00007FF775F812CD
reflectlite.Value.Type4656612873077392578125unexpected method stepreflect.Value.MapIndex to array with length ECDSAWithP256AndSHA256ECDSAWithP384AndSHA384ECDSAWithP521AndSHA512error decoding messageinappropriate fallback.localhost.localdomainmissing ']' in add, xrefs: 00007FF775F81303

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: reflectlite.Value.IsNil23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodCLIENT_TRAFFIC_SECRET_0SERVER_TRAFFIC_SECRET_0QUICEncryptionLevel(%v)unsupported certificateno application protocolmissing protocol schemeinvalid URI for requestunexpec$reflectlite.Value.Type4656612873077392578125unexpected method stepreflect.Value.MapIndex to array with length ECDSAWithP256AndSHA256ECDSAWithP384AndSHA384ECDSAWithP521AndSHA512error decoding messageinappropriate fallback.localhost.localdomainmissing ']' in add
API String ID: 0-4227794735
Opcode ID: 87ec6d1f379dc02e1474aaeb05dd4a91c37857505d08e003cc62b9b6cd0cc9d8
Instruction ID: 66e059c9273f0c5ebb346fad44bb4b9b86828332086d4d2acd81a5e19d35f357
Opcode Fuzzy Hash: 87ec6d1f379dc02e1474aaeb05dd4a91c37857505d08e003cc62b9b6cd0cc9d8
Instruction Fuzzy Hash: FBE12C23A3CB8281EA60EB15F8407BAE3A4FB85B80F845535DA8D53759DF3CE455C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F421C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

runtime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does , xrefs: 00007FF775F423A6
runtime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime:, xrefs: 00007FF775F4233D

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: runtime: inconsistent read deadlinefindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=hpack: invalid Huffman-encoded datadynamic table size update too largefile type does $runtime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime:
API String ID: 0-3482143090
Opcode ID: 7f9658dd036715d155a95de38a340029dffab4eb55e2205875936dedfcd00157
Instruction ID: 73c576e675e3e28e1f7d18765366103158b3bec0e0852fd3baf3ffa38941c545
Opcode Fuzzy Hash: 7f9658dd036715d155a95de38a340029dffab4eb55e2205875936dedfcd00157
Instruction Fuzzy Hash: 1E51D723A3D7C686EA64AB15A44073EEAA0EB85F90F944539EA9E437D5CF3DD4408720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F5C9E0 Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00007FF775F5CABA, 00007FF775F5CB9A, 00007FF775F5CCB0, 00007FF775F5CDCC

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
API String ID: 0-2911004680
Opcode ID: a1e4b5ed7459d7769ad0cf5cd2541a7c7816e00e127db1d888db172f32c8805e
Instruction ID: ae4e5c2214c7d217e0a7a12dd803faf1dc4a2d6769646520b138e7d25dc749a2
Opcode Fuzzy Hash: a1e4b5ed7459d7769ad0cf5cd2541a7c7816e00e127db1d888db172f32c8805e
Instruction Fuzzy Hash: 45F19C63B39AC681EA50AB55E8043B9E665FB44FD0FC80432EA5E43799CF6CE641C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F674A0 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

invalid length of trace eventruntime: traceback stuck. pc=runtime: impossible type kindruntime.semasleep wait_failedGetVolumeInformationByHandleWcrypto/aes: invalid key size crypto/des: invalid key size crypto/rc4: invalid key size x509: unsupported time forma, xrefs: 00007FF775F67764

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: invalid length of trace eventruntime: traceback stuck. pc=runtime: impossible type kindruntime.semasleep wait_failedGetVolumeInformationByHandleWcrypto/aes: invalid key size crypto/des: invalid key size crypto/rc4: invalid key size x509: unsupported time forma
API String ID: 0-815402860
Opcode ID: d3432b52083acb9b9d0e8f3bca217cab7776fd939ada52c3c48619fa075d97dd
Instruction ID: 87f2a264a12987d9dabf80fff940462bbe2fec8aa25457e89913b7afb36bbf3a
Opcode Fuzzy Hash: d3432b52083acb9b9d0e8f3bca217cab7776fd939ada52c3c48619fa075d97dd
Instruction Fuzzy Hash: 97D1D863A3EACA82EA54AB15D4003BAB761F745F84FA44235EA4E03BD5CF2CD451CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F3E440 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

bad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:inva, xrefs: 00007FF775F3E707

