Edit tour

Windows Analysis Report
SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Overview

General Information

Sample name:	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Analysis ID:	1446957
MD5:	2d49a6ce2ee81dc16d23b3a820ee87e0
SHA1:	d0b2dab654a86a302c1a051c950b76c15ece69b1
SHA256:	b50cf4ce1fbaa5ba67035c538d49b8a39f1c1f976bfde8ee1f4ee040c6d42591
Tags:	exe
Infos:

Detection

RMSRemoteAdmin

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected RMS RemoteAdmin tool

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe" MD5: 2D49A6CE2EE81DC16D23B3A820EE87E0)

rfusclient.exe (PID: 5496 cmdline: "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" -run_agent MD5: 43CC976800C506662C325478EB8BF9EA)

rutserv.exe (PID: 4412 cmdline: "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent MD5: 6C6BA57BE4B7B2FB661A99FEA872F6B8)

rutserv.exe (PID: 5084 cmdline: "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent -second MD5: 6C6BA57BE4B7B2FB661A99FEA872F6B8)

rfusclient.exe (PID: 2212 cmdline: "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" /tray /user MD5: 43CC976800C506662C325478EB8BF9EA)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x4608d0:$s1: rman_message 0x4611a0:$s3: rms_host_ 0x461b3c:$s3: rms_host_ 0x5cf4a0:$s4: rman_av_capture_settings 0x3eba10:$s7: _rms_log.txt 0x4b5860:$s8: rms_internet_id_settings
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x47e140:$s1: rman_message 0x47ea1c:$s3: rms_host_ 0x47f3c0:$s3: rms_host_ 0x5e6b80:$s4: rman_av_capture_settings 0x663110:$s5: rman_registry_key 0x66315c:$s5: rman_registry_key 0x52d148:$s6: rms_system_information 0x314e38:$s7: _rms_log.txt 0x4e9798:$s8: rms_internet_id_settings

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.1961729968.000000000168F000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000000.00000003.1810927214.000000007AC45000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000002.00000000.1854271083.0000000000EF3000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000003.00000000.1961729968.00000000015F0000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000000.00000002.1870500876.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Remotemanipulator_9ec52153	unknown	unknown	0x293bac:$a1: killself.bat 0x293bd4:$a1: killself.bat 0x291cc8:$a2: rutserv.exe 0x59d984:$a2: rutserv.exe 0x291cec:$a3: rfusclient.exe 0x59d958:$a3: rfusclient.exe 0x2922a8:$a4: install.log 0x59d9c0:$a5: Unable to create Agent's path.
Process Memory Space: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe PID: 6956	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rfusclient.exe PID: 5496	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: rutserv.exe PID: 4412	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.rfusclient.exe.400000.0.unpack	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
2.0.rfusclient.exe.400000.0.unpack	MALWARE_Win_RemoteUtilitiesRAT	RemoteUtilitiesRAT RAT payload	ditekSHen	0x4608d0:$s1: rman_message 0x4611a0:$s3: rms_host_ 0x461b3c:$s3: rms_host_ 0x5cf4a0:$s4: rman_av_capture_settings 0x3eba10:$s7: _rms_log.txt 0x4b5860:$s8: rms_internet_id_settings

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Virustotal: Detection: 12%			Perma Link
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	ReversingLabs: Detection: 21%
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Virustotal: Detection: 18%			Perma Link

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002690 CRYPTO_free,	3_2_11002690
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11017100 DES_ecb_encrypt,DES_encrypt1,	3_2_11017100
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107F110 ASN1_item_sign_ctx,X509_NAME_ENTRY_get_object,UI_get0_user_data,EVP_MD_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,ERR_put_error,pqueue_peek,OBJ_find_sigid_by_algs,OBJ_nid2obj,X509_ALGOR_set0,OBJ_nid2obj,X509_ALGOR_set0,ASN1_item_i2d,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_1107F110
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097120 CRYPTO_malloc,	3_2_11097120
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A1130 X509_VERIFY_PARAM_set1_name,CRYPTO_free,BUF_strdup,	3_2_110A1130
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B1130 CMS_add_smimecap,i2d_X509_ALGORS,CMS_signed_add1_attr_by_NID,CRYPTO_free,	3_2_110B1130
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11019150 DES_ofb_encrypt,DES_encrypt1,	3_2_11019150
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106D150 OBJ_NAME_do_all_sorted,lh_num_items,CRYPTO_malloc,lh_doall_arg,CRYPTO_free,	3_2_1106D150
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7150 TXT_DB_read,BUF_MEM_new,BUF_MEM_grow,CRYPTO_malloc,sk_new_null,CRYPTO_malloc,CRYPTO_malloc,BUF_MEM_grow_clean,BIO_gets,CRYPTO_malloc,sk_push,_fprintf,CRYPTO_free,_fprintf,CRYPTO_free,BUF_MEM_free,_fprintf,sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_110B7150
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F170 idea_cbc_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,idea_encrypt,	3_2_1101F170
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11037170 BN_clear_free,CRYPTO_free,	3_2_11037170
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11069180 lh_delete,CRYPTO_free,	3_2_11069180
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110311A0 CRYPTO_gcm128_encrypt,	3_2_110311A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110171B0 DES_cbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1,DES_encrypt1,	3_2_110171B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110031E0 CRYPTO_dbg_realloc,CRYPTO_dbg_malloc,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,lh_insert,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	3_2_110031E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106B1F0 ERR_get_implementation,CRYPTO_lock,CRYPTO_lock,	3_2_1106B1F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11057010 EC_POINT_point2hex,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	3_2_11057010
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF010 ENGINE_get_next,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ENGINE_free,	3_2_110BF010
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105F020 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,	3_2_1105F020
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11069020 lh_new,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,	3_2_11069020
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A1020 X509_VERIFY_PARAM_new,CRYPTO_malloc,_memset,CRYPTO_malloc,CRYPTO_free,	3_2_110A1020
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D104E sk_value,sk_num,sk_insert,CRYPTO_free,BN_free,CRYPTO_free,	3_2_110D104E
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104F040 DH_up_ref,CRYPTO_add_lock,	3_2_1104F040
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11081050 X509_PUBKEY_get,CRYPTO_add_lock,EVP_PKEY_new,OBJ_obj2nid,EVP_PKEY_set_type,CRYPTO_lock,CRYPTO_lock,EVP_PKEY_free,CRYPTO_lock,CRYPTO_add_lock,ERR_put_error,EVP_PKEY_free,	3_2_11081050
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7050 CONF_modules_load_file,NCONF_new,CONF_get1_default_config_file,NCONF_load,ERR_peek_last_error,ERR_clear_error,CONF_modules_load,CRYPTO_free,NCONF_free,	3_2_110B7050
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11037060 bn_dup_expand,BN_new,CRYPTO_free,BN_new,BN_copy,BN_free,	3_2_11037060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104F070 DH_get_ex_new_index,CRYPTO_get_ex_new_index,	3_2_1104F070
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023080 CAST_ofb64_encrypt,CAST_encrypt,	3_2_11023080
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF080 ENGINE_get_prev,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ENGINE_free,	3_2_110BF080
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104B090 DSA_SIG_new,CRYPTO_malloc,	3_2_1104B090
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A1090 X509_VERIFY_PARAM_free,CRYPTO_free,CRYPTO_free,	3_2_110A1090
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A5090 a2i_IPADDRESS_NC,BUF_strdup,a2i_ipadd,a2i_ipadd,CRYPTO_free,ASN1_OCTET_STRING_new,ASN1_OCTET_STRING_set,CRYPTO_free,ASN1_OCTET_STRING_free,	3_2_110A5090
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A90A0 X509_PURPOSE_add,CRYPTO_malloc,sk_value,CRYPTO_free,CRYPTO_free,BUF_strdup,BUF_strdup,sk_new,sk_push,ERR_put_error,	3_2_110A90A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110310B0 CRYPTO_gcm128_aad,	3_2_110310B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104B0C0 DSA_SIG_free,BN_free,BN_free,CRYPTO_free,	3_2_1104B0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108B0C0 EVP_CIPHER_CTX_init,EVP_md5,EVP_Digest,EVP_md5,EVP_rc4,EVP_BytesToKey,OPENSSL_cleanse,EVP_rc4,EVP_DecryptInit_ex,EVP_DecryptUpdate,EVP_DecryptFinal_ex,d2i_RSAPrivateKey,ERR_put_error,EVP_CIPHER_CTX_cleanup,ASN1_item_free,	3_2_1108B0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A10C0 BUF_strdup,BUF_memdup,CRYPTO_free,	3_2_110A10C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BD0C0 PKCS12_key_gen_uni,EVP_MD_CTX_init,EVP_MD_block_size,EVP_MD_size,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,BN_new,BN_new,_memset,EVP_DigestInit_ex,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BN_free,BN_free,EVP_MD_CTX_cleanup,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal_ex,BN_bin2bn,BN_add_word,BN_bin2bn,BN_add,BN_bn2bin,BN_num_bits,BN_bn2bin,_memset,BN_bn2bin,BN_bn2bin,EVP_DigestInit_ex,	3_2_110BD0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105F0D0 ECDH_get_ex_new_index,CRYPTO_get_ex_new_index,	3_2_1105F0D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110370E0 CRYPTO_malloc,CRYPTO_free,	3_2_110370E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110030F0 CRYPTO_dbg_free,CRYPTO_is_mem_check_on,CRYPTO_mem_ctrl,lh_delete,CRYPTO_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	3_2_110030F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104D0F0 DSO_up_ref,ERR_put_error,CRYPTO_add_lock,	3_2_1104D0F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110690F0 lh_insert,CRYPTO_malloc,	3_2_110690F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A30F0 X509V3_EXT_print,X509V3_EXT_get,ASN1_item_d2i,BIO_printf,X509V3_EXT_val_prn,X509V3_conf_free,sk_pop_free,CRYPTO_free,ASN1_item_free,	3_2_110A30F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF0F0 ENGINE_remove,ERR_put_error,CRYPTO_lock,ERR_put_error,CRYPTO_lock,	3_2_110BF0F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11049300 RSA_private_decrypt,	3_2_11049300
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023310 AES_cfb1_encrypt,AES_encrypt,CRYPTO_cfb128_1_encrypt,	3_2_11023310
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11049310 RSA_public_decrypt,	3_2_11049310
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11095310 PEM_ASN1_read_bio,PEM_bytes_read_bio,ERR_put_error,CRYPTO_free,	3_2_11095310
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11037320 BN_CTX_new,CRYPTO_malloc,ERR_put_error,	3_2_11037320
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104D340 DSO_set_filename,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,CRYPTO_free,ERR_put_error,	3_2_1104D340
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023350 AES_cfb8_encrypt,AES_encrypt,CRYPTO_cfb128_8_encrypt,	3_2_11023350
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106D350 OBJ_NAME_init,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,	3_2_1106D350
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B3350 CRYPTO_malloc,OBJ_nid2obj,	3_2_110B3350
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097370 EVP_CIPHER_CTX_init,PEM_def_callback,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_rc4,EVP_DecryptInit_ex,EVP_DecryptUpdate,EVP_DecryptFinal_ex,EVP_rc4,EVP_DecryptInit_ex,OPENSSL_cleanse,EVP_DecryptUpdate,EVP_DecryptFinal_ex,ERR_put_error,OPENSSL_cleanse,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	3_2_11097370
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11037380 BN_CTX_free,CRYPTO_free,CRYPTO_free,	3_2_11037380
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023390 AES_ofb128_encrypt,AES_encrypt,CRYPTO_ofb128_encrypt,	3_2_11023390
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110993A0 NETSCAPE_SPKI_b64_encode,i2d_NETSCAPE_SPKI,CRYPTO_malloc,CRYPTO_malloc,i2d_NETSCAPE_SPKI,EVP_EncodeBlock,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error,	3_2_110993A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110953B0 d2i_PKCS8PrivateKey_bio,d2i_PKCS8_bio,PEM_def_callback,ERR_put_error,X509_SIG_free,PKCS8_decrypt,X509_SIG_free,EVP_PKCS82PKEY,PKCS8_PRIV_KEY_INFO_free,EVP_PKEY_free,	3_2_110953B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F3C0 SEED_ecb_encrypt,SEED_encrypt,SEED_decrypt,	3_2_1102F3C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110233C0 AES_ctr128_encrypt,AES_encrypt,CRYPTO_ctr128_encrypt,	3_2_110233C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B33C0 CMS_EncryptedData_set1_key,ASN1_item_new,ERR_put_error,OBJ_nid2obj,OBJ_obj2nid,ERR_put_error,ERR_put_error,	3_2_110B33C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF3E0 ENGINE_up_ref,ERR_put_error,CRYPTO_add_lock,	3_2_110BF3E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F3F0 SEED_cbc_encrypt,	3_2_1102F3F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110853F0 X509_CRL_print,BIO_printf,ASN1_INTEGER_get,BIO_printf,OBJ_obj2nid,X509_signature_print,X509_NAME_oneline,BIO_printf,CRYPTO_free,BIO_printf,ASN1_TIME_print,BIO_printf,ASN1_TIME_print,BIO_printf,BIO_printf,X509V3_extensions_print,sk_num,BIO_printf,sk_num,sk_value,BIO_printf,i2a_ASN1_INTEGER,BIO_printf,ASN1_TIME_print,BIO_printf,X509V3_extensions_print,sk_num,X509_signature_print,	3_2_110853F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11025200 AES_encrypt,	3_2_11025200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF200 ENGINE_by_id,ERR_put_error,CRYPTO_lock,ENGINE_new,CRYPTO_lock,_getenv,ENGINE_by_id,ENGINE_ctrl_cmd_string,ENGINE_ctrl_cmd_string,ENGINE_ctrl_cmd_string,ENGINE_ctrl_cmd_string,ENGINE_ctrl_cmd_string,ENGINE_free,ERR_put_error,ERR_add_error_data,	3_2_110BF200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11037210 CRYPTO_malloc,BN_init,	3_2_11037210
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11035210 BN_mod_exp_mont_consttime,BN_num_bits,BN_set_word,BN_set_word,BN_CTX_start,BN_MONT_CTX_new,BN_MONT_CTX_set,CRYPTO_malloc,_memset,BN_value_one,BN_mod_mul_montgomery,BN_ucmp,BN_mod_mul_montgomery,BN_div,BN_mod_mul_montgomery,BN_mod_mul_montgomery,BN_mod_mul_montgomery,BN_is_bit_set,BN_mod_mul_montgomery,BN_is_bit_set,BN_mod_mul_montgomery,BN_from_montgomery,BN_MONT_CTX_free,OPENSSL_cleanse,CRYPTO_free,BN_CTX_end,ERR_put_error,	3_2_11035210
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F230 EVP_MD_CTX_create,CRYPTO_malloc,	3_2_1106F230
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106B240 ERR_set_implementation,CRYPTO_lock,CRYPTO_lock,	3_2_1106B240
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11027250 private_AES_set_encrypt_key,	3_2_11027250
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11027260 private_AES_set_decrypt_key,	3_2_11027260
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F260 EVP_DigestInit_ex,EVP_MD_CTX_clear_flags,ENGINE_finish,ENGINE_init,ERR_put_error,ENGINE_get_digest_engine,ENGINE_get_digest,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,	3_2_1106F260
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A9270 X509_PURPOSE_cleanup,sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_110A9270
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091290 PKCS5_pbkdf2_set,ASN1_item_new,ASN1_STRING_type_new,CRYPTO_malloc,RAND_bytes,ASN1_INTEGER_set,ASN1_STRING_type_new,ASN1_INTEGER_set,X509_ALGOR_new,OBJ_nid2obj,X509_ALGOR_set0,X509_ALGOR_new,OBJ_nid2obj,ASN1_TYPE_new,ASN1_item_pack,ERR_put_error,ASN1_item_free,X509_ALGOR_free,PBKDF2PARAM_free,	3_2_11091290
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110232A0 AES_ecb_encrypt,AES_encrypt,AES_decrypt,	3_2_110232A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107D2A0 c2i_ASN1_INTEGER,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	3_2_1107D2A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110232D0 AES_cfb128_encrypt,AES_encrypt,CRYPTO_cfb128_encrypt,	3_2_110232D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110972D0 BIO_write,CRYPTO_free,	3_2_110972D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110452E0 RSA_padding_add_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,ERR_put_error,EVP_Digest,_memset,RAND_bytes,CRYPTO_malloc,PKCS1_MGF1,PKCS1_MGF1,CRYPTO_free,CRYPTO_free,	3_2_110452E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110492E0 RSA_public_encrypt,	3_2_110492E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110032F0 __localtime64,BIO_snprintf,BIO_snprintf,X509_TRUST_get_flags,BIO_snprintf,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cpy,_memset,X509_TRUST_get_flags,BIO_snprintf,BUF_strlcpy,BIO_snprintf,BIO_puts,CRYPTO_THREADID_cmp,	3_2_110032F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110492F0 RSA_private_encrypt,	3_2_110492F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110992F0 NETSCAPE_SPKI_b64_decode,CRYPTO_malloc,ERR_put_error,EVP_DecodeBlock,ERR_put_error,CRYPTO_free,d2i_NETSCAPE_SPKI,CRYPTO_free,	3_2_110992F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AF2F0 CMS_EncryptedData_decrypt,pqueue_peek,OBJ_obj2nid,ERR_put_error,CMS_get0_content,ERR_put_error,CMS_EncryptedData_set1_key,CMS_dataInit,	3_2_110AF2F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A3500 X509V3_conf_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_110A3500
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A7500 BIO_printf,sk_num,BIO_printf,sk_num,sk_value,BIO_puts,BIO_puts,i2s_ASN1_INTEGER,BIO_puts,CRYPTO_free,sk_num,BIO_puts,BIO_printf,	3_2_110A7500
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105D510 ECPKParameters_print,BN_CTX_new,EC_GROUP_get_asn1_flag,BIO_indent,ENGINE_get_pkey_asn1_meths,OBJ_nid2sn,BIO_printf,BIO_printf,EC_curve_nid2nist,BIO_indent,BIO_printf,pqueue_peek,X509_TRUST_get_flags,BN_new,BN_new,BN_new,BN_new,BN_new,EC_GROUP_get_curve_GF2m,EC_GROUP_get_curve_GFp,X509_TRUST_get_flags,EC_GROUP_get_order,EC_GROUP_get_cofactor,ENGINE_get_init_function,EC_POINT_point2bn,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,ENGINE_get_finish_function,EVP_MD_block_size,CRYPTO_malloc,BIO_indent,OBJ_nid2sn,BIO_printf,EC_GROUP_get_basis_type,BIO_indent,OBJ_nid2sn,BIO_printf,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ERR_put_error,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_CTX_free,CRYPTO_free,	3_2_1105D510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BD520 PKCS12_key_gen_asc,PKCS12_key_gen_uni,OPENSSL_asc2uni,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,	3_2_110BD520
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11089530 ASN1_PCTX_new,CRYPTO_malloc,ERR_put_error,	3_2_11089530
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11081540 X509_PUBKEY_set0_param,X509_ALGOR_set0,CRYPTO_free,	3_2_11081540
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003550 CRYPTO_mem_leaks,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,lh_doall_arg,BIO_printf,CRYPTO_lock,lh_free,lh_num_items,lh_free,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,	3_2_11003550
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107F550 ASN1_verify,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_VerifyFinal,EVP_MD_CTX_cleanup,ERR_put_error,EVP_MD_CTX_cleanup,	3_2_1107F550
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108B550 a2i_ASN1_ENUMERATED,BIO_gets,CRYPTO_malloc,CRYPTO_realloc,BIO_gets,ERR_put_error,CRYPTO_free,	3_2_1108B550
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF560 ENGINE_add,ERR_put_error,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	3_2_110BF560
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107D570 ASN1_INTEGER_set,CRYPTO_free,CRYPTO_malloc,ERR_put_error,	3_2_1107D570
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001580 CRYPTO_num_locks,	3_2_11001580
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001590 CRYPTO_destroy_dynlockid,CRYPTO_lock,sk_num,sk_value,sk_set,CRYPTO_lock,CRYPTO_free,CRYPTO_lock,	3_2_11001590
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110515B0 DH_KDF_X9_42,EVP_MD_size,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal,OPENSSL_cleanse,CRYPTO_free,EVP_MD_CTX_cleanup,	3_2_110515B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F5B0 EVP_MD_CTX_copy_ex,ENGINE_init,ERR_put_error,EVP_MD_CTX_set_flags,EVP_MD_CTX_cleanup,EVP_PKEY_CTX_dup,EVP_MD_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,	3_2_1106F5B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110615B0 BIO_get_ex_new_index,CRYPTO_get_ex_new_index,	3_2_110615B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110175F0 DES_ecb3_encrypt,DES_encrypt3,DES_decrypt3,	3_2_110175F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023400 AES_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	3_2_11023400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11059400 EC_KEY_get_key_method_data,CRYPTO_lock,CRYPTO_lock,	3_2_11059400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B9400 PKCS7_dataDecode,ERR_put_error,ERR_put_error,OBJ_obj2nid,ERR_put_error,OBJ_obj2nid,OBJ_nid2sn,EVP_get_cipherbyname,ERR_put_error,OBJ_obj2nid,OBJ_nid2sn,EVP_get_cipherbyname,OBJ_obj2nid,PKCS7_ctrl,sk_num,sk_value,BIO_f_md,BIO_new,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,BIO_ctrl,BIO_push,sk_num,BIO_f_cipher,BIO_new,ERR_put_error,ERR_put_error,ERR_put_error,sk_num,sk_value,X509_NAME_cmp,ASN1_STRING_cmp,sk_num,ERR_put_error,sk_num,sk_value,ERR_clear_error,sk_num,ERR_clear_error,BIO_ctrl,EVP_CipherInit_ex,EVP_CIPHER_asn1_to_param,X509_STORE_CTX_get0_policy_tree,CRYPTO_malloc,EVP_CIPHER_CTX_rand_key,X509_STORE_CTX_get0_policy_tree,EVP_CIPHER_CTX_set_key_length,OPENSSL_cleanse,CRYPTO_free,ERR_clear_error,EVP_CipherInit_ex,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,BIO_push,BIO_new_mem_buf,BIO_s_mem,BIO_new,BIO_ctrl,BIO_push,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,BIO_free_all,BIO_free_all,BIO_free_all,BIO_free_all,	3_2_110B9400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031410 CRYPTO_gcm128_decrypt,	3_2_11031410
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F420 SEED_cfb128_encrypt,SEED_encrypt,CRYPTO_cfb128_encrypt,	3_2_1102F420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107D420 d2i_ASN1_UINTEGER,ASN1_STRING_type_new,ASN1_get_object,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	3_2_1107D420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A3420 X509V3_add_value,BUF_strdup,BUF_strdup,CRYPTO_malloc,sk_new_null,sk_push,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_110A3420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107F430 ASN1_digest,CRYPTO_malloc,ERR_put_error,EVP_Digest,CRYPTO_free,CRYPTO_free,	3_2_1107F430
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11049440 RSA_setup_blinding,BN_CTX_new,BN_CTX_start,BN_CTX_get,ERR_put_error,ERR_put_error,RAND_status,RAND_add,BN_BLINDING_create_param,ERR_put_error,BN_BLINDING_thread_id,CRYPTO_THREADID_current,BN_CTX_end,BN_CTX_free,BN_free,	3_2_11049440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106D440 OBJ_NAME_add,CRYPTO_mem_ctrl,lh_new,CRYPTO_mem_ctrl,CRYPTO_malloc,lh_insert,sk_num,sk_value,CRYPTO_free,CRYPTO_free,	3_2_1106D440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11059450 EC_KEY_insert_key_method_data,CRYPTO_lock,CRYPTO_lock,	3_2_11059450
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11065450 BIO_vprintf,CRYPTO_push_info_,CRYPTO_free,BIO_write,CRYPTO_free,BIO_write,CRYPTO_pop_info,	3_2_11065450
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F460 SEED_ofb128_encrypt,SEED_encrypt,CRYPTO_ofb128_encrypt,	3_2_1102F460
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11099460 X509_get_subject_name,sk_num,sk_value,X509_cmp,sk_num,sk_num,CRYPTO_add_lock,X509_free,sk_pop_free,X509_free,sk_pop_free,	3_2_11099460
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F490 CRYPTO_cbc128_encrypt,	3_2_1102F490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104D490 DSO_convert_filename,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BUF_strlcpy,	3_2_1104D490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051490 CMS_SharedInfo_encode,CRYPTO_memcmp,	3_2_11051490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109B490 X509_verify_cert,ERR_put_error,sk_new_null,sk_push,CRYPTO_add_lock,sk_dup,ERR_put_error,sk_num,sk_value,X509_check_purpose,sk_push,CRYPTO_add_lock,sk_delete_ptr,sk_num,sk_value,X509_check_purpose,sk_num,X509_cmp,X509_free,sk_set,X509_get_pubkey_parameters,sk_free,X509_free,X509_free,X509_free,sk_pop,sk_value,sk_push,sk_value,sk_push,X509_free,sk_pop,X509_free,sk_num,X509_get_pubkey_parameters,X509_chain_check_suiteb,sk_value,X509_free,ERR_put_error,	3_2_1109B490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F4A0 EVP_MD_CTX_cleanup,EVP_MD_CTX_test_flags,EVP_MD_CTX_test_flags,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,ENGINE_finish,	3_2_1106F4A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110754A0 EVP_PKEY_new,CRYPTO_malloc,ERR_put_error,	3_2_110754A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110834B0 X509_CRL_METHOD_new,CRYPTO_malloc,	3_2_110834B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A14C0 X509_VERIFY_PARAM_add0_table,sk_new,sk_find,sk_value,CRYPTO_free,CRYPTO_free,sk_delete,sk_push,	3_2_110A14C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107F4D0 ASN1_item_digest,ASN1_item_i2d,EVP_Digest,CRYPTO_free,CRYPTO_free,	3_2_1107F4D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B14D0 CMS_add1_signer,X509_check_private_key,ERR_put_error,ASN1_item_new,X509_check_purpose,CRYPTO_add_lock,CRYPTO_add_lock,EVP_MD_CTX_init,EVP_PKEY_get_default_digest_nid,OBJ_nid2sn,EVP_get_digestbyname,X509_ALGOR_set_md,sk_num,sk_value,X509_ALGOR_get0,OBJ_obj2nid,pqueue_peek,sk_num,sk_num,X509_ALGOR_new,X509_ALGOR_set_md,sk_push,X509_ALGOR_free,ERR_put_error,ASN1_item_free,sk_new_null,CMS_add_standard_smimecap,CMS_add_smimecap,X509_ALGOR_free,sk_pop_free,CMS_SignerInfo_sign,CMS_add1_cert,EVP_PKEY_CTX_new,EVP_PKEY_sign_init,EVP_PKEY_CTX_ctrl,EVP_DigestSignInit,sk_new_null,sk_push,	3_2_110B14D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110014E0 CRYPTO_get_new_lockid,sk_new_null,ERR_put_error,BUF_strdup,sk_push,CRYPTO_free,	3_2_110014E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110454F0 RSA_padding_check_PKCS1_OAEP_mgf1,EVP_sha1,EVP_MD_size,CRYPTO_malloc,CRYPTO_malloc,_memset,PKCS1_MGF1,PKCS1_MGF1,EVP_Digest,CRYPTO_memcmp,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_110454F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001700 CRYPTO_get_dynlock_destroy_callback,	3_2_11001700
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107F700 ASN1_item_verify,ERR_put_error,ERR_put_error,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_find_sigid_algs,ERR_put_error,ERR_put_error,OBJ_nid2sn,EVP_get_digestbyname,ERR_put_error,EVP_PKEY_type,ERR_put_error,EVP_DigestVerifyInit,ASN1_item_i2d,ERR_put_error,EVP_DigestUpdate,OPENSSL_cleanse,CRYPTO_free,EVP_DigestVerifyFinal,ERR_put_error,EVP_MD_CTX_cleanup,	3_2_1107F700
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001710 CRYPTO_set_dynlock_create_callback,	3_2_11001710
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101D710 RC2_ecb_encrypt,RC2_encrypt,RC2_decrypt,	3_2_1101D710
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001720 CRYPTO_set_dynlock_lock_callback,	3_2_11001720
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11083720 X509_INFO_new,CRYPTO_malloc,ERR_put_error,	3_2_11083720
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001730 CRYPTO_set_dynlock_destroy_callback,	3_2_11001730
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001740 CRYPTO_get_locking_callback,	3_2_11001740
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11055740 CRYPTO_add_lock,EC_POINT_free,CRYPTO_free,CRYPTO_free,	3_2_11055740
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001750 CRYPTO_get_add_lock_callback,	3_2_11001750
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF750 ENGINE_finish,ERR_put_error,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	3_2_110BF750
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001760 CRYPTO_set_locking_callback,	3_2_11001760
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105F760 CRYPTO_malloc,ERR_put_error,ECDSA_OpenSSL,ENGINE_get_default_ECDSA,EVP_PKEY_CTX_get_app_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,	3_2_1105F760
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001770 CRYPTO_set_add_lock_callback,	3_2_11001770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003770 CRYPTO_mem_leaks_fp,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,BIO_s_file,BIO_new,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,BIO_ctrl,CRYPTO_mem_leaks,BIO_free,	3_2_11003770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11083770 X509_INFO_free,CRYPTO_add_lock,X509_free,X509_CRL_free,X509_PKEY_free,CRYPTO_free,CRYPTO_free,	3_2_11083770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A3770 X509V3_add_value_int,i2s_ASN1_INTEGER,X509V3_add_value,CRYPTO_free,	3_2_110A3770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001780 CRYPTO_THREADID_set_numeric,	3_2_11001780
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001790 CRYPTO_THREADID_set_pointer,	3_2_11001790
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110017A0 CRYPTO_THREADID_set_callback,	3_2_110017A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110517B0 EC_GROUP_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BN_init,BN_init,CRYPTO_free,	3_2_110517B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110017C0 CRYPTO_THREADID_get_callback,	3_2_110017C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F7C0 EVP_MD_CTX_destroy,EVP_MD_CTX_cleanup,CRYPTO_free,	3_2_1106F7C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108B7C0 X509_PKEY_new,CRYPTO_malloc,ERR_put_error,X509_ALGOR_new,ASN1_STRING_type_new,	3_2_1108B7C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110017D0 CRYPTO_THREADID_current,GetCurrentThreadId,	3_2_110017D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11057620 BN_new,BN_new,pqueue_peek,X509_TRUST_get_flags,EC_GROUP_get_curve_GFp,ERR_put_error,EC_GROUP_get_curve_GF2m,BN_num_bits,BN_num_bits,CRYPTO_malloc,BN_bn2bin,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,ASN1_STRING_set,ASN1_STRING_set,ASN1_BIT_STRING_new,CRYPTO_malloc,BN_bn2bin,ASN1_OCTET_STRING_set,ASN1_BIT_STRING_free,ERR_put_error,	3_2_11057620
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11061620 BIO_new,CRYPTO_malloc,ERR_put_error,BIO_set,CRYPTO_free,	3_2_11061620
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C7620 UI_new,CRYPTO_malloc,ERR_put_error,UI_OpenSSL,CRYPTO_new_ex_data,	3_2_110C7620
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F630 CRYPTO_cbc128_decrypt,	3_2_1102F630
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF640 CRYPTO_lock,CRYPTO_lock,ERR_put_error,	3_2_110BF640
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BD640 PKCS12_get_attr_gen,PKCS12_get_attr_gen,OBJ_obj2nid,EVP_PKCS82PKEY,PKCS12_decrypt_skey,EVP_PKCS82PKEY,PKCS8_PRIV_KEY_INFO_free,OBJ_obj2nid,PKCS12_certbag2x509,X509_keyid_set1,ASN1_STRING_to_UTF8,X509_alias_set1,CRYPTO_free,sk_push,X509_free,	3_2_110BD640
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001660 CRYPTO_get_dynlock_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_lock,	3_2_11001660