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: bad summary dataruntime: addr = runtime: base = runtime: head = already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:inva
API String ID: 0-3699108350
Opcode ID: 0e724042f1ade8e1945a8bafde0c706eab917e44d7abe424dba7265bd2f34370
Instruction ID: c515d2260c2cf36258819276c44d89830fa525bb63bc628bada5c01bc1ffcd6f
Opcode Fuzzy Hash: 0e724042f1ade8e1945a8bafde0c706eab917e44d7abe424dba7265bd2f34370
Instruction Fuzzy Hash: A471C2B7A38BC582EA40AB15E4403A9A765FB49FD0F845236EF9D1378ACE3CE445C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F99380 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67, xrefs: 00007FF775F994BB

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67
API String ID: 0-3300367623
Opcode ID: ee4c63e475626b83de3cf1fc271b516ba106ce23b9766ce50fc09f1396b3406d
Instruction ID: 343e2ba24bc56acdeac6988a9245627bf06522ea6590cb3b3ae19ead926c6a99
Opcode Fuzzy Hash: ee4c63e475626b83de3cf1fc271b516ba106ce23b9766ce50fc09f1396b3406d
Instruction Fuzzy Hash: 65514563B3C9D242EB29AB19960167CE28DAB84F90FD68135C90E877C5CF2DE841C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F2B4C0 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5C, xrefs: 00007FF775F2B648

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:bad nsse41sse42ssse3SHA-1P-224P-256P-384P-521ECDSAGreek (at ClassStringFormat[]bytestringBasic CookieacceptcookieexpectoriginserverclosedExpectstatusPragmasocks Lockedactivesocks5C
API String ID: 0-3266934206
Opcode ID: 6ec9d1a701b784f9699547681ce9a64c7e97a45e1cce1475467bd41f3cd5906d
Instruction ID: 6a1025a52a297defdc3f9d71a0d4a94f17a76bb42c6642f08a3eb600bc05bde0
Opcode Fuzzy Hash: 6ec9d1a701b784f9699547681ce9a64c7e97a45e1cce1475467bd41f3cd5906d
Instruction Fuzzy Hash: 92716333A3DA4285EB44FB22E8852BAA7A0FF49B40FC18136D94D47395DE3DE944C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F31420 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not , xrefs: 00007FF775F31507