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F660 idea_cfb64_encrypt,idea_encrypt,idea_encrypt,	3_2_1101F660
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031670 CRYPTO_gcm128_encrypt_ctr32,	3_2_11031670
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097680 b2i_PVK_bio,BIO_read,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,BIO_read,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,	3_2_11097680
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11095690 EVP_PKEY2PKCS8,ERR_put_error,i2d_PKCS8_PRIV_KEY_INFO_bio,PKCS8_PRIV_KEY_INFO_free,PEM_write_bio_PKCS8_PRIV_KEY_INFO,PKCS8_PRIV_KEY_INFO_free,PEM_def_callback,ERR_put_error,PKCS8_PRIV_KEY_INFO_free,PKCS8_encrypt,OPENSSL_cleanse,PKCS8_PRIV_KEY_INFO_free,i2d_PKCS8_bio,PEM_write_bio_PKCS8,X509_SIG_free,	3_2_11095690
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B3690 CMS_add1_ReceiptRequest,CMS_ReceiptRequest_it,ASN1_item_i2d,CMS_signed_add1_attr_by_NID,ERR_put_error,CRYPTO_free,	3_2_110B3690
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110196A0 DES_pcbc_encrypt,DES_encrypt1,DES_encrypt1,	3_2_110196A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110556A0 CRYPTO_malloc,ERR_put_error,	3_2_110556A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110896A0 i2s_ASN1_INTEGER,BIO_puts,CRYPTO_free,	3_2_110896A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107D6C0 BN_to_ASN1_INTEGER,ASN1_STRING_type_new,BN_num_bits,CRYPTO_realloc,ERR_put_error,ASN1_STRING_free,BN_bn2bin,	3_2_1107D6C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110176D0 DES_cfb64_encrypt,DES_encrypt1,DES_encrypt1,	3_2_110176D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BF6D0 ENGINE_init,ERR_put_error,CRYPTO_lock,CRYPTO_lock,	3_2_110BF6D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110016E0 CRYPTO_get_dynlock_create_callback,	3_2_110016E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110016F0 CRYPTO_get_dynlock_lock_callback,	3_2_110016F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110616F0 BIO_dup_chain,CRYPTO_malloc,BIO_set,BIO_ctrl,CRYPTO_dup_ex_data,BIO_push,CRYPTO_free,ERR_put_error,BIO_free,BIO_free,	3_2_110616F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F900 CRYPTO_ctr128_encrypt,	3_2_1102F900
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003910 CRYPTO_mem_leaks_cb,CRYPTO_lock,lh_doall_arg,CRYPTO_lock,	3_2_11003910
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106B930 CRYPTO_free,	3_2_1106B930
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11087930 ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,BUF_MEM_grow_clean,ERR_put_error,ERR_put_error,ERR_put_error,asn1_ex_c2i,CRYPTO_free,	3_2_11087930
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11057940 BN_new,ERR_put_error,ASN1_item_new,X509_TRUST_get_flags,ENGINE_get_init_function,EC_POINT_point2oct,CRYPTO_malloc,EC_POINT_point2oct,ASN1_OCTET_STRING_new,ASN1_OCTET_STRING_set,EC_GROUP_get_order,BN_to_ASN1_INTEGER,EC_GROUP_get_cofactor,BN_to_ASN1_INTEGER,ERR_put_error,ASN1_item_free,BN_free,CRYPTO_free,	3_2_11057940
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11039950 BN_BLINDING_new,CRYPTO_malloc,ERR_put_error,_memset,BN_dup,BN_dup,BN_dup,BN_BLINDING_free,CRYPTO_THREADID_current,	3_2_11039950
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051970 EC_GROUP_set_seed,CRYPTO_free,CRYPTO_malloc,	3_2_11051970
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105F9A0 ECDSA_get_ex_new_index,CRYPTO_get_ex_new_index,	3_2_1105F9A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110039B0 CRYPTO_get_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,	3_2_110039B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108F9B0 ASN1_STRING_set0,CRYPTO_free,	3_2_1108F9B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F9E0 EVP_EncryptFinal_ex,OpenSSLDie,ERR_put_error,_memset,	3_2_1106F9E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106B9F0 ERR_free_strings,CRYPTO_lock,CRYPTO_lock,	3_2_1106B9F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108F9F0 ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,	3_2_1108F9F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7800 TXT_DB_free,lh_free,CRYPTO_free,CRYPTO_free,sk_num,sk_value,CRYPTO_free,CRYPTO_free,sk_value,CRYPTO_free,sk_free,CRYPTO_free,	3_2_110B7800
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001810 CRYPTO_THREADID_cmp,	3_2_11001810
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11055810 CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,BN_is_bit_set,ERR_put_error,CRYPTO_free,	3_2_11055810
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F820 EVP_CIPHER_CTX_new,CRYPTO_malloc,_memset,	3_2_1106F820
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106B830 CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,_strerror,_strncpy,CRYPTO_lock,	3_2_1106B830
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102D840 SEED_encrypt,	3_2_1102D840
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105F840 ENGINE_finish,CRYPTO_free_ex_data,OPENSSL_cleanse,CRYPTO_free,	3_2_1105F840
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108B840 X509_PKEY_free,d2i_NETSCAPE_SPKAC,d2i_NETSCAPE_SPKAC,CRYPTO_add_lock,X509_ALGOR_free,ASN1_STRING_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,	3_2_1108B840
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106F850 EVP_EncryptUpdate,OpenSSLDie,	3_2_1106F850
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107B850 a2d_ASN1_OBJECT,ERR_put_error,BN_new,BN_set_word,BN_mul_word,BN_add_word,BN_add_word,BN_num_bits,CRYPTO_free,CRYPTO_malloc,BN_div_word,CRYPTO_free,BN_free,ERR_put_error,CRYPTO_free,BN_free,ERR_put_error,	3_2_1107B850
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AF850 CMS_RecipientInfo_kari_get0_reks,sk_num,sk_value,CMS_RecipientEncryptedKey_cert_cmp,sk_num,CMS_RecipientInfo_kari_set0_pkey,CMS_RecipientInfo_kari_decrypt,CMS_RecipientInfo_kari_set0_pkey,	3_2_110AF850
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F860 idea_ofb64_encrypt,idea_encrypt,	3_2_1101F860
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11039860 BN_BLINDING_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,	3_2_11039860
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001870 CRYPTO_THREADID_cpy,	3_2_11001870
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031870 CRYPTO_gcm128_decrypt_ctr32,	3_2_11031870
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001890 CRYPTO_get_id_callback,	3_2_11001890
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110018A0 CRYPTO_set_id_callback,	3_2_110018A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110238A0 AES_bi_ige_encrypt,OpenSSLDie,OpenSSLDie,OpenSSLDie,AES_encrypt,AES_encrypt,AES_decrypt,AES_decrypt,	3_2_110238A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106D8A0 OBJ_add_object,lh_new,OBJ_dup,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,lh_insert,CRYPTO_free,	3_2_1106D8A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B18A0 EVP_MD_CTX_init,ERR_put_error,CMS_signed_get_attr_count,EVP_DigestFinal_ex,CMS_signed_add1_attr_by_NID,CMS_signed_add1_attr_by_NID,CMS_SignerInfo_sign,EVP_DigestFinal_ex,EVP_PKEY_size,CRYPTO_malloc,ERR_put_error,EVP_PKEY_sign,EVP_PKEY_size,CRYPTO_malloc,EVP_SignFinal,ERR_put_error,CRYPTO_free,ASN1_STRING_set0,EVP_MD_CTX_cleanup,EVP_PKEY_CTX_free,	3_2_110B18A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110018B0 CRYPTO_thread_id,GetCurrentThreadId,	3_2_110018B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110978B0 EVP_CIPHER_CTX_init,CRYPTO_malloc,ERR_put_error,RAND_bytes,PEM_def_callback,ERR_put_error,EVP_CIPHER_CTX_cleanup,EVP_rc4,EVP_EncryptInit_ex,OPENSSL_cleanse,EVP_DecryptUpdate,EVP_DecryptFinal_ex,EVP_CIPHER_CTX_cleanup,EVP_CIPHER_CTX_cleanup,	3_2_110978B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110178C0 DES_ede3_cfb64_encrypt,DES_encrypt3,DES_encrypt3,	3_2_110178C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110918C0 _strrchr,OBJ_create,CRYPTO_malloc,OBJ_nid2obj,	3_2_110918C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110018D0 CRYPTO_get_lock_name,sk_num,sk_value,	3_2_110018D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101D8E0 RC2_encrypt,	3_2_1101D8E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108F8F0 ASN1_STRING_set,CRYPTO_malloc,CRYPTO_realloc,ERR_put_error,	3_2_1108F8F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110958F0 PEM_write_bio_PKCS8PrivateKey,EVP_PKEY2PKCS8,ERR_put_error,PEM_write_bio_PKCS8_PRIV_KEY_INFO,PKCS8_PRIV_KEY_INFO_free,PEM_def_callback,ERR_put_error,PKCS8_PRIV_KEY_INFO_free,PKCS8_encrypt,OPENSSL_cleanse,PKCS8_PRIV_KEY_INFO_free,PEM_write_bio_PKCS8,X509_SIG_free,	3_2_110958F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AF8F0 CMS_decrypt_set1_pkey,CMS_get0_RecipientInfos,ERR_put_error,sk_num,sk_value,pqueue_peek,CMS_RecipientInfo_ktri_cert_cmp,CMS_RecipientInfo_set0_pkey,CMS_RecipientInfo_decrypt,CMS_RecipientInfo_set0_pkey,sk_num,ERR_clear_error,ERR_put_error,	3_2_110AF8F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11065B00 BIO_get_port,ERR_put_error,CRYPTO_lock,getservbyname,htons,CRYPTO_lock,WSAGetLastError,ERR_put_error,ERR_add_error_data,	3_2_11065B00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11013B10 DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,DES_set_odd_parity,DES_set_key_unchecked,DES_encrypt1,	3_2_11013B10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101FB10 idea_set_encrypt_key,	3_2_1101FB10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BB10 ERR_release_err_state_table,CRYPTO_lock,CRYPTO_lock,	3_2_1106BB10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B9B30 PKCS7_SIGNER_INFO_sign,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,EVP_MD_CTX_init,EVP_DigestSignInit,EVP_PKEY_CTX_ctrl,PKCS7_ATTR_SIGN_it,ASN1_item_i2d,EVP_DigestUpdate,CRYPTO_free,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,EVP_PKEY_CTX_ctrl,ERR_put_error,CRYPTO_free,EVP_MD_CTX_cleanup,EVP_MD_CTX_cleanup,ASN1_STRING_set0,	3_2_110B9B30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031B40 CRYPTO_gcm128_tag,CRYPTO_gcm128_finish,	3_2_11031B40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C1B40 ENGINE_pkey_asn1_find_str,CRYPTO_lock,CRYPTO_lock,	3_2_110C1B40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051B60 CRYPTO_malloc,ERR_put_error,	3_2_11051B60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BB70 ERR_lib_error_string,CRYPTO_lock,CRYPTO_lock,	3_2_1106BB70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11075B70 EVP_PKEY_free,CRYPTO_add_lock,ENGINE_finish,X509_ATTRIBUTE_free,sk_pop_free,CRYPTO_free,	3_2_11075B70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091B70 PEM_SealInit,RSA_size,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_EncodeInit,EVP_MD_CTX_init,EVP_DigestInit,EVP_CIPHER_CTX_init,EVP_SealInit,RSA_size,EVP_EncodeBlock,CRYPTO_free,OPENSSL_cleanse,	3_2_11091B70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101DB80 RC2_cbc_encrypt,RC2_encrypt,RC2_encrypt,RC2_decrypt,RC2_decrypt,	3_2_1101DB80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031B80 CRYPTO_gcm128_new,CRYPTO_malloc,CRYPTO_gcm128_init,	3_2_11031B80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AFB80 CMS_decrypt_set1_password,CMS_get0_RecipientInfos,sk_num,sk_value,pqueue_peek,CMS_RecipientInfo_set0_password,CMS_RecipientInfo_decrypt,CMS_RecipientInfo_set0_password,sk_num,ERR_put_error,	3_2_110AFB80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FB90 CRYPTO_cts128_encrypt_block,CRYPTO_cbc128_encrypt,	3_2_1102FB90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107DB90 i2d_ASN1_SET,sk_num,sk_value,sk_value,ASN1_object_size,ASN1_put_object,sk_num,sk_num,CRYPTO_malloc,sk_num,sk_value,sk_num,sk_num,CRYPTO_malloc,ERR_put_error,sk_num,sk_num,CRYPTO_free,CRYPTO_free,sk_num,sk_value,sk_num,	3_2_1107DB90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A3B90 hex_to_string,CRYPTO_malloc,ERR_put_error,	3_2_110A3B90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031BC0 CRYPTO_gcm128_release,OPENSSL_cleanse,CRYPTO_free,	3_2_11031BC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11085BC0 ASN1_template_new,ASN1_primitive_new,CRYPTO_malloc,_memset,asn1_set_choice_selector,CRYPTO_malloc,_memset,asn1_do_lock,asn1_enc_init,asn1_get_field_ptr,ASN1_template_new,ASN1_item_ex_free,ERR_put_error,ASN1_item_ex_free,ERR_put_error,	3_2_11085BC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003BD0 CRYPTO_malloc,ERR_put_error,CRYPTO_lock,sk_num,sk_push,sk_num,sk_set,CRYPTO_lock,ERR_put_error,CRYPTO_free,	3_2_11003BD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031BE0 CRYPTO_ccm128_init,	3_2_11031BE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BBF0 ERR_func_error_string,CRYPTO_lock,CRYPTO_lock,	3_2_1106BBF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11079BF0 EVP_PKEY_CTX_free,EVP_PKEY_free,EVP_PKEY_free,ENGINE_finish,CRYPTO_free,	3_2_11079BF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11075BF0 EVP_PKEY_encrypt_old,ERR_put_error,RSA_public_encrypt,	3_2_11075BF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003A00 CRYPTO_set_ex_data_implementation,CRYPTO_lock,CRYPTO_lock,	3_2_11003A00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11055A00 ERR_put_error,EC_POINT_set_to_infinity,BN_CTX_new,X509_TRUST_get_flags,ERR_put_error,EC_POINT_cmp,BN_num_bits,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,BN_num_bits,CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free,EC_POINT_new,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_add,EC_POINTs_make_affine,EC_POINT_dbl,EC_POINT_invert,EC_POINT_copy,EC_POINT_add,EC_POINT_set_to_infinity,EC_POINT_invert,ERR_put_error,BN_CTX_free,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,	3_2_11055A00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1105FA10 ECDSA_METHOD_new,CRYPTO_malloc,ERR_put_error,	3_2_1105FA10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101DA20 RC2_decrypt,	3_2_1101DA20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104FA30 BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,BN_num_bits,CRYPTO_malloc,BIO_indent,BN_num_bits,BIO_printf,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,ASN1_bn_print,BIO_indent,BIO_puts,BIO_puts,BIO_indent,BIO_printf,BIO_write,ASN1_bn_print,BIO_indent,BIO_printf,ERR_put_error,CRYPTO_free,	3_2_1104FA30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108FA40 ASN1_STRING_free,CRYPTO_free,CRYPTO_free,	3_2_1108FA40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003A50 CRYPTO_lock,pqueue_peek,lh_new,CRYPTO_lock,	3_2_11003A50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FA50 CRYPTO_ctr128_encrypt_ctr32,	3_2_1102FA50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11039A50 BN_BLINDING_create_param,CRYPTO_malloc,ERR_put_error,_memset,BN_dup,CRYPTO_THREADID_current,BN_new,BN_new,BN_free,BN_dup,BN_rand_range,BN_mod_inverse,ERR_peek_last_error,ERR_clear_error,BN_rand_range,ERR_put_error,BN_mod_exp,BN_BLINDING_free,	3_2_11039A50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BA50 ERR_get_string_table,CRYPTO_lock,CRYPTO_lock,	3_2_1106BA50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11099A50 sk_num,CRYPTO_free,sk_value,X509_check_host,	3_2_11099A50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101FA60 idea_ecb_encrypt,idea_encrypt,	3_2_1101FA60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031A70 CRYPTO_gcm128_finish,CRYPTO_memcmp,	3_2_11031A70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108FA70 ASN1_STRING_clear_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	3_2_1108FA70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11095A70 i2d_PKCS8PrivateKey_bio,EVP_PKEY2PKCS8,ERR_put_error,i2d_PKCS8_PRIV_KEY_INFO_bio,PKCS8_PRIV_KEY_INFO_free,PEM_def_callback,ERR_put_error,PKCS8_PRIV_KEY_INFO_free,PKCS8_encrypt,OPENSSL_cleanse,PKCS8_PRIV_KEY_INFO_free,i2d_PKCS8_bio,X509_SIG_free,	3_2_11095A70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11079A80 EVP_PKEY_meth_new,CRYPTO_malloc,_memset,	3_2_11079A80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11085A80 ASN1_primitive_new,OBJ_nid2obj,CRYPTO_malloc,ASN1_STRING_type_new,	3_2_11085A80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AFA90 CMS_decrypt_set1_key,CMS_get0_RecipientInfos,sk_num,sk_value,pqueue_peek,CMS_RecipientInfo_kekri_id_cmp,CMS_RecipientInfo_set0_key,CMS_RecipientInfo_decrypt,CMS_RecipientInfo_set0_key,ERR_clear_error,sk_num,ERR_put_error,ERR_put_error,	3_2_110AFA90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003AB0 ASN1_PCTX_free,sk_pop_free,CRYPTO_free,	3_2_11003AB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BAB0 ERR_get_err_state_table,CRYPTO_lock,CRYPTO_lock,	3_2_1106BAB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003AD0 CRYPTO_lock,lh_retrieve,CRYPTO_malloc,sk_new_null,CRYPTO_free,lh_insert,lh_retrieve,sk_free,CRYPTO_free,CRYPTO_lock,ERR_put_error,	3_2_11003AD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106FAD0 EVP_DecryptUpdate,EVP_EncryptUpdate,OpenSSLDie,EVP_EncryptUpdate,	3_2_1106FAD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091AD0 PEM_SignFinal,EVP_PKEY_size,CRYPTO_malloc,ERR_put_error,EVP_SignFinal,EVP_EncodeBlock,CRYPTO_free,	3_2_11091AD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11017AE0 DES_ede3_cfb_encrypt,DES_encrypt3,DES_encrypt3,	3_2_11017AE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11093AE0 PEM_ASN1_write_bio,pqueue_peek,OBJ_nid2sn,X509_TRUST_get0_name,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PEM_def_callback,ERR_put_error,RAND_add,OpenSSLDie,RAND_bytes,EVP_md5,EVP_BytesToKey,OPENSSL_cleanse,OpenSSLDie,PEM_proc_type,PEM_dek_info,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal_ex,EVP_CIPHER_CTX_cleanup,PEM_write_bio,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,	3_2_11093AE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BFAF0 ENGINE_ctrl,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_110BFAF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051D20 EC_POINT_new,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,	3_2_11051D20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BD30 ERR_remove_thread_state,CRYPTO_THREADID_cpy,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,	3_2_1106BD30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A9D30 X509_check_purpose,CRYPTO_lock,CRYPTO_lock,X509_PURPOSE_get_by_id,sk_value,	3_2_110A9D30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106DD40 OBJ_create,a2d_ASN1_OBJECT,CRYPTO_malloc,ERR_put_error,a2d_ASN1_OBJECT,ASN1_OBJECT_create,OBJ_add_object,ASN1_OBJECT_free,CRYPTO_free,	3_2_1106DD40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091D40 PEM_SealUpdate,EVP_DigestUpdate,EVP_EncryptUpdate,EVP_EncodeUpdate,	3_2_11091D40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BDD40 PKCS12_verify_mac,ERR_put_error,PKCS12_gen_mac,CRYPTO_memcmp,	3_2_110BDD40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031D60 CRYPTO_ccm128_encrypt,_memset,	3_2_11031D60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107BD60 ASN1_OBJECT_new,CRYPTO_malloc,ERR_put_error,	3_2_1107BD60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11043D70 RSA_new_method,CRYPTO_malloc,ERR_put_error,_memset,RSA_PKCS1_SSLeay,ENGINE_init,ERR_put_error,CRYPTO_free,ENGINE_get_default_RSA,UI_get0_user_data,ERR_put_error,ENGINE_finish,CRYPTO_free,CRYPTO_new_ex_data,ENGINE_finish,CRYPTO_free,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_free,	3_2_11043D70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106FD70 EVP_CIPHER_CTX_cleanup,OPENSSL_cleanse,CRYPTO_free,ENGINE_finish,_memset,	3_2_1106FD70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101FD80 BF_set_key,BF_encrypt,BF_encrypt,	3_2_1101FD80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023D80 AES_wrap_key,AES_encrypt,CRYPTO_128_wrap,	3_2_11023D80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11045D80 RSA_verify_PKCS1_PSS_mgf1,EVP_MD_CTX_init,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,PKCS1_MGF1,ERR_put_error,ERR_put_error,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,ERR_put_error,CRYPTO_free,EVP_MD_CTX_cleanup,	3_2_11045D80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001D90 CRYPTO_memcmp,	3_2_11001D90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003DA0 CRYPTO_ex_data_new_class,CRYPTO_lock,CRYPTO_lock,	3_2_11003DA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FDA0 CRYPTO_nistcts128_encrypt,	3_2_1102FDA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023DB0 AES_unwrap_key,AES_decrypt,CRYPTO_128_unwrap,	3_2_11023DB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107BDB0 ASN1_OBJECT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_1107BDB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109FDB0 X509_TRUST_add,CRYPTO_malloc,ERR_put_error,sk_value,CRYPTO_free,BUF_strdup,sk_new,sk_push,	3_2_1109FDB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001DC0 CRYPTO_lock,CRYPTO_get_dynlock_value,CRYPTO_destroy_dynlockid,OpenSSLDie,	3_2_11001DC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BDC0 ERR_remove_state,CRYPTO_THREADID_current,CRYPTO_lock,CRYPTO_lock,	3_2_1106BDC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B3DC0 CMS_add0_recipient_password,ERR_put_error,X509_ALGOR_new,EVP_CIPHER_CTX_init,EVP_EncryptInit_ex,X509_get_issuer_name,RAND_bytes,EVP_EncryptInit_ex,ASN1_TYPE_new,EVP_CIPHER_param_to_asn1,pqueue_peek,EVP_CIPHER_type,OBJ_nid2obj,EVP_CIPHER_CTX_cleanup,ASN1_item_new,ASN1_item_new,X509_ALGOR_free,X509_ALGOR_new,OBJ_nid2obj,ASN1_TYPE_new,X509_ALGOR_it,ASN1_item_pack,X509_ALGOR_free,PKCS5_pbkdf2_set,CMS_RecipientInfo_set0_password,sk_push,ERR_put_error,EVP_CIPHER_CTX_cleanup,ASN1_item_free,X509_ALGOR_free,	3_2_110B3DC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051DD0 EC_POINT_free,CRYPTO_free,	3_2_11051DD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109DDD0 X509_LOOKUP_new,CRYPTO_malloc,CRYPTO_free,	3_2_1109DDD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BDDF0 PKCS12_setup_mac,PKCS12_MAC_DATA_free,PKCS12_MAC_DATA_new,ASN1_STRING_type_new,ASN1_INTEGER_set,CRYPTO_malloc,RAND_bytes,pqueue_peek,OBJ_nid2obj,ASN1_TYPE_new,ERR_put_error,	3_2_110BDDF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107FC00 ASN1_mbstring_ncopy,UTF8_getc,ERR_put_error,BIO_snprintf,ERR_add_error_data,ERR_put_error,BIO_snprintf,ERR_add_error_data,CRYPTO_free,ASN1_STRING_type_new,ASN1_STRING_set,CRYPTO_malloc,ASN1_STRING_free,ERR_put_error,	3_2_1107FC00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106FC10 EVP_DecryptFinal_ex,ERR_put_error,OpenSSLDie,ERR_put_error,ERR_put_error,	3_2_1106FC10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FC30 CRYPTO_nistcts128_encrypt_block,CRYPTO_cbc128_encrypt,	3_2_1102FC30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031C30 CRYPTO_ccm128_setiv,	3_2_11031C30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097C30 i2b_PVK_bio,BIO_write,CRYPTO_free,ERR_put_error,	3_2_11097C30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A3C30 string_to_hex,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,ERR_put_error,	3_2_110A3C30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AFC30 CMS_decrypt,pqueue_peek,OBJ_obj2nid,ERR_put_error,CMS_get0_content,ERR_put_error,CMS_decrypt_set1_pkey,CMS_dataInit,	3_2_110AFC30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051C40 CRYPTO_free,	3_2_11051C40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11075C40 EVP_PKEY_decrypt_old,ERR_put_error,RSA_private_decrypt,	3_2_11075C40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107BC50 i2a_ASN1_OBJECT,OBJ_obj2txt,CRYPTO_malloc,OBJ_obj2txt,BIO_write,BIO_write,CRYPTO_free,BIO_write,	3_2_1107BC50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A9C50 X509_check_ca,CRYPTO_lock,CRYPTO_lock,	3_2_110A9C50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A1C50 ASN1_item_i2d,CRYPTO_malloc,ASN1_STRING_type_new,X509_EXTENSION_create_by_NID,ERR_put_error,ASN1_STRING_free,	3_2_110A1C50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11057C80 BN_bin2bn,ERR_put_error,BN_bin2bn,OBJ_obj2nid,ERR_put_error,BN_new,ERR_put_error,OBJ_obj2nid,ERR_put_error,ASN1_INTEGER_get,BN_set_bit,ERR_put_error,ERR_put_error,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,BN_set_bit,EC_GROUP_new_curve_GF2m,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ASN1_INTEGER_to_BN,ERR_put_error,BN_num_bits,ERR_put_error,EC_GROUP_new_curve_GFp,ERR_put_error,CRYPTO_free,CRYPTO_malloc,EC_POINT_new,EC_GROUP_set_point_conversion_form,EC_POINT_oct2point,ASN1_INTEGER_to_BN,BN_num_bits,ERR_put_error,EC_GROUP_clear_free,BN_free,BN_free,BN_free,EC_POINT_free,BN_free,EC_GROUP_set_generator,ASN1_INTEGER_to_BN,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_11057C80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BC80 ERR_reason_error_string,CRYPTO_lock,CRYPTO_lock,	3_2_1106BC80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031CA0 CRYPTO_ccm128_aad,	3_2_11031CA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051CA0 CRYPTO_free,	3_2_11051CA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A5CA0 OTHERNAME_new,ASN1_TYPE_free,ASN1_generate_v3,CRYPTO_malloc,_strncpy,OBJ_txt2obj,CRYPTO_free,	3_2_110A5CA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003CD0 CRYPTO_lock,CRYPTO_lock,	3_2_11003CD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FCD0 CRYPTO_cts128_encrypt,	3_2_1102FCD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101FCE0 idea_set_decrypt_key,	3_2_1101FCE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051CE0 CRYPTO_free,	3_2_11051CE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11095CE0 PEM_read_bio_PrivateKey,PEM_bytes_read_bio,d2i_PKCS8_PRIV_KEY_INFO,EVP_PKCS82PKEY,EVP_PKEY_free,PKCS8_PRIV_KEY_INFO_free,d2i_X509_SIG,PEM_def_callback,ERR_put_error,X509_SIG_free,PKCS8_decrypt,X509_SIG_free,EVP_PKCS82PKEY,EVP_PKEY_free,PKCS8_PRIV_KEY_INFO_free,EVP_PKEY_asn1_find_str,d2i_PrivateKey,ERR_put_error,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	3_2_11095CE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BBCF0 PKCS12_MAKE_SHKEYBAG,PKCS12_SAFEBAG_new,ERR_put_error,OBJ_nid2obj,OBJ_nid2sn,EVP_get_cipherbyname,PKCS8_encrypt,ERR_put_error,PKCS12_SAFEBAG_free,	3_2_110BBCF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101FF00 BF_ecb_encrypt,BF_encrypt,BF_decrypt,	3_2_1101FF00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11043F10 RSA_free,CRYPTO_add_lock,ENGINE_finish,CRYPTO_free_ex_data,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,BN_BLINDING_free,BN_BLINDING_free,CRYPTO_free_locked,CRYPTO_free,	3_2_11043F10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11079F10 EVP_PKEY_meth_set_decrypt,	3_2_11079F10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097F10 X509_issuer_and_serial_hash,EVP_MD_CTX_init,X509_NAME_oneline,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,CRYPTO_free,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,	3_2_11097F10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003F20 CRYPTO_dup_ex_data,CRYPTO_lock,CRYPTO_lock,	3_2_11003F20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104FF20 BN_dup,BN_free,BN_dup,BN_free,CRYPTO_free,BUF_memdup,	3_2_1104FF20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110ADF30 CMS_add1_cert,CMS_add0_cert,CRYPTO_add_lock,	3_2_110ADF30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108FF60 d2i_ASN1_type_bytes,ASN1_get_object,ASN1_tag2bit,d2i_ASN1_BIT_STRING,ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	3_2_1108FF60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109FF60 X509_TRUST_cleanup,CRYPTO_free,CRYPTO_free,sk_pop_free,	3_2_1109FF60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BF70 ERR_get_next_error_library,CRYPTO_lock,CRYPTO_lock,	3_2_1106BF70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11079F70 ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	3_2_11079F70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091F70 PEM_X509_INFO_read_bio,sk_new_null,ERR_put_error,X509_INFO_new,PEM_read_bio,sk_push,X509_INFO_new,X509_PKEY_new,X509_PKEY_new,X509_PKEY_new,PEM_get_EVP_CIPHER_INFO,PEM_do_header,d2i_PrivateKey,d2i_X509,ERR_put_error,X509_INFO_free,sk_num,sk_value,X509_INFO_free,sk_num,sk_free,PEM_get_EVP_CIPHER_INFO,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_last_error,ERR_clear_error,sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_11091F70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003F80 CRYPTO_free_ex_data,CRYPTO_lock,CRYPTO_lock,	3_2_11003F80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11065F90 BIO_accept,accept,BIO_sock_should_retry,WSAGetLastError,ERR_put_error,ERR_put_error,DSO_global_lookup,htonl,htons,CRYPTO_malloc,ERR_put_error,BIO_snprintf,CRYPTO_realloc,CRYPTO_malloc,BIO_snprintf,	3_2_11065F90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11085F90 ASN1_primitive_free,ASN1_OBJECT_free,ASN1_primitive_free,CRYPTO_free,ASN1_STRING_free,	3_2_11085F90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110ABF90 CRYPTO_malloc,X509_get_ext_d2i,POLICY_CONSTRAINTS_free,ASN1_INTEGER_free,ASN1_INTEGER_get,X509_get_ext_d2i,X509_get_ext_d2i,X509_get_ext_d2i,	3_2_110ABF90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109DFA0 X509_STORE_new,CRYPTO_malloc,sk_new,sk_new_null,X509_VERIFY_PARAM_new,CRYPTO_new_ex_data,X509_VERIFY_PARAM_free,sk_free,sk_free,CRYPTO_free,	3_2_1109DFA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B1FB0 ASN1_item_new,CRYPTO_add_lock,CRYPTO_add_lock,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,	3_2_110B1FB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031FC0 CRYPTO_ccm128_decrypt,_memset,	3_2_11031FC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B9FC0 PKCS7_signatureVerify,EVP_MD_CTX_init,OBJ_obj2nid,OBJ_obj2nid,ERR_put_error,OBJ_obj2nid,BIO_find_type,BIO_ctrl,X509_NAME_ENTRY_get_object,pqueue_peek,X509_NAME_ENTRY_get_object,X509_TRUST_get_flags,BIO_next,ERR_put_error,EVP_MD_CTX_cleanup,EVP_MD_CTX_copy_ex,sk_num,EVP_DigestFinal_ex,PKCS7_digest_from_attributes,OBJ_nid2sn,EVP_get_digestbyname,EVP_DigestInit_ex,PKCS7_ATTR_VERIFY_it,ASN1_item_i2d,ERR_put_error,EVP_DigestUpdate,CRYPTO_free,X509_get_pubkey,EVP_VerifyFinal,EVP_PKEY_free,	3_2_110B9FC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BBFC0 PKCS12_unpack_p7encdata,OBJ_obj2nid,PKCS12_SAFEBAGS_it,PKCS12_item_decrypt_d2i,	3_2_110BBFC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BFD0 ERR_set_error_data,ERR_get_state,CRYPTO_free,	3_2_1106BFD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003FE0 CRYPTO_set_ex_data,sk_new_null,ERR_put_error,sk_num,sk_push,sk_set,ERR_put_error,	3_2_11003FE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103FFF0 BN_GF2m_mod_mul,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_mul_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	3_2_1103FFF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003E00 CRYPTO_cleanup_all_ex_data,CRYPTO_lock,CRYPTO_lock,	3_2_11003E00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051E00 EC_POINT_clear_free,OPENSSL_cleanse,CRYPTO_free,	3_2_11051E00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11091E20 PEM_SealFinal,ERR_put_error,RSA_size,CRYPTO_malloc,ERR_put_error,EVP_EncryptFinal_ex,EVP_EncodeUpdate,EVP_EncodeFinal,EVP_SignFinal,EVP_EncodeBlock,EVP_MD_CTX_cleanup,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	3_2_11091E20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109DE20 X509_LOOKUP_free,CRYPTO_free,	3_2_1109DE20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7E30 PKCS7_ENCRYPT_it,	3_2_110B7E30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001E40 CRYPTO_add_lock,CRYPTO_lock,CRYPTO_lock,	3_2_11001E40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106BE40 ERR_get_state,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cpy,CRYPTO_malloc,CRYPTO_THREADID_cpy,	3_2_1106BE40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7E40 d2i_PKCS7_ENCRYPT,ASN1_item_d2i,	3_2_110B7E40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003E60 CRYPTO_get_ex_new_index,CRYPTO_lock,CRYPTO_lock,	3_2_11003E60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7E60 i2d_PKCS7_ENCRYPT,ASN1_item_i2d,	3_2_110B7E60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107BE70 c2i_ASN1_OBJECT,ASN1_OBJECT_new,ERR_put_error,CRYPTO_free,CRYPTO_malloc,ERR_put_error,ASN1_OBJECT_free,	3_2_1107BE70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102FE80 CRYPTO_cts128_decrypt_block,CRYPTO_cbc128_decrypt,	3_2_1102FE80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7E80 PKCS7_ENCRYPT_new,ASN1_item_new,	3_2_110B7E80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11001E90 CRYPTO_get_new_dynlockid,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,ERR_put_error,sk_find,sk_push,sk_set,CRYPTO_free,	3_2_11001E90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108FE90 ASN1_STRING_new,CRYPTO_malloc,ERR_put_error,	3_2_1108FE90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B7E90 PKCS7_ENCRYPT_free,ASN1_item_free,	3_2_110B7E90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BBE90 PKCS12_pack_p7encdata,PKCS7_new,ERR_put_error,PKCS7_set_type,OBJ_nid2sn,EVP_get_cipherbyname,PKCS5_pbe2_set,PKCS5_pbe_set,X509_ALGOR_free,ASN1_STRING_free,PKCS12_SAFEBAGS_it,PKCS12_item_i2d_encrypt,ERR_put_error,PKCS7_free,	3_2_110BBE90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11051EB0 EC_POINT_dup,EC_POINT_new,EC_POINT_copy,CRYPTO_free,	3_2_11051EB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11003EC0 CRYPTO_new_ex_data,CRYPTO_lock,CRYPTO_lock,	3_2_11003EC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106FEE0 EVP_CIPHER_CTX_copy,ENGINE_init,ERR_put_error,EVP_CIPHER_CTX_cleanup,CRYPTO_malloc,ERR_put_error,ERR_put_error,	3_2_1106FEE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AFEE0 CMS_EncryptedData_encrypt,ERR_put_error,CMS_ContentInfo_new,CMS_EncryptedData_set1_key,CMS_set_detached,CMS_final,CMS_ContentInfo_free,	3_2_110AFEE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11079EF0 EVP_PKEY_meth_set_encrypt,	3_2_11079EF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BFEF0 CRYPTO_lock,pqueue_peek,lh_new,lh_retrieve,CRYPTO_malloc,sk_new_null,lh_insert,sk_delete_ptr,sk_push,CRYPTO_lock,CRYPTO_free,ERR_put_error,	3_2_110BFEF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C0100 CRYPTO_lock,lh_doall_arg,CRYPTO_lock,	3_2_110C0100
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002120 CRYPTO_set_mem_ex_functions,	3_2_11002120
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11046130 RSA_padding_add_PKCS1_PSS_mgf1,EVP_MD_size,BN_num_bits,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,ERR_put_error,RAND_bytes,EVP_MD_CTX_init,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_cleanup,PKCS1_MGF1,CRYPTO_free,	3_2_11046130
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AC140 CRYPTO_lock,CRYPTO_lock,	3_2_110AC140
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107C150 c2i_ASN1_BIT_STRING,ASN1_STRING_type_new,CRYPTO_malloc,ERR_put_error,ASN1_STRING_free,CRYPTO_free,	3_2_1107C150
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11094160 PEM_bytes_read_bio,PEM_read_bio,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_peek_error,ERR_add_error_data,PEM_get_EVP_CIPHER_INFO,PEM_do_header,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_11094160
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106C170 ERR_pop_to_mark,ERR_get_state,CRYPTO_free,	3_2_1106C170
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002180 CRYPTO_set_locked_mem_functions,	3_2_11002180
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11090180 ASN1_STRING_new,ASN1_get_object,CRYPTO_malloc,ASN1_STRING_free,CRYPTO_free,CRYPTO_free,	3_2_11090180
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109E190 X509_STORE_add_lookup,sk_num,sk_value,sk_num,CRYPTO_malloc,sk_push,CRYPTO_free,	3_2_1109E190
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AE190 CMS_get1_crls,OBJ_obj2nid,ERR_put_error,sk_num,sk_value,sk_new_null,sk_push,CRYPTO_add_lock,sk_num,X509_CRL_free,sk_pop_free,	3_2_110AE190
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110021C0 CRYPTO_set_locked_mem_ex_functions,	3_2_110021C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B01D0 CMS_encrypt,CMS_EnvelopedData_create,ERR_put_error,sk_num,sk_value,CMS_add1_recipient_cert,sk_num,CMS_set_detached,CMS_final,CMS_ContentInfo_free,ERR_put_error,CMS_ContentInfo_free,	3_2_110B01D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B41E0 X509_get_serialNumber,RAND_bytes,EVP_EncryptUpdate,EVP_EncryptUpdate,	3_2_110B41E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C01E0 ERR_set_mark,CRYPTO_lock,lh_retrieve,sk_value,sk_value,CRYPTO_lock,ERR_pop_to_mark,	3_2_110C01E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110041F0 CRYPTO_lock,sk_num,sk_num,CRYPTO_set_ex_data,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_set_ex_data,CRYPTO_free,	3_2_110041F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110821F0 CRYPTO_free,sk_num,sk_new_null,sk_num,sk_value,sk_new_null,sk_push,ASN1_item_new,OBJ_dup,sk_push,sk_num,CRYPTO_malloc,sk_free,ASN1_item_free,sk_pop_free,	3_2_110821F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020000 BF_encrypt,	3_2_11020000
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11070000 EVP_CipherInit_ex,EVP_CIPHER_CTX_cleanup,ENGINE_init,ERR_put_error,ENGINE_get_cipher_engine,ENGINE_get_cipher,CRYPTO_malloc,ERR_put_error,EVP_CIPHER_CTX_ctrl,ERR_put_error,OpenSSLDie,EVP_CIPHER_CTX_flags,ERR_put_error,EVP_CIPHER_CTX_flags,EVP_CIPHER_CTX_flags,X509_get_issuer_name,OpenSSLDie,X509_get_issuer_name,X509_get_issuer_name,X509_get_issuer_name,	3_2_11070000
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BC010 PKCS12_decrypt_skey,	3_2_110BC010
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11044030 RSA_up_ref,CRYPTO_add_lock,	3_2_11044030
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107E030 ASN1_dup,CRYPTO_malloc,ERR_put_error,CRYPTO_free,	3_2_1107E030
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AE050 CMS_add1_crl,CMS_add0_RevocationInfoChoice,CRYPTO_add_lock,	3_2_110AE050
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E060 RC2_cfb64_encrypt,RC2_encrypt,RC2_encrypt,	3_2_1101E060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11044060 RSA_get_ex_new_index,CRYPTO_get_ex_new_index,	3_2_11044060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106E060 OBJ_obj2txt,OBJ_obj2nid,OBJ_nid2ln,OBJ_nid2sn,BUF_strlcpy,BN_add_word,BN_new,BN_set_word,BN_lshift,BN_sub_word,BN_bn2dec,BUF_strlcpy,CRYPTO_free,BIO_snprintf,BUF_strlcpy,BN_free,BN_free,	3_2_1106E060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106C060 ERR_add_error_vdata,CRYPTO_malloc,CRYPTO_realloc,BUF_strlcat,ERR_set_error_data,CRYPTO_free,	3_2_1106C060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11096060 PEM_read_bio_Parameters,PEM_bytes_read_bio,EVP_PKEY_new,EVP_PKEY_set_type_str,EVP_PKEY_free,EVP_PKEY_free,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_11096060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BE060 OPENSSL_asc2uni,CRYPTO_malloc,	3_2_110BE060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11030070 CRYPTO_nistcts128_decrypt_block,CRYPTO_cbc128_decrypt,CRYPTO_cbc128_decrypt,	3_2_11030070
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11086070 ASN1_template_free,ASN1_primitive_free,asn1_get_choice_selector,asn1_get_field_ptr,ASN1_template_free,asn1_do_lock,asn1_enc_free,asn1_do_adb,asn1_get_field_ptr,ASN1_template_free,CRYPTO_free,	3_2_11086070
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11004080 CRYPTO_get_ex_data,sk_num,sk_value,	3_2_11004080
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110020A0 CRYPTO_set_mem_functions,OPENSSL_init,	3_2_110020A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110400A0 BN_GF2m_mod_sqr,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_sqr_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	3_2_110400A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AE0A0 CMS_get1_certs,OBJ_obj2nid,ERR_put_error,sk_num,sk_value,sk_new_null,sk_push,CRYPTO_add_lock,sk_num,X509_free,sk_pop_free,	3_2_110AE0A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110040B0 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,ERR_put_error,sk_num,sk_value,CRYPTO_free,	3_2_110040B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110440B0 RSA_memory_lock,CRYPTO_malloc_locked,ERR_put_error,BN_clear_free,	3_2_110440B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B40B0 X509_get_serialNumber,CRYPTO_malloc,EVP_DecryptUpdate,EVP_DecryptUpdate,EVP_DecryptUpdate,EVP_DecryptInit_ex,EVP_DecryptUpdate,OPENSSL_cleanse,CRYPTO_free,	3_2_110B40B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107E0C0 ASN1_item_dup,ASN1_item_i2d,ERR_put_error,ASN1_item_d2i,CRYPTO_free,	3_2_1107E0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107A0C0 EVP_PKEY_CTX_new,ENGINE_init,ERR_put_error,ENGINE_get_pkey_meth_engine,ENGINE_get_pkey_meth,EVP_PKEY_meth_find,CRYPTO_malloc,ENGINE_finish,ERR_put_error,CRYPTO_add_lock,EVP_PKEY_CTX_free,	3_2_1107A0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109E0C0 X509_STORE_free,CRYPTO_add_lock,sk_num,sk_value,CRYPTO_free,sk_num,sk_free,sk_pop_free,CRYPTO_free_ex_data,X509_VERIFY_PARAM_free,CRYPTO_free,	3_2_1109E0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B80D0 PKCS7_set_type,OBJ_nid2obj,PKCS7_SIGNED_new,ASN1_INTEGER_set,PKCS7_SIGNED_free,ASN1_STRING_type_new,PKCS7_SIGN_ENVELOPE_new,ASN1_INTEGER_set,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_ENVELOPE_new,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_ENCRYPT_new,ASN1_INTEGER_set,OBJ_nid2obj,PKCS7_DIGEST_new,ASN1_INTEGER_set,ERR_put_error,	3_2_110B80D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BE0E0 OPENSSL_uni2asc,CRYPTO_malloc,	3_2_110BE0E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002300 CRYPTO_get_locked_mem_functions,	3_2_11002300
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11022300 CAST_encrypt,	3_2_11022300
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11070300 EVP_EncryptInit_ex,EVP_CipherInit_ex,	3_2_11070300
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108A310 EVP_PKEY_asn1_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_1108A310
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AC310 CRYPTO_malloc,OBJ_obj2nid,sk_new,sk_push,sk_new_null,sk_push,CRYPTO_free,	3_2_110AC310
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11070330 EVP_DecryptInit_ex,EVP_CipherInit_ex,	3_2_11070330
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BE330 OBJ_obj2nid,PKCS8_decrypt,PKCS8_encrypt,PKCS8_PRIV_KEY_INFO_free,X509_SIG_free,	3_2_110BE330
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002340 CRYPTO_get_locked_mem_ex_functions,	3_2_11002340
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B2340 ERR_put_error,EVP_PKEY_CTX_new,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_ctrl,ERR_put_error,EVP_PKEY_decrypt,CRYPTO_malloc,ERR_put_error,EVP_PKEY_decrypt,ERR_put_error,OPENSSL_cleanse,CRYPTO_free,EVP_PKEY_CTX_free,CRYPTO_free,	3_2_110B2340
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11090350 ASN1_const_check_infinite_end,asn1_const_Finish,CRYPTO_free,ASN1_STRING_free,BUF_MEM_grow_clean,ASN1_STRING_free,CRYPTO_free,	3_2_11090350
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11066360 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,	3_2_11066360
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002370 CRYPTO_get_mem_debug_functions,	3_2_11002370
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106C370 ERR_load_ERR_strings,CRYPTO_lock,CRYPTO_lock,	3_2_1106C370
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11004380 CRYPTO_lock,sk_num,CRYPTO_malloc,sk_value,CRYPTO_lock,CRYPTO_lock,sk_value,CRYPTO_lock,sk_num,sk_value,CRYPTO_free,sk_free,	3_2_11004380
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11070380 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_cleanup,CRYPTO_free,	3_2_11070380
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B83C0 PKCS7_add_certificate,OBJ_obj2nid,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_add_lock,sk_push,X509_free,	3_2_110B83C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110023D0 CRYPTO_malloc_locked,	3_2_110023D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110303E0 CRYPTO_nistcts128_decrypt,	3_2_110303E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AC3E0 ASN1_OBJECT_free,POLICYQUALINFO_free,sk_pop_free,ASN1_OBJECT_free,sk_pop_free,CRYPTO_free,	3_2_110AC3E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103E3F0 BN_RECP_CTX_new,CRYPTO_malloc,BN_init,BN_init,	3_2_1103E3F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110843F0 X509_ocspid_print,BIO_printf,i2d_X509_NAME,CRYPTO_malloc,i2d_X509_NAME,EVP_sha1,EVP_Digest,BIO_printf,CRYPTO_free,BIO_printf,EVP_sha1,EVP_Digest,BIO_printf,BIO_printf,CRYPTO_free,	3_2_110843F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002200 CRYPTO_set_mem_debug_functions,OPENSSL_init,	3_2_11002200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11018200 DES_cfb_encrypt,DES_encrypt1,DES_encrypt1,	3_2_11018200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11044200 RSA_sign,ERR_put_error,OBJ_nid2obj,ERR_put_error,ERR_put_error,i2d_X509_SIG,RSA_size,ERR_put_error,CRYPTO_malloc,ERR_put_error,i2d_X509_SIG,RSA_private_encrypt,OPENSSL_cleanse,CRYPTO_free,	3_2_11044200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032210 CRYPTO_ccm128_encrypt_ccm64,_memset,	3_2_11032210
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107A220 EVP_PKEY_CTX_dup,ENGINE_init,ERR_put_error,CRYPTO_malloc,CRYPTO_add_lock,CRYPTO_add_lock,EVP_PKEY_CTX_free,	3_2_1107A220
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109C220 X509_STORE_CTX_init,X509_VERIFY_PARAM_new,ERR_put_error,X509_VERIFY_PARAM_inherit,X509_VERIFY_PARAM_lookup,X509_VERIFY_PARAM_inherit,CRYPTO_new_ex_data,ERR_put_error,X509_STORE_CTX_cleanup,	3_2_1109C220
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11022230 CAST_ecb_encrypt,CAST_encrypt,CAST_decrypt,	3_2_11022230
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11066240 BIO_get_host_ip,ERR_put_error,BIO_sock_init,CRYPTO_lock,gethostbyname,ERR_put_error,ERR_put_error,CRYPTO_lock,ERR_add_error_data,	3_2_11066240
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002250 CRYPTO_get_mem_functions,	3_2_11002250
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E250 RC2_ofb64_encrypt,RC2_encrypt,	3_2_1101E250
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109E250 X509_OBJECT_up_ref_count,CRYPTO_add_lock,CRYPTO_add_lock,	3_2_1109E250
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A2260 OBJ_txt2obj,ERR_put_error,ERR_add_error_data,string_to_hex,ERR_put_error,ERR_add_error_data,ASN1_STRING_type_new,ERR_put_error,X509_EXTENSION_create_by_OBJ,ASN1_OBJECT_free,ASN1_STRING_free,CRYPTO_free,	3_2_110A2260
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107C270 ASN1_BIT_STRING_set_bit,CRYPTO_malloc,CRYPTO_realloc_clean,ERR_put_error,_memset,	3_2_1107C270
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110022B0 CRYPTO_get_mem_ex_functions,	3_2_110022B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B42B0 EVP_CIPHER_CTX_init,ERR_put_error,OBJ_obj2nid,d2i_X509_ALGOR,OBJ_obj2nid,OBJ_nid2sn,EVP_get_cipherbyname,ERR_put_error,EVP_CipherInit_ex,EVP_CIPHER_CTX_set_padding,EVP_CIPHER_asn1_to_param,ERR_put_error,EVP_PBE_CipherInit,ERR_put_error,X509_get_serialNumber,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,ERR_put_error,EVP_CIPHER_CTX_cleanup,CRYPTO_free,X509_ALGOR_free,ERR_put_error,	3_2_110B42B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110302D0 CRYPTO_cts128_decrypt,	3_2_110302D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110A42D0 BUF_strndup,ASN1_STRING_to_UTF8,BUF_strndup,CRYPTO_free,	3_2_110A42D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110962E0 PEM_read_bio_DHparams,PEM_bytes_read_bio,d2i_DHxparams,d2i_DHparams,ERR_put_error,CRYPTO_free,CRYPTO_free,	3_2_110962E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11004510 ERR_load_CRYPTO_strings,ERR_func_error_string,ERR_load_strings,ERR_load_strings,	3_2_11004510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002510 CRYPTO_strdup,CRYPTO_malloc,	3_2_11002510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11030510 CRYPTO_cfb128_encrypt,	3_2_11030510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11036520 BN_clear_free,OPENSSL_cleanse,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,	3_2_11036520
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B8520 PKCS7_SIGNER_INFO_set,ASN1_INTEGER_set,X509_get_issuer_name,X509_NAME_set,ASN1_STRING_free,X509_get_serialNumber,ASN1_STRING_dup,CRYPTO_add_lock,pqueue_peek,OBJ_nid2obj,X509_ALGOR_set0,ERR_put_error,ERR_put_error,	3_2_110B8520
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002560 CRYPTO_realloc,CRYPTO_malloc,	3_2_11002560
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11038560 BN_bn2hex,CRYPTO_strdup,CRYPTO_malloc,ERR_put_error,	3_2_11038560
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11036580 BN_free,CRYPTO_free,CRYPTO_free,	3_2_11036580
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106C580 ERR_clear_error,ERR_get_state,CRYPTO_free,	3_2_1106C580
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11064590 CRYPTO_malloc,CRYPTO_realloc,	3_2_11064590
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1109E590 X509_STORE_get_by_subject,CRYPTO_lock,sk_value,CRYPTO_lock,sk_num,sk_value,sk_num,CRYPTO_add_lock,	3_2_1109E590
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106E5A0 OBJ_txt2obj,OBJ_sn2nid,OBJ_ln2nid,OBJ_nid2obj,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,	3_2_1106E5A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107E5A0 ASN1_i2d_bio,CRYPTO_malloc,ERR_put_error,BIO_write,BIO_write,CRYPTO_free,CRYPTO_free,	3_2_1107E5A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108C5B0 BIO_new_NDEF,CRYPTO_malloc,BIO_f_asn1,BIO_new,BIO_push,BIO_asn1_set_prefix,BIO_asn1_set_suffix,BIO_ctrl,BIO_free,CRYPTO_free,ERR_put_error,	3_2_1108C5B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110325C0 CRYPTO_ccm128_tag,	3_2_110325C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C05D0 ENGINE_load_ssl_client_cert,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,	3_2_110C05D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110025E0 CRYPTO_realloc_clean,CRYPTO_malloc,OPENSSL_cleanse,	3_2_110025E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110365E0 BN_new,CRYPTO_malloc,ERR_put_error,	3_2_110365E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108A400 EVP_PKEY_asn1_new,CRYPTO_malloc,_memset,BUF_strdup,BUF_strdup,EVP_PKEY_asn1_free,	3_2_1108A400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C0400 ENGINE_load_private_key,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,ERR_put_error,	3_2_110C0400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032410 CRYPTO_ccm128_decrypt_ccm64,_memset,	3_2_11032410
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11044410 i2d_X509_SIG,OPENSSL_cleanse,CRYPTO_free,	3_2_11044410
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020420 BF_decrypt,	3_2_11020420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110AC420 OBJ_dup,CRYPTO_malloc,sk_new_null,CRYPTO_free,ASN1_OBJECT_free,	3_2_110AC420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101C440 DES_fcrypt,_memset,DES_set_key_unchecked,	3_2_1101C440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103E440 BN_RECP_CTX_free,BN_free,BN_free,CRYPTO_free,	3_2_1103E440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002450 CRYPTO_free_locked,	3_2_11002450
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11070460 EVP_EncryptInit,_memset,EVP_CipherInit_ex,	3_2_11070460
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BA460 PKCS7_dataFinal,ERR_put_error,EVP_MD_CTX_init,OBJ_obj2nid,ASN1_STRING_type_new,sk_num,sk_value,OBJ_obj2nid,EVP_MD_CTX_copy_ex,sk_num,ASN1_STRING_type_new,OBJ_obj2nid,ASN1_STRING_free,OBJ_obj2nid,ASN1_STRING_free,EVP_PKEY_size,CRYPTO_malloc,EVP_SignFinal,ASN1_STRING_set0,sk_num,OBJ_obj2nid,EVP_DigestFinal_ex,ASN1_STRING_set,OBJ_obj2nid,PKCS7_ctrl,BIO_find_type,BIO_ctrl,BIO_set_flags,BIO_ctrl,ASN1_STRING_set0,ERR_put_error,EVP_MD_CTX_cleanup,	3_2_110BA460
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11096470 CRYPTO_malloc,BN_bin2bn,CRYPTO_free,	3_2_11096470
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B8470 PKCS7_add_crl,OBJ_obj2nid,ERR_put_error,sk_new_null,ERR_put_error,CRYPTO_add_lock,sk_push,X509_CRL_free,	3_2_110B8470
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002490 CRYPTO_malloc,	3_2_11002490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106C490 ERR_put_error,ERR_get_state,CRYPTO_free,	3_2_1106C490
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110704A0 EVP_DecryptInit,_memset,EVP_CipherInit_ex,	3_2_110704A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110444B0 RSA_size,ERR_put_error,RSA_public_decrypt,CRYPTO_malloc,ERR_put_error,ERR_put_error,RSA_public_decrypt,ERR_put_error,d2i_X509_SIG,ASN1_TYPE_get,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,EVP_MD_size,ERR_put_error,X509_SIG_free,OPENSSL_cleanse,CRYPTO_free,	3_2_110444B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110804C0 i2d_ASN1_TYPE,CRYPTO_malloc,i2d_ASN1_TYPE,CRYPTO_free,	3_2_110804C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108A4D0 EVP_PKEY_asn1_add_alias,CRYPTO_malloc,_memset,EVP_PKEY_asn1_add0,EVP_PKEY_asn1_free,	3_2_1108A4D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110C04E0 ENGINE_load_public_key,ERR_put_error,CRYPTO_lock,CRYPTO_lock,ERR_put_error,CRYPTO_lock,ERR_put_error,ERR_put_error,	3_2_110C04E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11090700 ASN1_STRING_TABLE_add,sk_new,ERR_put_error,ASN1_STRING_TABLE_get,CRYPTO_malloc,ERR_put_error,sk_push,	3_2_11090700
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002720 CRYPTO_set_mem_debug_options,	3_2_11002720
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102A720 Camellia_ctr128_encrypt,Camellia_encrypt,CRYPTO_ctr128_encrypt,	3_2_1102A720
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107A720 EVP_PKEY_encrypt,ERR_put_error,EVP_PKEY_size,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_1107A720
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002730 CRYPTO_get_mem_debug_options,	3_2_11002730
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11036730 bn_expand2,CRYPTO_free,	3_2_11036730
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11052730 EC_GROUP_free,BN_MONT_CTX_free,CRYPTO_free,BN_free,BN_free,CRYPTO_free,CRYPTO_free,	3_2_11052730
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002740 CRYPTO_free,	3_2_11002740
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11040740 BN_GF2m_mod_exp,BN_num_bits,CRYPTO_malloc,BN_GF2m_poly2arr,BN_GF2m_mod_exp_arr,CRYPTO_free,ERR_put_error,CRYPTO_free,	3_2_11040740
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106E750 OBJ_dup,ASN1_OBJECT_new,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	3_2_1106E750
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B0760 CMS_SignerInfo_set1_signer_cert,CRYPTO_add_lock,EVP_PKEY_free,X509_get_pubkey,X509_free,	3_2_110B0760
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11002770 CRYPTO_mem_ctrl,CRYPTO_lock,CRYPTO_THREADID_current,CRYPTO_THREADID_cmp,CRYPTO_lock,CRYPTO_lock,CRYPTO_lock,CRYPTO_THREADID_cpy,CRYPTO_lock,CRYPTO_lock,	3_2_11002770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11058770 i2d_ECPrivateKey,ASN1_item_new,ERR_put_error,BN_num_bits,EC_GROUP_get_degree,ERR_put_error,CRYPTO_malloc,BN_bn2bin,_memset,ASN1_STRING_set,ERR_put_error,CRYPTO_free,ASN1_item_free,ASN1_STRING_type_new,EC_POINT_point2oct,CRYPTO_realloc,EC_POINT_point2oct,ASN1_STRING_set,ERR_put_error,	3_2_11058770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1106A770 GetVersion,OPENSSL_isservice,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,GetObjectA,CRYPTO_malloc,GetDIBits,EVP_sha1,EVP_Digest,RAND_add,CRYPTO_free,DeleteObject,ReleaseDC,	3_2_1106A770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BE770 PKCS8_decrypt,PKCS8_PRIV_KEY_INFO_it,PKCS12_item_decrypt_d2i,	3_2_110BE770
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1108C790 sk_num,BIO_write,sk_value,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,BIO_puts,CRYPTO_free,BIO_puts,BIO_puts,sk_num,BIO_puts,	3_2_1108C790
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110BE7A0 PKCS8_encrypt,X509_SIG_new,PKCS5_pbe2_set,EVP_PBE_find,PKCS5_pbe2_set_iv,ERR_clear_error,PKCS5_pbe_set,X509_ALGOR_free,ASN1_STRING_free,PKCS8_PRIV_KEY_INFO_it,PKCS12_item_i2d_encrypt,ERR_put_error,X509_SIG_free,	3_2_110BE7A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110227B0 CAST_decrypt,	3_2_110227B0