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID: gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not
API String ID: 0-3110597650
Opcode ID: bbc32f2959b87941c53b4df3a590af4d951a50a148aee1651a1a49c6b1f02b3c
Instruction ID: 2e19817f7016d11c73f2f50f440013529f2fdb15afca57a4397b65f77b391f71
Opcode Fuzzy Hash: bbc32f2959b87941c53b4df3a590af4d951a50a148aee1651a1a49c6b1f02b3c
Instruction Fuzzy Hash: DD21C2A3B25AC946EF05AF15C4403F8AB65E756FC8F899076CE0D07B96CE2CD554C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F7EFC0 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339bc034b6991c3a25f8422800448db2eb7af5214e01a553cafb018bf9c7913f
Instruction ID: 3c07275f8ea5cde53714f5b0378765e4ace7ab74aca44811c038e7e0b88b42e7
Opcode Fuzzy Hash: 339bc034b6991c3a25f8422800448db2eb7af5214e01a553cafb018bf9c7913f
Instruction Fuzzy Hash: EF32B223E3C6D182EBA0AB19D40027DA791EB45FD0FD45872FA4D17799DE6CE882D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F98B60 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbecaeedc5629b5ff5b2e392d1e5d3e109847af1a087be23edb2d0449953d0df
Instruction ID: 5e821a605baad61fbc5212c6b26f6981901efad780619327c61bf3c582db841b
Opcode Fuzzy Hash: bbecaeedc5629b5ff5b2e392d1e5d3e109847af1a087be23edb2d0449953d0df
Instruction Fuzzy Hash: 4DD1E363F3CAD582EA60AB16A4016BAE665FB85FC4F844031EE4E87B59CF2CD945C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F25F60 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c4c12a12138e84b996b6207b1f0ac2c4a6e7940965e9e7061c635f7ad818ff
Instruction ID: e9fc1a16e91a0083dfcc89eebc818a1220024cef16da9a4d00538326aaafd15e
Opcode Fuzzy Hash: 22c4c12a12138e84b996b6207b1f0ac2c4a6e7940965e9e7061c635f7ad818ff
Instruction Fuzzy Hash: F3D151A2B29BC481D660DB56A8407AEE761F789FD0F848136EE8D57B99CF3CD450CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F71E20 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5026248b10003446996eb36432e0e130507aacc5bfb64b71f910afc2b386e4
Instruction ID: 527dde202090eb3e988be1c092228c4241b3d3e14f237286cf2d7c4a24845b10
Opcode Fuzzy Hash: 4c5026248b10003446996eb36432e0e130507aacc5bfb64b71f910afc2b386e4
Instruction Fuzzy Hash: 4BF15F33A28BC581EAA0AB15E8403BEA7A5FB85F80FD58535EA8D47795CF3DD484C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F7E880 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdb7e4ea6da8f73ae1eec21f4fb049acb096dd70b966ade15acf0e0eb44a4d8
Instruction ID: 725771a90a607154030933ca30cc978905c1074536ad51fdff54c6f10583c386
Opcode Fuzzy Hash: 9fdb7e4ea6da8f73ae1eec21f4fb049acb096dd70b966ade15acf0e0eb44a4d8
Instruction Fuzzy Hash: 65E14C33A39AC585EA60AB25E44036AF765FB85F80FD44836EB8D07B99DF3CD4458B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F74B49 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d278a68979bdb4e2e12c457c456d8457c7900f727f69271caa071a0e33b01651
Instruction ID: 8440095ea7ac4f616cd20b7af977aa87c39cf877eb3731575504616449ff8833
Opcode Fuzzy Hash: d278a68979bdb4e2e12c457c456d8457c7900f727f69271caa071a0e33b01651
Instruction Fuzzy Hash: CBB13F16D2CFCB50E613677D9403A7667106EF3AC4B41D73ABAC6F16A3DB162A00B532

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F50AC0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc85461f6cdb9452b27dab7e61e7b32e3e14609444ef3c9bd6b40ec0fa363441
Instruction ID: 5c4e07469b7e7864b4a5a3bdfc64d09de86f6e3c2e47bc0ec59ef5fdc267b67b
Opcode Fuzzy Hash: dc85461f6cdb9452b27dab7e61e7b32e3e14609444ef3c9bd6b40ec0fa363441
Instruction Fuzzy Hash: 5C91F673B3D6C286D764AB26A410A7AE7A5FB85FC0F984035EE4D07B49DE3CE5408B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F3BBA0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cce94ff9d5bcab866fd367d605385e77d3c61c1a8f7f6c173ad607559e20a6
Instruction ID: 1a25eb159fcea21ffcb55c82f4d3bd217b39b4bcbf6f171a508c777a27405420
Opcode Fuzzy Hash: 85cce94ff9d5bcab866fd367d605385e77d3c61c1a8f7f6c173ad607559e20a6
Instruction Fuzzy Hash: 80A15F77A28BC582EB109B15E0802AAB765F789BD4F941236EB9D53B99CF3CD450CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F3D020 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f3ac7197d4e9825d5509f6ad159fb9ac576d64d30bfd62f49be3ad38db0dc0
Instruction ID: f7c16632063d851736f520bd850fe01954404b79b42c9d9378a4a6fd5523ec44
Opcode Fuzzy Hash: e9f3ac7197d4e9825d5509f6ad159fb9ac576d64d30bfd62f49be3ad38db0dc0
Instruction Fuzzy Hash: E3916E73A28BC582EA509B11E4403AAA762FB85FC0F855136EF9D57B9ACF3CD450C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F2ECE0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d7459e759ce90b26b23ba6940f4c3405e2c2fc028d5d641444bb7443fc93f9
Instruction ID: 1525d0b1fb654e0eb8fa98e26571bbda06b0d6d2b6e97f786eb9718c13bb8d21
Opcode Fuzzy Hash: 13d7459e759ce90b26b23ba6940f4c3405e2c2fc028d5d641444bb7443fc93f9
Instruction Fuzzy Hash: 2771E57393CBC182EB41AB25A4413BEA7A1EB56FD0F949235EA5D137C5CF3CE4908620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F1AC40 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88dcf394d6e4962d838399384e7b09d05d77da2f7414c0e09023e5cb6bbd5b17
Instruction ID: cb1d19a1c7b7197395315f5353ae169b3354bbf561ae8d3d32c7ad9a378921d8
Opcode Fuzzy Hash: 88dcf394d6e4962d838399384e7b09d05d77da2f7414c0e09023e5cb6bbd5b17
Instruction Fuzzy Hash: 5A510A96B26E9641EE049B53952007AF361EB4AFD0798E633CE1D7779CDE3CE4028394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F61620 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab0759d33f9c954d454e4eef0761b1b7635eb5f0ccd5bceae82a4de668522ad
Instruction ID: 98b9772c210ab9aa49f2d32e8cbdbbeb739d85c7bacbc00c77fe4d2327df82bb
Opcode Fuzzy Hash: eab0759d33f9c954d454e4eef0761b1b7635eb5f0ccd5bceae82a4de668522ad
Instruction Fuzzy Hash: 9341E633FB8D864AEB10AB3494417B69285DB41B38FCC4B74CF2D472C2EE2DA49595A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F8FB60 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e857e89081123d735b674d3dc7fa2c294a5f02fb70759e9d4ae2afd38b24713a
Instruction ID: df6d64b1921b8f044072cc8afec3e8f9cca1b9ac90d1b348665e3de2ca731438
Opcode Fuzzy Hash: e857e89081123d735b674d3dc7fa2c294a5f02fb70759e9d4ae2afd38b24713a
Instruction Fuzzy Hash: 9751F733A2CBC185D760AB16B84036AE7A5F799BC0F944035EA8D53B59DF3CE455CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F32E00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185c93eb15ac379675bb3d1c424d0a35d84cceed86a6710c9908a0c6410d92e2
Instruction ID: a075aa176cbe93ad9301a42ed2d80aa2461b4ee19bdd0c55387f07d654b96750
Opcode Fuzzy Hash: 185c93eb15ac379675bb3d1c424d0a35d84cceed86a6710c9908a0c6410d92e2
Instruction Fuzzy Hash: 3741C4A3E3FE8649ED07A73A5C51035D2065F92FE0794C731D82F661D9AF1EA5828220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F1E8C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb6a6f1c5147f831e0757ed6f0464a371103e568fa0f5e38dfee2e98994634b
Instruction ID: 6ecab95f1ddecb42079c77dfda1c6f0d6754469a83b6ce0d710334322c418877
Opcode Fuzzy Hash: 6fb6a6f1c5147f831e0757ed6f0464a371103e568fa0f5e38dfee2e98994634b
Instruction Fuzzy Hash: F321DAA2E35F450ADA8397395451322C50B5F96BE0F68D332ED1F76796EF28A0D34110