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007AC45000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_749144a7-2

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Unpacked PE file: 2.2.rfusclient.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Unpacked PE file: 3.2.rutserv.exe.400000.0.unpack

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\EULA.rtf

Jump to behavior

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb0U source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\src\webmdshow\dll\webmdshow\Release\vp8decoder.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\src\webmdshow\dll\webmdshow\Release\vp8decoder.pdb u source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb \| source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11004950 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,		3_2_11004950
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D6D90 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,		3_2_110D6D90

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

3_2_1103C4F0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: connect.aimcosoftware.uk

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1793322618.00000000711E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1793322618.00000000711E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1793322618.00000000711E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1701582361.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1764765582.000000007EC9E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1716542972.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BF29000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.000000000044E000.00000020.00000001.01000000.00000005.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://madExcept.comU
Source: rutserv.exe, 00000007.00000002.2953125672.000000000971A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/5&
Source: rutserv.exe, 00000007.00000002.2953125672.000000000971A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/=&
Source: rutserv.exe, 00000007.00000002.2953125672.000000000971A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com/m%
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1793322618.00000000711E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1961729968.000000000168F000.00000002.00000001.01000000.00000006.sdmp, rutserv.exe, 00000003.00000000.1961729968.00000000015F0000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1701582361.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1764765582.000000007EC9E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1716542972.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BF29000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.000000000044E000.00000020.00000001.01000000.00000005.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1739571910.000000007C210000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade.ini
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1739571910.000000007C210000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade_beta.ini
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BEDA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1758312282.000000007CC27000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CC2C000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.0000000000CAE000.00000020.00000001.01000000.00000005.sdmp, rfusclient.exe, 00000002.00000003.1997747439.0000000002D8D000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000003.2015541607.0000000003384000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.000000000114D000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmp, rutserv.exe, 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.0000000004610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1862720704.0000000004D3B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1864126411.000000000463D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1679075237.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1793322618.00000000711E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.rfusclient.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: 00000000.00000002.1870500876.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remotemanipulator_9ec52153 Author: unknown
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, type: DROPPED	Matched rule: RemoteUtilitiesRAT RAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Memory allocated: 711E0000 page read and write

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

File deleted: C:\Windows\Temp\rutserv.madExcept

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11097120	3_2_11097120
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11019150	3_2_11019150
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F170	3_2_1101F170
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110311A0	3_2_110311A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110171B0	3_2_110171B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11005050	3_2_11005050
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023080	3_2_11023080
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110DB3B5	3_2_110DB3B5
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11027260	3_2_11027260
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11015280	3_2_11015280
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110252B0	3_2_110252B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E52D3	3_2_110E52D3
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103D510	3_2_1103D510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11019540	3_2_11019540
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023400	3_2_11023400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B9400	3_2_110B9400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031410	3_2_11031410
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11019440	3_2_11019440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110454F0	3_2_110454F0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11025730	3_2_11025730
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102F630	3_2_1102F630
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11049640	3_2_11049640
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F660	3_2_1101F660
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110196A0	3_2_110196A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110176D0	3_2_110176D0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11007940	3_2_11007940
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103D940	3_2_1103D940
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101B980	3_2_1101B980
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E59CB	3_2_110E59CB
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110339DD	3_2_110339DD
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11005820	3_2_11005820
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102D840	3_2_1102D840
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107B850	3_2_1107B850
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101F860	3_2_1101F860
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103F870	3_2_1103F870
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110238A0	3_2_110238A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110978B0	3_2_110978B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110178C0	3_2_110178C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11013B10	3_2_11013B10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11019B80	3_2_11019B80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101DB80	3_2_1101DB80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11007B90	3_2_11007B90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11025A00	3_2_11025A00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110DDA4F	3_2_110DDA4F
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11005AC0	3_2_11005AC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11017AE0	3_2_11017AE0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031D60	3_2_11031D60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11005C80	3_2_11005C80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031CA0	3_2_11031CA0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103DF80	3_2_1103DF80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11007FC0	3_2_11007FC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11031FC0	3_2_11031FC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11023E00	3_2_11023E00
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11024160	3_2_11024160
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D8170	3_2_110D8170
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020000	3_2_11020000
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E060	3_2_1101E060
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103E0C0	3_2_1103E0C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11022300	3_2_11022300
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11024370	3_2_11024370
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11018200	3_2_11018200
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032210	3_2_11032210
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103E240	3_2_1103E240
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E250	3_2_1101E250
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101A2A0	3_2_1101A2A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11030510	3_2_11030510
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11008560	3_2_11008560
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032410	3_2_11032410
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020420	3_2_11020420
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101C440	3_2_1101C440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E440	3_2_1101E440
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110227B0	3_2_110227B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102E600	3_2_1102E600
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032600	3_2_11032600
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101C630	3_2_1101C630
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11026906	3_2_11026906
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101E910	3_2_1101E910
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E6947	3_2_110E6947
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110329B0	3_2_110329B0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101A9C0	3_2_1101A9C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11018840	3_2_11018840
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E484B	3_2_110E484B
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102A8A0	3_2_1102A8A0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11030B10	3_2_11030B10
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101AB20	3_2_1101AB20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101CBF0	3_2_1101CBF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101AA2C	3_2_1101AA2C
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11016A40	3_2_11016A40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102CA5F	3_2_1102CA5F
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020A80	3_2_11020A80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11032AF0	3_2_11032AF0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1107ED20	3_2_1107ED20
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11044D30	3_2_11044D30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102CD70	3_2_1102CD70
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E4D8F	3_2_110E4D8F
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101CDC0	3_2_1101CDC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1101AC50	3_2_1101AC50
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11020C80	3_2_11020C80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11008C89	3_2_11008C89
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1102ACD0	3_2_1102ACD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11018F60	3_2_11018F60
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1103CF80	3_2_1103CF80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11026FA9	3_2_11026FA9
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11034FC0	3_2_11034FC0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11022E80	3_2_11022E80
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11036E90	3_2_11036E90
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_120392DD	3_2_120392DD
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203C373	3_2_1203C373
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1201E070	3_2_1201E070
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12014160	3_2_12014160
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12011180	3_2_12011180
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203B1F3	3_2_1203B1F3
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_120116DE	3_2_120116DE
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203B737	3_2_1203B737
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12012400	3_2_12012400
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_120114D8	3_2_120114D8
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12010B40	3_2_12010B40
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203DE92	3_2_1203DE92
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203BC7B	3_2_1203BC7B
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12002CB0	3_2_12002CB0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12010CD0	3_2_12010CD0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1200ED30	3_2_1200ED30
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12010DEB	3_2_12010DEB