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4C5E0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdca11814e257034a430d2534bbfcab2f1c991e43e961595fbd7c1472380c71
Instruction ID: 231f33136b04552228f15163897644f477c94eefde35fe52a758997e51077394
Opcode Fuzzy Hash: 5bdca11814e257034a430d2534bbfcab2f1c991e43e961595fbd7c1472380c71
Instruction Fuzzy Hash: 5C219037A28F8581DA00EB21E94117AB760FB4AF80F549632EE9C43755DF3CE191C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4C6C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038bd6f38d43a72ad2e9c479e94437e856e042b72c2d015bd7b5c9efb54f6037
Instruction ID: 412b61b7737f20f9259258af178e918297f232fa86e09774ea7deebbe1fdbd10
Opcode Fuzzy Hash: 038bd6f38d43a72ad2e9c479e94437e856e042b72c2d015bd7b5c9efb54f6037
Instruction Fuzzy Hash: 7D214F27A28F85C2DA00EB26E84117AA760FB4AF80F559631EE9C43765DF3CE191C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4C420 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbc1c96bbdd468078cc8444a61829702d01217f533c6742d30432a3f07eeca7
Instruction ID: 0c34700612d1e97924b97893dbb00dc80957a97145fc12952d92e1d138375211
Opcode Fuzzy Hash: dbbc1c96bbdd468078cc8444a61829702d01217f533c6742d30432a3f07eeca7
Instruction Fuzzy Hash: 72215E37A28F8681DA00EB25E94117AB760FB4AF80F559231EE9C43765DF3DE191C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F4C500 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa42d5b09dd5189d8701183dffaf4957a011b33b993325264e23e112f9fb1b6
Instruction ID: d54788f18bf7eb04dbf24a27811719ed343ece400e7550aab81711e909e94407
Opcode Fuzzy Hash: aaa42d5b09dd5189d8701183dffaf4957a011b33b993325264e23e112f9fb1b6
Instruction Fuzzy Hash: E3216037A28F8581DA00EB26E84517AB760FB4AF80F559632EE9C43759DF3CE191C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F795C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35503efc0b02d980c7fbe89dfde5c9b61a028bf9620ba1989b3b47437324878a
Instruction ID: 23f1c8b69dccd3a632da22023992624d26bc7a25aca07e2c2a170ab3d76899f6
Opcode Fuzzy Hash: 35503efc0b02d980c7fbe89dfde5c9b61a028bf9620ba1989b3b47437324878a
Instruction Fuzzy Hash: ADE0E636714E44C4D6205B2AE8413967324E744BB4F590321EFBC077E4CE3CD2628F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF775F77880 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74fc2f2e351b5f421c99f3de7163aa5de10e749f766cc8a66bdb76c638101e7
Instruction ID: 1d83c73a01f60034fd7d56936c9c9c941327a28a657471666031b07de5c9b19e
Opcode Fuzzy Hash: b74fc2f2e351b5f421c99f3de7163aa5de10e749f766cc8a66bdb76c638101e7
Instruction Fuzzy Hash: 2AC080E2D3FBC314FB24A304A900335EAC54F85780ED080B0E14C0115C9D6C76408124

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77616EB30 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF77616EC49

Strings

Address %p has no image-section, xrefs: 00007FF77616EBA0, 00007FF77616ECF5
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF77616ECE1
Mingw-w64 runtime failure:, xrefs: 00007FF77616EB68
VirtualProtect failed with code 0x%x, xrefs: 00007FF77616ECBE

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: bd0f74a64fe43e332ce818d5a916ad1fcb08f3da001a19d72ebb284a4c4e8fb9
Instruction ID: d83fdedbbb09b6b9268b5e54a3ac3d55e5c3aa4b18cec6eea76bf9a1331db8e6
Opcode Fuzzy Hash: bd0f74a64fe43e332ce818d5a916ad1fcb08f3da001a19d72ebb284a4c4e8fb9
Instruction Fuzzy Hash: 2351B067B3874685EE10AB51FC45ABBA760BB45B98F848134DE0D07358EE3CE545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77616ED10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF776490B00,00007FFEFE3AADA0,?,?,?,00000001,00007FF775F11261), ref: 00007FF77616EEB5

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF77616EF75
Unknown pseudo relocation protocol version %d., xrefs: 00007FF77616EF81

Memory Dump Source

Source File: 00000000.00000002.1274885397.00007FF775F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF775F10000, based on PE: true

Associated: 00000000.00000002.1274865359.00007FF775F10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275126150.00007FF77617A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275147767.00007FF77617E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275173158.00007FF7761A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275190336.00007FF7761A7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275207578.00007FF7761A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275223972.00007FF7761A9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275241129.00007FF7761AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275257490.00007FF7761AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF77645B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776462000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1275511205.00007FF776489000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276049563.00007FF776492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776493000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276075284.00007FF776496000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1276120553.00007FF776497000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff775f10000_PuTTy.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: aa1ca11ce625c7ac9b7be97da47ca7e9bf56b908fe6f156aa260d9eb04243716
Instruction ID: ad5d86b31b971e1acaff4125e04d2b6e631d15a4c31e13592aa989554af68a37
Opcode Fuzzy Hash: aa1ca11ce625c7ac9b7be97da47ca7e9bf56b908fe6f156aa260d9eb04243716
Instruction Fuzzy Hash: A661AD6BB3C64286EE10AF11BC4857BE761BB95B98F94C331DA5D0739CEE3DE5408220

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PuTTy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
PuTTy.exe

Function 00007FF775F42E80 Relevance: 45.3, Strings: 36, Instructions: 274
COMMON

Function 00007FF775F1D220 Relevance: 12.9, Strings: 10, Instructions: 386
COMMON

Function 00007FF775F45A20 Relevance: 4.0, Strings: 3, Instructions: 268
COMMON