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 11002490 appears 252 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 12031578 appears 72 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 11085F50 appears 110 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 12031884 appears 39 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 11086300 appears 106 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 12031E10 appears 149 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 110655A0 appears 135 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 11001DC0 appears 191 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 1106D440 appears 40 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 11061620 appears 34 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 110DC788 appears 46 times
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: String function: 110D1AB0 appears 626 times

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rfusclient.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: rutserv.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: rfusclient.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: rutserv.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 2.0.rfusclient.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: 00000000.00000002.1870500876.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remotemanipulator_9ec52153 reference_sample = 1dd15c830c0a159b53ed21b8c2ce1b7e8093256368d7b96c1347c6851ee6c4f6, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remotemanipulator, fingerprint = 02220e8af70ecffb3a7585f756c59ef5d9e17e6690c36d6bffc458e1d17dbd0c, id = 9ec52153-3b62-432d-b87c-895035df1a46, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, type: DROPPED	Matched rule: MALWARE_Win_RemoteUtilitiesRAT author = ditekSHen, description = RemoteUtilitiesRAT RAT payload, clamav_sig = MALWARE.Win.Trojan.RemoteUtilitiesRAT

Source: classification engine

Classification label: mal80.evad.winEXE@8/18@11/0

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 7_2_007F0104 LookupPrivilegeValueW,AdjustTokenPrivileges,

7_2_007F0104

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_1106A900 RAND_poll,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,RAND_add,FreeLibrary,GetVersion,OPENSSL_isservice,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,RAND_add,GetVersion,GetVersion,RAND_add,RAND_add,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,RAND_add,Heap32First,RAND_add,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,RAND_add,GetTickCount,GetTickCount,GetTickCount,RAND_add,GetTickCount,GetTickCount,RAND_add,GetTickCount,FindCloseChangeNotification,FreeLibrary,GlobalMemoryStatus,RAND_add,GetCurrentProcessId,RAND_add,

3_2_1106A900

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RManFUSTray
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$113c
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1578
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$8a4
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$113c
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$13dc
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$8a4
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$13dc

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

File created: C:\Users\user\AppData\Local\Temp\rfusclient.madExcept

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	ReversingLabs: Detection: 21%
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Virustotal: Detection: 18%

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	String found in binary or memory: marker-start
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	String found in binary or memory: step-start

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe "C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" -run_agent
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent -second
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" /tray /user
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" -run_agent	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" /tray /user	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Window found: window name: TComboBox

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Static file information: File size 17159792 > 1048576

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x1be000
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xe9d200

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb0U source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\src\webmdshow\dll\webmdshow\Release\vp8decoder.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\src\webmdshow\dll\webmdshow\Release\vp8decoder.pdb u source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb \| source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Unpacked PE file: 2.2.rfusclient.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Unpacked PE file: 3.2.rutserv.exe.400000.0.unpack

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: webmvorbisdecoder.dll.0.dr	Static PE information: section name: _RDATA
Source: webmvorbisencoder.dll.0.dr	Static PE information: section name: _RDATA
Source: eventmsg.dll.0.dr	Static PE information: section name: .didata
Source: rfusclient.exe.0.dr	Static PE information: section name: .didata
Source: rutserv.exe.0.dr	Static PE information: section name: .didata
Source: vp8decoder.dll.0.dr	Static PE information: section name: .rodata
Source: vp8encoder.dll.0.dr	Static PE information: section name: .rodata

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110DC7CD push ecx; ret	3_2_110DC7E0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1200C428 push esi; ret	3_2_1200C429
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12035511 push ecx; ret	3_2_12035524
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 7_2_004FCA40 push esp; retf 004Fh	7_2_004FCABE
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 7_2_004FC9FC push esp; retf 004Fh	7_2_004FC9FD

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

File created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\EULA.rtf

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Usoris\Remote Utilities\Host\Parameters General

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	System information queried: FirmwareTableInformation	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1758312282.000000007CB10000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000E01000.00000020.00000001.01000000.00000006.sdmp	Binary or memory string: OLLYDBG.EXE
Source: rutserv.exe, 00000003.00000002.2023988409.0000000001703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE#
Source: rutserv.exe, 00000003.00000002.2023988409.0000000001703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEES
Source: rutserv.exe, 00000003.00000002.2023988409.0000000001703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE5

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_11004DE0 rdtsc

3_2_11004DE0

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Window / User API: threadDelayed 1469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Window / User API: threadDelayed 5679	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Window / User API: threadDelayed 9510	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

API coverage: 0.3 %

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe TID: 3804	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe TID: 2896	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe TID: 6308	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe TID: 3804	Thread sleep time: -5679000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe TID: 6356	Thread sleep time: -4755000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11004950 OPENSSL_DIR_read,_malloc,_memset,_malloc,FindFirstFileA,FindNextFileA,_strncpy,		3_2_11004950
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D6D90 __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,		3_2_110D6D90

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: rfusclient.exe, 00000002.00000003.1999313844.0000000001253000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rfusclient.exe, 00000002.00000003.1999313844.0000000001253000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yz

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_11004DE0 rdtsc

3_2_11004DE0

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_110D94B7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_110D94B7

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_110E0AD4 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

3_2_110E0AD4

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D94B7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_110D94B7
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110D2132 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_110D2132
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110E2EE7 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_110E2EE7
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_120322D4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_120322D4
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1203537C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_1203537C
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_12032CE0 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_12032CE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" -run_agent			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Process created: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe "C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent			Jump to behavior

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1705967540.000000007E83E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1716542972.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWndTrayNotifyWndSV

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_11004C00 cpuid

3_2_11004C00

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: GetLocaleInfoA,		3_2_110E45E3
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: GetLocaleInfoA,		3_2_1203DC44

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 7_2_009C5BAC CreateNamedPipeW,ConnectNamedPipe,

7_2_009C5BAC

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_110E15FE GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_110E15FE

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Code function: 3_2_110DE271 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

3_2_110DE271

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

3_2_1106A900

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1758312282.000000007CB10000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000E01000.00000020.00000001.01000000.00000006.sdmp

Binary or memory string: OLLYDBG.EXE

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Blob

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104D140 DSO_bind_var,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_1104D140
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_1104D1C0 DSO_bind_func,ERR_put_error,ERR_put_error,ERR_put_error,	3_2_1104D1C0
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_11066360 BIO_get_accept_socket,BIO_sock_init,BUF_strdup,DSO_global_lookup,DSO_global_lookup,BIO_get_port,htons,BIO_get_host_ip,htonl,socket,setsockopt,bind,WSAGetLastError,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,ERR_put_error,ERR_add_error_data,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_add_error_data,ERR_put_error,CRYPTO_free,closesocket,	3_2_11066360
Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	Code function: 3_2_110B6C80 NCONF_get_string,ERR_clear_error,DSO_load,DSO_bind_func,DSO_bind_func,DSO_free,ERR_put_error,ERR_add_error_data,	3_2_110B6C80

Source: Yara match	File source: 2.0.rfusclient.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.1961729968.000000000168F000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1810927214.000000007AC45000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1854271083.0000000000EF3000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1961729968.00000000015F0000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rfusclient.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rutserv.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	13 Process Injection	1 Modify Registry	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	351 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Virtualization/Sandbox Evasion	NTDS	111 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Deobfuscate/Decode Files or Information	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Obfuscated Files or Information	Proc Filesystem	54 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Software Packing	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 File Deletion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	21%	ReversingLabs
SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll	2%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	8%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe	12%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	11%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe	13%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\ssleay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\ssleay32.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.openssl.org/V	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://update.remoteutilities.net/upgrade.ini	0%	Virustotal		Browse
http://madExcept.comU	0%	Avira URL Cloud	safe
http://rmansys.ru/internet-id/	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade.ini	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade_beta.ini	0%	Avira URL Cloud	safe
http://rmansys.ru/internet-id/	2%	Virustotal		Browse
http://update.remoteutilities.net/upgrade_beta.ini	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
connect.aimcosoftware.uk	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp	false	URL Reputation: safe	unknown
http://update.remoteutilities.net/upgrade_beta.ini	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1739571910.000000007C210000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.indyproject.org/	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1758312282.000000007CC27000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1726715891.000000007CC2C000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.0000000000CAE000.00000020.00000001.01000000.00000005.sdmp, rfusclient.exe, 00000002.00000003.1997747439.0000000002D8D000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000003.2015541607.0000000003384000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.000000000114D000.00000020.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/V	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmp, rutserv.exe, 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://rmansys.ru/internet-id/	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1961729968.000000000168F000.00000002.00000001.01000000.00000006.sdmp, rutserv.exe, 00000003.00000000.1961729968.00000000015F0000.00000002.00000001.01000000.00000006.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://madExcept.comU	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1701582361.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1764765582.000000007EC9E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1716542972.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BF29000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.000000000044E000.00000020.00000001.01000000.00000005.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1697640507.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1701582361.000000007FAB0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1764765582.000000007EC9E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1716542972.000000007EDF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1733158326.000000007BF29000.00000004.00001000.00020000.00000000.sdmp, rfusclient.exe, 00000002.00000000.1823854216.000000000044E000.00000020.00000001.01000000.00000005.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	URL Reputation: safe	unknown
http://update.remoteutilities.net/upgrade.ini	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1739571910.000000007C210000.00000004.00001000.00020000.00000000.sdmp, rutserv.exe, 00000003.00000000.1890695085.0000000000401000.00000020.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446957
Start date and time:	2024-05-24 05:26:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@8/18@11/0
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, PID 6956 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:27:32	API Interceptor	672569x Sleep call for process: rutserv.exe modified
23:27:42	API Interceptor	37239x Sleep call for process: rfusclient.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://birchflarechurch.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	nF54KOU30R.exe	Get hash	malicious	RHADAMANTHYS	Browse	192.229.221.95
	https://url.au.m.mimecastprotect.com/s/uuv2CgZowrsOpyOOc26VTV?domain=in.xero.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://shop.ketochow.xyz/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://in.xero.com/7hv8mDuF13K6MICiXjOmyJk92EdbNVBSqtgAvYsV	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://cctv.hotmail.cloudns.org/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://toenpocket.pro/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://wuyouo.cn/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pub-f99e2b2dafd440acb935db5a40c7576b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll	Xd7BQ3JgRO.exe	Get hash	malicious	RMSRemoteAdmin, GuLoader	Browse
	3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities, DanaBot, PrivateLoader	Browse
	3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities, DanaBot, PrivateLoader	Browse
	pL3fPdWbRl.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	94E4D5FCC31FC37AA29B3D042BC2C0295B66592F33730.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	3677833).exe	Get hash	malicious	RMSRemoteAdmin Remote Utilities	Browse
	w89kTa93Aw.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	2828.pdf.exe	Get hash	malicious	RMSRemoteAdmin Remote Utilities	Browse
	2828.pdf.exe	Get hash	malicious	RMSRemoteAdmin Remote Utilities	Browse
	NWBVeupdvT.exe	Get hash	malicious	RMSRemoteAdmin	Browse
C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll	host-7.1.7.0.msi	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	BB4B88DA25E06B8DAF7CD814F772849F0E28A1C8EBA92.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	BB4B88DA25E06B8DAF7CD814F772849F0E28A1C8EBA92.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	host7.1.6.0.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	host7.1.6.0.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities, DanaBot, PrivateLoader	Browse
	3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities, DanaBot, PrivateLoader	Browse
	www.remoteutilities.com/download/host7.1.5.0.exe	Get hash	malicious	RMSRemoteAdmin, Remote Utilities	Browse
	http://www.remoteutilities.com/download/host7.1.5.0.exe	Get hash	malicious	RMSRemoteAdmin, PlayCrypt	Browse
	pL3fPdWbRl.exe	Get hash	malicious	RMSRemoteAdmin	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\EULA.rtf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	71372
Entropy (8bit):	5.162652802737552
Encrypted:	false
SSDEEP:	768:D//N2WF2Fn+MZXfpCjFwMVVKJeW/j6yfjdRZxDBJYinhFnDnlnSnAn9zSkqf/Bsn:D3N2AQFFYirDlSA9zSl/Bs19
MD5:	E6B99144EA133A583F2964FDAA0C514A
SHA1:	A9AB6B4AD60BD60C798E9909BE801DAD725497DE
SHA-256:	B137E38FACDD1CDFC9730856675F4B531366D7AF54B605209CB2158A58DEB1EF
SHA-512:	A4F6E9663163E7A85251E129983251698B2C98070D2044F6402804D92779D77E477CB63C703B72A6EA20E19FC0D443A2A4F7FCF9D181A1E0EF0C0276297BF072
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f43\fbidi \fnil\fcharset0\fprq2{\\panose 00000000000000000000}Lucida Grande{\\falt Segoe UI};}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\\falt Times New Roman};}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman{\*\f

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52984
Entropy (8bit):	6.450596759872685
Encrypted:	false
SSDEEP:	768:tsmrWdCS5PvBHOUYTKJgr0OMpqdBwFrGjYdhXdsn:tza/pu/TKJ/OMpTryYvan
MD5:	CA8A4346B37CDD0220792885C5937B30
SHA1:	EEF05F4B7FB5F8AABFB93D10A6451CC77B489864
SHA-256:	CCD5B9E5947F956E880BD2285A6091DC9F1EE9B0EB8DF627EC4E72B451A1C745
SHA-512:	C286B0FA9D24A85FE63D3A3D801F135D12409736742C4FC16BA1DC15529DF136577DC8975736146437DD56467576FDEDB4AC50CF05AB054547504F3DC5CA0C35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: host-7.1.7.0.msi, Detection: malicious, Browse Filename: BB4B88DA25E06B8DAF7CD814F772849F0E28A1C8EBA92.exe, Detection: malicious, Browse Filename: BB4B88DA25E06B8DAF7CD814F772849F0E28A1C8EBA92.exe, Detection: malicious, Browse Filename: host7.1.6.0.exe, Detection: malicious, Browse Filename: host7.1.6.0.exe, Detection: malicious, Browse Filename: 3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe, Detection: malicious, Browse Filename: 3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: pL3fPdWbRl.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...q.7`.....................$...................@..........................`....................................... ..q............P.......................@..................................................................$....................text............................... ..`.itext.............................. ..`.data...<...........................@....bss.....5...............................idata..............................@....didata.$...........................@....edata..q.... ......................@..@.rdata..E....0......................@..@.reloc.......@......................@..B.rsrc........P......................@..@.............`......................@..@........................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1377016
Entropy (8bit):	6.8566450434786255
Encrypted:	false
SSDEEP:	24576:nD8B+KpPexB6mqwktXUcAVEaFQXhL0porIqo+FrzbN:EKkmlktXUcAVEDhQporIqo+FrzbN
MD5:	0D51927274281007657C7F3E0DF7BECB
SHA1:	6DE3746D9D0980F5715CEC6C676A8EB53B5EFC49
SHA-256:	DFC847405BE60C29E86E3E3222E7F63C1FF584727D87D3C35C25C4893E19FDA0
SHA-512:	EEF74088A94635184192D82BB6DCC0758749CB290C8DEEFF211881E8A280AEC73A53334EFF8846DF618204B0F318E757EAB23E76951A472BA6E086905000D9A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Xd7BQ3JgRO.exe, Detection: malicious, Browse Filename: 3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe, Detection: malicious, Browse Filename: 3F74BCC813857A11F0E885138C64A809CDF21100074F4.exe, Detection: malicious, Browse Filename: pL3fPdWbRl.exe, Detection: malicious, Browse Filename: 94E4D5FCC31FC37AA29B3D042BC2C0295B66592F33730.exe, Detection: malicious, Browse Filename: 3677833).exe, Detection: malicious, Browse Filename: w89kTa93Aw.exe, Detection: malicious, Browse Filename: 2828.pdf.exe, Detection: malicious, Browse Filename: 2828.pdf.exe, Detection: malicious, Browse Filename: NWBVeupdvT.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b7.j&V.9&V.9&V.9/..9.V.9/..9=V.9&V.9.V.9...9-V.9&V.93V.9/..9.T.9/..9'V.9/..9'V.9/..9'V.9Rich&V.9................PE..L.....,Y...........!.....\..................p...............................P.......[..................................r.......x.......0.......................P...pr..............................p...@............p..(............................text....[.......\.................. ..`.rdata...X...p...Z...`..............@..@.data...........t..................@....rsrc...0...........................@..@.reloc..............4..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11781368
Entropy (8bit):	6.797648364031984
Encrypted:	false
SSDEEP:	196608:P7Lmc33S6HGGLbt/ouGp3ueqS9w73g95qjBjuW:jLm23DtdBSIIJ50Bj3
MD5:	43CC976800C506662C325478EB8BF9EA
SHA1:	6D18795469C3A0AC6E4B8BB0024FFFBA51C45C60
SHA-256:	41EA3C0B8421EBDEA1EB6A508A38E120B1FBB38B9A2E1379DEABC5A167A87408
SHA-512:	396A97698A815316B1BD1B927F089C1D4934EA9FB8B31BE72941E46030059978F98866CC19C5DAF36722D5A768AF007434C875DE53B3F3AB9497B6A2BCD9DD54
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 12%, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....J.`....................."(..... .............@.................................y...........@.............................~V.......S............................................................................ ....0..xr...................text...,;.......<.................. ..`.itext...C...P...D...@.............. ..`.data....i.......j..................@....bss....p................................idata..~V......X.................@....didata.xr...0...t...F..............@....edata..............................@..@.tls....h................................rdata..]..........................@..@.reloc..............................@..B.rsrc....S.......T...R..............@..@...................................@..@................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18831608
Entropy (8bit):	6.576120573360384
Encrypted:	false
SSDEEP:	393216:jwoZwIhy4ksLov8EkBK8vEJ9Gf5Lf2e1Q:XAlCYmQ
MD5:	6C6BA57BE4B7B2FB661A99FEA872F6B8
SHA1:	AA95F1662A80E2C31FC24E60A9168B6DF93C42E7
SHA-256:	CE5BA1E5D70D95D52B89A1B8278FF8DD4D1E25C38C90CA202B43BDC014795D78
SHA-512:	15D89D9B89BF585ACEF483212C3E0CD37EE5C680E03D5E4E9F6AE73E058E5ECE0FF6E52DF36F695A2AED20C5115E1B1AB6EB6AFA580E7349D4871AD4C079C37F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 11% Antivirus: Virustotal, Detection: 13%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....I.`.................,....I......H.......P....@...........................+......Q ..........@...................@.......`...\......(.1..........:.......p.. ............................`.......................o..........B\|...................text............................... ..`.itext...x.......z.................. ..`.data...(....P.......0..............@....bss....P....`...........................idata...\...`...^...2..............@....didata.B\|.......~..................@....edata.......@......................@..@.tls....h....P...........................rdata..]....`......................@..@.reloc.. ....p...0..................@..B.rsrc...(.1.......1..B..............@..@.....................V..............@..@................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\settings.dat

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (2897), with CRLF line terminators
Category:	dropped
Size (bytes):	7215
Entropy (8bit):	5.559983873696286
Encrypted:	false
SSDEEP:	192:Gus2dIK9mfb/jCVmvPIKOQndWAtH0CS+5V:VOCGI295V
MD5:	9747762406E1F1708107C6377B2EE6F8
SHA1:	C4D2CF11E3D2A2AED7A2E3D08BAAD370820E81D8
SHA-256:	A02F875CDEE319D72C187F14D9861E6825155097B5396137E7C8964A01BF7989
SHA-512:	310BE62D38D6D035587F7884F97D10A9388105732960CC5F5377EBB155F1403E206554E48EF09B50C275AD334A3723BAAA00C56D5E04C09D5885F3DEBEED12C2
Malicious:	false
Preview:	.General=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxnZW5lcmFsX3NldHRpbmdzIHZlcnNpb249IjcwMDIwIj48cG9ydD41NjUwPC9wb3J0PjxoaWRlX3RyYXlfaWNvbl9wb3B1cF9tZW51PmZhbHNlPC9oaWRlX3RyYXlfaWNvbl9wb3B1cF9tZW51Pjx0cmF5X21lbnVfaGlkZV9zdG9wPmZhbHNlPC90cmF5X21lbnVfaGlkZV9zdG9wPjxsYW5ndWFnZT5FbmdsaXNoPC9sYW5ndWFnZT48Y2FsbGJhY2tfYXV0b19jb25uZWN0PnRydWU8L2NhbGxiYWNrX2F1dG9fY29ubmVjdD48Y2FsbGJhY2tfY29ubmVjdF9pbnRlcnZhbD42MDwvY2FsbGJhY2tfY29ubmVjdF9pbnRlcnZhbD48cGFzc3dvcmRfZGF0YT48L3Bhc3N3b3JkX2RhdGE+PHByb3RlY3RfY2FsbGJhY2tfc2V0dGluZ3M+ZmFsc2U8L3Byb3RlY3RfY2FsbGJhY2tfc2V0dGluZ3M+PHByb3RlY3RfaW5ldF9pZF9zZXR0aW5ncz5mYWxzZTwvcHJvdGVjdF9pbmV0X2lkX3NldHRpbmdzPjx1c2VfbGVnYWN5X2NhcHR1cmU+ZmFsc2U8L3VzZV9sZWdhY3lfY2FwdHVyZT48ZG9fbm90X2NhcHR1cmVfcmRwPmZhbHNlPC9kb19ub3RfY2FwdHVyZV9yZHA+PHVzZV9pcF92XzY+dHJ1ZTwvdXNlX2lwX3ZfNj48bG9nX3VzZT50cnVlPC9sb2dfdXNlPjxsb2dfdXNlX3dpbmRvd3M+ZmFsc2U8L2xvZ191c2Vfd2luZG93cz48Y2hhdF9jbGllbnRfc2V0dGluZ3M+PC9jaGF0X2NsaWVudF9zZXR0aW5ncz48YXV0aF9rZXlfc3RyaW5nPjwvYXV0aF9rZ

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\ssleay32.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345336
Entropy (8bit):	6.557003324106128
Encrypted:	false
SSDEEP:	6144:IEXfWSXFKIsrpivdM+kPsmWak8dfthPDP0wrE90k7DUT/NaDB7JlwScihgbX5/Gd:IEXfWSVKIsrpivdM+msmWak8dfnPDPPG
MD5:	197DA919E4C91125656BF905877C9B5A
SHA1:	9574EC3E87BB0F7ACCE72D4D59D176296741AA83
SHA-256:	303C78ABA3B776472C245F17020F9AA5A53F09A6F6C1E4F34B8E18E33906B5EE
SHA-512:	33C1B853181F83CAB2F57F47FB7E093BADF83963613E7328EBD23F0D62F59416D7A93063C6237435FBB6833A69BC44EBBC13AA585DA010F491C680B2EA335C47
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.......r.......r......r......r...s.6.r....\.r.......r......r......r.Rich..r.................PE..L.....,Y...........!.........l......Y3...............................................S..............................0....).....<....0..0............&.......@...,..0...............................0...@............................................text...Z........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	389368
Entropy (8bit):	6.640121600715051
Encrypted:	false
SSDEEP:	6144:lIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcS:lI8tiDOzyH9H8Tu6h04fZMZoMPuvfC
MD5:	41ACD8B6D9D80A61F2F686850E3D676A
SHA1:	38428A08915CF72DD2ECA25B3D87613D9AA027DD
SHA-256:	36993FC3312CE757C8ADECA3E5969E1FCC11D5B51B12C458BA8D54D73B64D4E7
SHA-512:	D174638965EC781CBCB2927CEAFB295C3176DC78DA8938467FACA3E512A42FE71A9DC1070F23E1C95F0B7C157FFF3B00A8B572C39E4670713564F1310360ED23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g......"............#.O...T8.....T8..................T8.....'....................Rich............................PE..L...v..T...........!..... ...........2.......0.....................................................................@q.......q...................................(...1..8............................U..@............0...............................text............ .................. ..`.rdata...J...0...L...$..............@..@.data...H>...........p..............@....rodata.............................@..@.rsrc...............................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641208
Entropy (8bit):	6.686845258578782
Encrypted:	false
SSDEEP:	49152:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwz:mSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSN
MD5:	2AC39D6990170CA37A735F2F15F970E8
SHA1:	8148A9CDC6B3FE6492281EBAD79636433A6064AB
SHA-256:	0961D83CB25E1A50D5C0EC2F9FB0D17F2504DAE0B22A865F6E1EA8E987E1C6FA
SHA-512:	7E30FDE909D5F8EFD6C2E40E125525697267273163AC35CF53561A2BD32E5DAD8E4FBA32905F53E422C9C73B8AD9A0C151F8D36042C5F156B50BF42DC21A9CEE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:J<A[$oA[$oA[$o...o@[$o...o.[$o...op[$o...o.[$o...oC[$o...oL[$oA[%o.[$oA[$op[$o...o@[$oL..o.[$oL..o@[$oL..o@[$oL..o@[$oRichA[$o................PE..L...}..T...........!.........>.......*..............................................A$......................................(............7.............................................................@............................................text............................... ..`.rdata..............................@..@.data...$r......."..................@....rodata.............................@..@.rsrc....7.......8...0..............@..@.reloc..............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266488
Entropy (8bit):	6.521389859829101
Encrypted:	false
SSDEEP:	3072:xW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTY:xWSfr7sXSmPDbKPJ6/AsNk+S
MD5:	8A683F90A78778FBA037565588A6F752
SHA1:	011939C1FA7B73272DB340C32386A13E140ADC6A
SHA-256:	BD520007864B44E0BDA7A466384D12C3C3F328326CF3549BA1853A58CCDBC99D
SHA-512:	9280FBB121F8B94F57560D1BE3BCFE5E7C308D54DAC278F13EA6C00256444FB9F17F543DD0D32C9844460818C1A50D83B26CE51C79698E9CA7A304652A3F5EA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@~..!..!..!...p...!...p..!...p..+!..M...!..M...!..!...!..M...!..s..!..s..!..s..!..s..!..Rich.!..................PE..L...{..T...........!.........N.......k.......................................0......MP......................................4...x................................/..................................Ha..@...............l............................text............................... ..`.rdata..v...........................@..@.data....B......."..................@....rsrc...............................@..@.reloc.../.......0..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374008
Entropy (8bit):	6.770650269193578
Encrypted:	false
SSDEEP:	6144:RaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtL:loPH0GgEp0gVd1ValsQXsHL
MD5:	C9D412C1D30ABB9D61151A10371F4140
SHA1:	87120FAA6B859F5E23F7344F9547B2FC228AF15B
SHA-256:	F3465CE8A23DB5E8228EED5A60A6F7A096D1A9ADF3012C39BC6D81D4E57E8E9E
SHA-512:	1C020AFA89CDAE55F4DCB80A455DC1B352F40455142F3947ED29C3E3D51FBD465B6E0EA16CD103186C252783A3F2A7F7C417E4DF5727D9B2DB511B650308FACE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Mm..,...,...,...}...,...}...,...}...,.......,.......,...,..,.......,...~...,...~...,...~...,...~...,..Rich.,..........................PE..L...t..T...........!................b....................................................@..........................M......@N..d.......0.......................d&..................................p/..@...............T............................text...=........................... ..`.rdata...E.......F..................@..@.data...\|<...`.......H..............@..._RDATA...............d..............@..@.rsrc...0............j..............@..@.reloc..d&.......(...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	880888
Entropy (8bit):	5.240956834094615
Encrypted:	false
SSDEEP:	12288:vTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRN1:YYF+Eyx2lzujtEIYRc1cQmsGa7ON1
MD5:	A59F69797C42324540E26C7C7998C18C
SHA1:	7F7BC5BC62A8744F87A7D2E30CC6DD74C72E19B4
SHA-256:	83E1C1EB55BFD0F2D85D41C1E4DEE65046B064CCB263EC7F412A5F329C75CFD1
SHA-512:	837F244E6B70658974506AC35BD3EE2D413B89FE4B26E75F4A61CC7BEC63E999C9C2CFFB690AD567F74962BAB13F2F5471300CD0E0CFE61BB1084072CB55C38B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A....u...u...u..C$G.3u..C$y.Iu..C$x..u...V..u...S..u...u..ju...H..u...'}.&u...'D..u...'C..u...'F..u..Rich.u..........................PE..L...s..T...........!.........R..............0............................................@.........................`...........d....P..p............R.......`...D......................................@............0..T............................text...}........................... ..`.rdata.......0......."..............@..@.data...\|<..........................@..._RDATA.......@......................@..@.rsrc...p....P......................@..@.reloc...D...`...F..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remote Utilities Agent\Logs\rut_log_2024-05.html

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	HTML document, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	7040
Entropy (8bit):	5.3948198645088
Encrypted:	false
SSDEEP:	96:dr0xccoJxML6RLidRLiN1jgPMSjeccwpevJZ:NzcWS6pidpi3gljecNp+Z
MD5:	077665AA830984AC26A423842E139FEF
SHA1:	36C1AEB73AAC00E26EF0230B644D0B6A49589D9A
SHA-256:	F877862D798D2A9AFFECCF9FA9BDD01FB0C418930FE76FE0FFB57CB96E0B66F6
SHA-512:	DD58B9FEA06748713638243BC2557C9CDEFAA1F1A0867DA6642FD70F59C8CF04426DB05E369DDF8500BD7DD4A272912AF0594F7C73C2049F1F0B238455D8DE00
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>Remote Utilities – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = par

C:\Users\user\AppData\Roaming\Remote Utilities Agent\Logs\rut_log_2024-07.html

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	HTML document, ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	5.332716644075702
Encrypted:	false
SSDEEP:	48:SporoU8xNqcoYERDML6RLi7rNRLigbwSKGkdglP:dr0xccoJxML6RLidRLiN1jglP
MD5:	7D7D2B15E2FAD0030BA856851790E05B
SHA1:	95899B02D891992662D3C7B1A622B71F238FC364
SHA-256:	728B6C0BEDA3ED560BC8E824AAA403079D563351F0DAF71BF849B2458EF62150
SHA-512:	2FCFDEBE7064B42D07A8225E3C4A89FBC4A2805602435609FDC15CD698D868F0473493E58C59D304B69DE97BE6B15BD017E4DC19D1582052B75595A641719D19
Malicious:	false
Preview:	<head>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="copyright" content="TektonIT" />.<meta name="description" content="Remote Manipulator System - Server software, event log. Tektonit.com" />.<title>Remote Utilities – host log</title>.<style type="text/css">.body {.font-family: Courier New, monospace;.font-size: 100%;.background-color: #FFFFFF;.} .h1 {.font-size: 130%;.margin: 0px 0px 0px 0px;.} .textarea {.display: none;.margin-top: 5px;.width: 100%;.} ..main_table td {.border: 1px dashed #DADADA;.} ..e_l_0 {.background-color: #4c4cff;.border: 1px solid red;.} ..e_l_1 {.background-color: #fff04c;.border: none;.} ..e_l_2 {.background-color: #ffa94c;.border: none;.} ..e_l_3 {.background-color: #fc2727;.border: none;.} .#log_header td {.font-weight: bold;.} .#subheader {.font-size: 70%;.color: #DADADA;.margin-bottom: 10px;.} .</style>.<script language="javascript">.function show_textarea(elem) {.var parent_node = elem.parentNode;.var nodes = par

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	471
Entropy (8bit):	7.201311094781459
Encrypted:	false
SSDEEP:	12:JY0+nc5FZPLnAOkgwtqf/cbqi4fJbcJ4Bdt8sk:JY0wc3Zr/Wtc/SGRbcJ4tk
MD5:	41C80F6FF995EC3FC024FD1B8C59D151
SHA1:	786EF05FA8E6B21CA172CD11C56C0555C019B1DF
SHA-256:	13EB6F4B726E67EF373E0E582496DA2C63F0555C1BB06B05E404D6213CA0352F
SHA-512:	22C24BDAF881B5F12AE68C0038A3155325CB28A20C2FB627D413FDAD93852034387F010104381304415DCCE4AA0AD22303B5A82B6D035F982C0D8198EA5B659C
Malicious:	false
Preview:	0..........0.....+.....0......0...0.......>.i...G..&....cd+...20240522183033Z0s0q0I0...+...........(..A..B..G@B.X....>.i...G..&....cd+......_:....x...G\....20240522183033Z....20240529183033Z0...*.H..............4.M...._.k.->DK..\....:...........1.6q\kN..Q...).b....HU).x......t..fa'^.).>C..~..GJ.6...MX.d^.....'.]:...?;..g..S.8..39#]....K@.j+......f....fci.....,..D....o.?3}......,....@9L...=......= T.....fEBq...8r..r.$....G.....C.!..{.......%_..P._.3

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	471
Entropy (8bit):	7.23592156518836
Encrypted:	false
SSDEEP:	12:Jk67X5tXGbG+85o6xjNqz922mEoQiYBeqD/be47aYULKq:JksXnXGebxjYz92bszDafZ
MD5:	7F8644D4D1B430E71CD849A6D5CD87BB
SHA1:	58D6E3097ACF568C5A41EB8996814A64C732F4BE
SHA-256:	9EBBDAFC5C157F57A0A406A8DA0458E2279C809FFE91B78E551EADB531E8AEE8
SHA-512:	57122BC083E2FAAD3D8496B9606816CFEA91B6B8E3C268DAE7AF61EF487E8A476CC717528886C4EC8B818173CAA93C948DFDD37E54CCA318C01DF5D558C99452
Malicious:	false
Preview:	0..........0.....+.....0......0...0........~.m2j..#.p.j:..k....20240523173016Z0s0q0I0...+.........._..YIn..]M[.m<W+......~.m2j..#.p.j:..k.....0 .<.}.A.s....20240523171502Z....20240530161502Z0....H..............K.......D4u.n+..d.H.3!.we..Hv{...m..5.H..K.cz<.uU.E1..uh..`A<j..(.....b.G.&.jFZ.=.M..Gv6...,3..9.O...-...\.h..[......O<.X..X~....."...q*.nc......r.[eC..Jm..F.<....%.!..l$v./..vP..^........j.v..oV..y..;...n..;y3.=...t..=..\a+.g..L.J<..#..h>...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.000520600646062
Encrypted:	false
SSDEEP:	6:kKy/IKQ73XlRNfOAUMivhClroFn1cgvVJuIuAQbDUFwGQlhzksqZcKTYXDaMlrn:Kw1mxMiv8sF1JbqDkwJrmYTaMlr
MD5:	1C535243527A42D4F2D06F916BE09F62
SHA1:	322893D0B82DA2A3F93CD24448F7F48BBA9C41BF
SHA-256:	3F83B6068CB3DB2E470B0B57D7BCE4ADF811088A676CDEE09D878CAE64016315
SHA-512:	1A00A4B30FE66EB43CF5A97C0B594B0B1FDCEE6F0449998D7FE958A0AF951F32D98E31E420ECB1F51DE8095DFE9560EA3F4D6ADE9ADD6ECFAD8D68BA33566BDE
Malicious:	false
Preview:	p...... .............(................*.!v....jsJ.....................jsJ.... ..........H.... ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.T.f.q.h.L.j.K.L.E.J.Q.Z.P.i.n.0.K.C.z.k.d.A.Q.p.V.Y.o.w.Q.U.s.T.7.D.a.Q.P.4.v.0.c.B.1.J.g.m.G.g.g.C.7.2.N.k.K.8.M.C.E.A.P.x.t.O.F.f.O.o.L.x.F.J.Z.4.s.9.f.Y.R.1.w.%.3.D...

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F

Download File

Process:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
File Type:	data
Category:	dropped
Size (bytes):	408
Entropy (8bit):	3.9347845494128886
Encrypted:	false
SSDEEP:	6:kKOeki2hbDtXlRNfOAUMivhClroFH9Sux2Zl1Ylketl8QciTamW5N8slD0Wlrn:pZ2RmxMiv8sFQo+YlyWy5vOWlr
MD5:	3F5687321770133FA7637CE8E43A5D54
SHA1:	959FB9AD836D5B4EF295ACC8E7978818990A99F1
SHA-256:	6FDF6639FAF92561A675B8CD4CA11EB6B73BD70481165DB347C252B083033CFE
SHA-512:	DAB9C95907D16813BD2524F487F8EF945F32640BC7BD763F5F4A486D669F24F871F7526AA80201FFAAEC211B4BBB6C12A1B0F893E4481A980A784B00940420E1
Malicious:	false
Preview:	p...... ....$....O......(................/I.4.....i.......................i..... .........Q..... ...................h.t.t.p.:././.o.c.s.p...d.i.g.i.c.e.r.t...c.o.m./.M.F.E.w.T.z.B.N.M.E.s.w.S.T.A.J.B.g.U.r.D.g.M.C.G.g.U.A.B.B.S.P.w.l.%.2.B.r.B.F.l.J.b.v.z.L.X.U.1.b.G.W.0.8.V.y.s.J.2.w.Q.U.j.%.2.B.h.%.2.B.8.G.0.y.a.g.A.F.I.8.d.w.l.2.o.6.k.P.9.r.6.t.Q.C.E.A.g.w.I.O.s.8.8.K.C.v.f.b.1.B.4.r.J.z.6.K.k.%.3.D...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.975339537408599
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
File size:	17'159'792 bytes
MD5:	2d49a6ce2ee81dc16d23b3a820ee87e0
SHA1:	d0b2dab654a86a302c1a051c950b76c15ece69b1
SHA256:	b50cf4ce1fbaa5ba67035c538d49b8a39f1c1f976bfde8ee1f4ee040c6d42591
SHA512:	c4e2d5459315035df1f60117b03c8289c63b5d8c34bb4c23566b77a38fcd2c4d0967351c5f425839123f2bb4d030a4b6d14236610b066306028c2dda31e5359a
SSDEEP:	393216:lfdu0pZ+MHgn6ttNkJI/Jt7RRfONkopbgbGq/jF8I6RLj:lFPpZ+MH5ttxRtVlONLp0yLj
TLSH:	C1073326F7E58814C4FA8EBF4DBD0B141727BC996923578C0369B02D9C3734299A93DB
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2deab2caccc34f38

Static PE Info

General

Entrypoint:	0x1987ce0
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x60934A40 [Thu May 6 01:45:36 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	38be718d163809a15e0c7a672311fe41

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	A certificate was explicitly revoked by its issuer
Error Number:	-2146762484
Not Before, Not After	18/08/2020 01:00:00 19/08/2022 00:59:59
Subject Chain	CN=Remote Utilities LLC, O=Remote Utilities LLC, STREET="d. 29 E 12 pom. I K 5 RM 5, prospekt Vernadskogo", L=Moscow, S=Moskovskaya oblast, PostalCode=119331, C=RU
Version:	3
Thumbprint MD5:	BC4B31F57F2C4D009A90E3F517FAC9D3
Thumbprint SHA-1:	835AB7CAEF9A43CED9B5F86969B8DCBCC1DC2E5E
Thumbprint SHA-256:	CAE7C89D5C445A4D774E14192FBCC6BB80658F183CEC22DA8146317446C33628
Serial:	00AAB0E5906AFEAD7B956937974D8016EF

Entrypoint Preview

Instruction
pushad
mov esi, 017CA000h
lea edi, dword ptr [esi-013C9000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F92CCF75C92h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F92CCF75C6Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F92CCF75C8Dh
jne 00007F92CCF75CAAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F92CCF75CA1h
dec eax
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F92CCF75C56h
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F92CCF75CD4h
xor ecx, ecx
sub eax, 03h
jc 00007F92CCF75C93h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F92CCF75CF7h
sar eax, 1
mov ebp, eax
jmp 00007F92CCF75C8Dh
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F92CCF75C4Eh
inc ecx
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F92CCF75C40h
add ebx, ebx
jne 00007F92CCF75C89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F92CCF75C71h
jne 00007F92CCF75C8Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F92CCF75C66h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x660000	0x9e	UPX0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2424e74	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1588000	0xe9ce74	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x105b600	0x2070	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1587e8c	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x659000	0x68e2	UPX0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x13c9000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x13ca000	0x1be000	0x1be000	4e5427f9106009e3d7952802734baeb5	False	0.9805169212443946	data	7.917567297744889	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1588000	0xe9e000	0xe9d200	dee405250ebd69728ea0df09c48c2a12	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
UNICODEDATA	0x15891b0	0x968f	data			0.3783566406351348
UNICODEDATA	0x1592844	0x9ebb	data			0.4321889996308601
UNICODEDATA	0x159c704	0x8d6	data			0.5919540229885057
UNICODEDATA	0x159cfe0	0xb4bc	data			0.41804270770294805
UNICODEDATA	0x15a84a0	0xd91e	data			0.44955201324169697
UNICODEDATA	0x15b5dc4	0x2035	OpenPGP Secret Key			0.6761673741661614
RT_CURSOR	0x15b7e00	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x15b7f38	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x15b8070	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x15b81a8	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x15b82e0	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x15b8418	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x15b8550	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x15b8688	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.061392283338757875
RT_ICON	0x15fa6b4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.0993877913166923
RT_ICON	0x160aee0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.18049792531120332
RT_ICON	0x160d48c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2910412757973734
RT_ICON	0x160e538	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.35860655737704916
RT_ICON	0x160eec4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3377659574468085
RT_STRING	0x160f330	0x40	AmigaOS bitmap font "P", 18944 elements, 2nd, 3rd			0.609375
RT_STRING	0x160f374	0x39c	data			0.4155844155844156
RT_STRING	0x160f714	0x474	data			0.37280701754385964
RT_STRING	0x160fb8c	0xb44	data			0.24653259361997226
RT_STRING	0x16106d4	0x8bc	data			0.2826475849731664
RT_STRING	0x1610f94	0x884	data			0.11192660550458716
RT_STRING	0x161181c	0x860	data			0.13712686567164178
RT_STRING	0x1612080	0x84c	data			0.1548964218455744
RT_STRING	0x16128d0	0x7e8	data			0.1590909090909091
RT_STRING	0x16130bc	0x9a8	data			0.12135922330097088
RT_STRING	0x1613a68	0x984	data			0.12397372742200329
RT_STRING	0x16143f0	0x500	data			0.32578125
RT_STRING	0x16148f4	0x2b4	data			0.4682080924855491
RT_STRING	0x1614bac	0x328	data			0.4158415841584158
RT_STRING	0x1614ed8	0x3a0	data			0.35129310344827586
RT_STRING	0x161527c	0x32c	data			0.4248768472906404
RT_STRING	0x16155ac	0x450	data			0.34148550724637683
RT_STRING	0x1615a00	0x2c0	data			0.3991477272727273
RT_STRING	0x1615cc4	0x418	data			0.3998091603053435
RT_STRING	0x16160e0	0x9c	data			0.717948717948718
RT_STRING	0x1616180	0xe8	data			0.6293103448275862
RT_STRING	0x161626c	0x364	data			0.423963133640553
RT_STRING	0x16165d4	0x3f8	data			0.375
RT_STRING	0x16169d0	0x364	data			0.39055299539170507
RT_STRING	0x1616d38	0x528	data			0.3212121212121212
RT_STRING	0x1617264	0x31c	data			0.34673366834170855
RT_STRING	0x1617584	0x358	data			0.39953271028037385
RT_STRING	0x16178e0	0x388	data			0.4081858407079646
RT_STRING	0x1617c6c	0x528	data			0.3886363636363636
RT_STRING	0x1618198	0x4ec	data			0.3055555555555556
RT_STRING	0x1618688	0x38c	data			0.3964757709251101
RT_STRING	0x1618a18	0x3b8	data			0.328781512605042
RT_STRING	0x1618dd4	0x40c	data			0.3735521235521235
RT_STRING	0x16191e4	0xf4	data			0.5491803278688525
RT_STRING	0x16192dc	0xc4	data			0.6275510204081632
RT_STRING	0x16193a4	0x268	data			0.48863636363636365
RT_STRING	0x1619610	0x434	data			0.3308550185873606
RT_STRING	0x1619a48	0x360	data			0.3912037037037037
RT_STRING	0x1619dac	0x2dc	data			0.3770491803278688
RT_STRING	0x161a08c	0x318	data			0.33080808080808083
RT_RCDATA	0x161a3a8	0x10	data			1.5
RT_RCDATA	0x161a3bc	0x14	data			1.3
RT_RCDATA	0x161a3d4	0x233	Zip archive data, at least v2.0 to extract, compression method=deflate	English	United States	0.9680284191829485
RT_RCDATA	0x161a60c	0x148b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0020916524054002
RT_RCDATA	0x161ba9c	0x111e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0025102692834322
RT_RCDATA	0x161cbc0	0xd8c	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
RT_RCDATA	0x161d950	0x1238	data			0.49421097770154376
RT_RCDATA	0x161eb8c	0x2	data	English	United States	5.0
RT_RCDATA	0x161eb94	0xe04480	data			1.0003108978271484
RT_RCDATA	0x2423018	0x4c	data			0.8026315789473685
RT_RCDATA	0x2423068	0x2	data			5.0
RT_RCDATA	0x2423070	0x1326	Delphi compiled form 'TfmInfo'			0.9330885352917176
RT_GROUP_CURSOR	0x242439c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x24243b4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x24243cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x24243e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x24243fc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x2424414	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x242442c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x2424444	0x5a	data	English	United States	0.7777777777777778
RT_VERSION	0x24244a4	0x318	data	English	United States	0.44191919191919193
RT_MANIFEST	0x24247c0	0x6b4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41083916083916083

Imports

DLL	Import
advapi32.dll	RegLoadKeyW
comctl32.dll	ImageList_Add
gdi32.dll	Pie
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
msvcrt.dll	memcpy
netapi32.dll	NetWkstaGetInfo
ole32.dll	IsEqualGUID
oleaut32.dll	VariantInit
shell32.dll	ShellExecuteW
SHFolder.dll	SHGetFolderPathW
user32.dll	GetDC
version.dll	VerQueryValueW
winmm.dll	timeGetTime
winspool.drv	ClosePrinter

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 05:27:41.356553078 CEST	63279	53	192.168.2.4	1.1.1.1
May 24, 2024 05:27:41.392759085 CEST	53	63279	1.1.1.1	192.168.2.4
May 24, 2024 05:27:49.538980007 CEST	58930	53	192.168.2.4	1.1.1.1
May 24, 2024 05:27:49.576235056 CEST	53	58930	1.1.1.1	192.168.2.4
May 24, 2024 05:27:57.413999081 CEST	49377	53	192.168.2.4	1.1.1.1
May 24, 2024 05:27:57.447706938 CEST	53	49377	1.1.1.1	192.168.2.4
May 24, 2024 05:28:06.774674892 CEST	56140	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:06.816879034 CEST	53	56140	1.1.1.1	192.168.2.4
May 24, 2024 05:28:14.726553917 CEST	64944	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:14.814999104 CEST	53	64944	1.1.1.1	192.168.2.4
May 24, 2024 05:28:22.685846090 CEST	62331	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:22.735415936 CEST	53	62331	1.1.1.1	192.168.2.4
May 24, 2024 05:28:30.790188074 CEST	50528	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:30.829719067 CEST	53	50528	1.1.1.1	192.168.2.4
May 24, 2024 05:28:38.766292095 CEST	52870	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:38.808314085 CEST	53	52870	1.1.1.1	192.168.2.4
May 24, 2024 05:28:46.851929903 CEST	54827	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:46.889132977 CEST	53	54827	1.1.1.1	192.168.2.4
May 24, 2024 05:28:54.731851101 CEST	54243	53	192.168.2.4	1.1.1.1
May 24, 2024 05:28:54.770593882 CEST	53	54243	1.1.1.1	192.168.2.4
May 24, 2024 05:29:09.492136955 CEST	61794	53	192.168.2.4	1.1.1.1
May 24, 2024 05:29:09.512351036 CEST	53	61794	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 05:27:41.356553078 CEST	192.168.2.4	1.1.1.1	0xf0bd	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:27:49.538980007 CEST	192.168.2.4	1.1.1.1	0x8e2a	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:27:57.413999081 CEST	192.168.2.4	1.1.1.1	0xa456	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:06.774674892 CEST	192.168.2.4	1.1.1.1	0x873f	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:14.726553917 CEST	192.168.2.4	1.1.1.1	0x23fa	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:22.685846090 CEST	192.168.2.4	1.1.1.1	0xe8cc	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:30.790188074 CEST	192.168.2.4	1.1.1.1	0xcf9e	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:38.766292095 CEST	192.168.2.4	1.1.1.1	0xe7bb	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:46.851929903 CEST	192.168.2.4	1.1.1.1	0xb2fc	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:28:54.731851101 CEST	192.168.2.4	1.1.1.1	0x22f1	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false
May 24, 2024 05:29:09.492136955 CEST	192.168.2.4	1.1.1.1	0xfe6a	Standard query (0)	connect.aimcosoftware.uk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 05:27:15.788244963 CEST	1.1.1.1	192.168.2.4	0x63cf	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 05:27:15.788244963 CEST	1.1.1.1	192.168.2.4	0x63cf	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 05:27:29.509247065 CEST	1.1.1.1	192.168.2.4	0xcf60	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 05:27:29.509247065 CEST	1.1.1.1	192.168.2.4	0xcf60	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	23:26:56
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe"
Imagebase:	0x400000
File size:	17'159'792 bytes
MD5 hash:	2D49A6CE2EE81DC16D23B3A820EE87E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000000.00000003.1810927214.000000007AC45000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000000.00000003.1683688639.000000007FD6A000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000000.00000003.1726715891.000000007CDDF000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remotemanipulator_9ec52153, Description: unknown, Source: 00000000.00000002.1870500876.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:27:14
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" -run_agent
Imagebase:	0x400000
File size:	11'781'368 bytes
MD5 hash:	43CC976800C506662C325478EB8BF9EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000002.00000000.1854271083.0000000000EF3000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe, Author: ditekSHen
Antivirus matches:	Detection: 8%, ReversingLabs Detection: 12%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:27:21
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent
Imagebase:	0x400000
File size:	18'831'608 bytes
MD5 hash:	6C6BA57BE4B7B2FB661A99FEA872F6B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000003.00000000.1961729968.000000000168F000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000003.00000000.1961729968.00000000015F0000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, Author: Joe Security Rule: MALWARE_Win_RemoteUtilitiesRAT, Description: RemoteUtilitiesRAT RAT payload, Source: C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe, Author: ditekSHen
Antivirus matches:	Detection: 11%, ReversingLabs Detection: 13%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:27:33
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe" -run_agent -second
Imagebase:	0x400000
File size:	18'831'608 bytes
MD5 hash:	6C6BA57BE4B7B2FB661A99FEA872F6B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:27:39
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe" /tray /user
Imagebase:	0x5f0000
File size:	11'781'368 bytes
MD5 hash:	43CC976800C506662C325478EB8BF9EA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.1%
Total number of Nodes:	244
Total number of Limit Nodes:	21

Executed Functions

Function 1106A900 Relevance: 159.9, APIs: 64, Strings: 27, Instructions: 603
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ADVAPI32.DLL,FB4B3DBC), ref: 1106A965
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 1106A96F
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 1106A97B
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 1106A99E
GetProcAddress.KERNEL32(00000000,NetApiBufferFree), ref: 1106A9A9
RAND_add.LIBEAY32(?,000000D8), ref: 1106A9F0
RAND_add.LIBEAY32(?,00000044), ref: 1106AA2E
FreeLibrary.KERNEL32(00000000), ref: 1106AA42
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 1106AA57
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 1106AA62
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 1106AA6D
RAND_add.LIBEAY32(?,00000040), ref: 1106AAD4
Heap32First.KERNEL32(?,?,?), ref: 1106AE1F
RAND_add.LIBEAY32(?,?), ref: 1106AE52
Heap32Next.KERNEL32(?), ref: 1106AE61
GetTickCount.KERNEL32 ref: 1106AE6E
Heap32ListNext.KERNEL32(?,?), ref: 1106AEB0
GetTickCount.KERNEL32 ref: 1106AEBD
GetTickCount.KERNEL32 ref: 1106AEE7
Process32First.KERNEL32(?,?), ref: 1106AEF8
RAND_add.LIBEAY32(?,?), ref: 1106AF26
GetTickCount.KERNEL32 ref: 1106AF45
GetTickCount.KERNEL32 ref: 1106AF67
RAND_add.LIBEAY32(?,?), ref: 1106AFA9
GetTickCount.KERNEL32 ref: 1106AFC9
GetTickCount.KERNEL32 ref: 1106AFE4
RAND_add.LIBEAY32(?,00000040), ref: 1106AB31

Part of subcall function 1106A520: ENGINE_get_default_RAND.LIBEAY32(00000000,11038E29,?,00000008), ref: 1106A52A
Part of subcall function 1106A520: TS_TST_INFO_get_nonce.LIBEAY32(00000000,00000000,11038E29,?,00000008), ref: 1106A536
Part of subcall function 1106A520: ENGINE_finish.LIBEAY32(00000000,00000008), ref: 1106A548
Part of subcall function 1106A520: RAND_SSLeay.LIBEAY32(00000000,11038E29,?,00000008), ref: 1106A550

FreeLibrary.KERNEL32(?), ref: 1106AB53
GetVersion.KERNEL32 ref: 1106AB59
OPENSSL_isservice.LIBEAY32 ref: 1106AB66
LoadLibraryA.KERNEL32(USER32.DLL), ref: 1106AB78
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 1106AB8E
GetProcAddress.KERNEL32(00000000,GetCursorInfo), ref: 1106AB99
GetProcAddress.KERNEL32(00000000,GetQueueStatus), ref: 1106ABA4
RAND_add.LIBEAY32(?,00000004), ref: 1106ABCA
GetVersion.KERNEL32 ref: 1106ABD8
GetVersion.KERNEL32 ref: 1106ABE5
RAND_add.LIBEAY32(?,?), ref: 1106AC22
RAND_add.LIBEAY32(?,00000004), ref: 1106AC50
FreeLibrary.KERNEL32(00000000), ref: 1106AC59
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 1106AC74
GetProcAddress.KERNEL32(00000000,CloseToolhelp32Snapshot), ref: 1106AC7E
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 1106AC89
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 1106AC94
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 1106AC9F
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 1106ACAA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 1106ACB5
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 1106ACC0
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 1106ACCB
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 1106ACD6
GetProcAddress.KERNEL32(00000000,Module32First), ref: 1106ACE1
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 1106ACEC
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 1106AD60
GetTickCount.KERNEL32 ref: 1106AD88
Heap32ListFirst.KERNEL32(?,?), ref: 1106AD99
RAND_add.LIBEAY32(?,?), ref: 1106ADCB

Strings

NetStatisticsGet, xrefs: 1106A998
Intel Hardware Cryptographic Service Provider, xrefs: 1106AAF0
Module32First, xrefs: 1106ACDB
LanmanServer, xrefs: 1106AA07
NETAPI32.DLL, xrefs: 1106A976
Thread32First, xrefs: 1106ACC5
USER32.DLL, xrefs: 1106AB73
GetCursorInfo, xrefs: 1106AB93
CryptGenRandom, xrefs: 1106AA5C
CryptReleaseContext, xrefs: 1106AA67
CloseToolhelp32Snapshot, xrefs: 1106AC78
Heap32First, xrefs: 1106AC83
LanmanWorkstation, xrefs: 1106A9C6
Heap32ListFirst, xrefs: 1106AC99
GetForegroundWindow, xrefs: 1106AB88
Process32Next, xrefs: 1106ACBA
Heap32ListNext, xrefs: 1106ACA4
Module32Next, xrefs: 1106ACE6
Process32First, xrefs: 1106ACAF
Heap32Next, xrefs: 1106AC8E
NetApiBufferFree, xrefs: 1106A9A3
ADVAPI32.DLL, xrefs: 1106A95A
CreateToolhelp32Snapshot, xrefs: 1106AC6E
GetQueueStatus, xrefs: 1106AB9E
CryptAcquireContextW, xrefs: 1106AA4E
KERNEL32.DLL, xrefs: 1106A96A
Thread32Next, xrefs: 1106ACD0

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: AddressProc$D_add$CountTick$Library$Heap32Load$FirstFreeVersion$ListNext$CreateE_finishE_get_default_L_isserviceLeayO_get_nonceProcess32SnapshotToolhelp32
String ID: ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 3196546149-2556708411
Opcode ID: 7a5f0157966d81529787fe4494373d96266094a4f586f4fa8c2ba77cd707473d
Instruction ID: c16aa8565bbba2c0d6a7ccc7e4fe83e0b0f805d41468ac9f0f6c14887989fba0
Opcode Fuzzy Hash: 7a5f0157966d81529787fe4494373d96266094a4f586f4fa8c2ba77cd707473d
Instruction Fuzzy Hash: 5B3237B5D00319EBEB10EFE5CD84BEEBBF8AF08704F00455AF515A6280EB759984CB61

Function 11002690 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70e6ee2eebd712565080eb3fb12d1455e80324ecb16f362a66327c8163f991e
Instruction ID: 8a1c772791e188c4bf48f6b73112c2c73a4ebecf3f74dd624863cab6c969db95
Opcode Fuzzy Hash: a70e6ee2eebd712565080eb3fb12d1455e80324ecb16f362a66327c8163f991e
Instruction Fuzzy Hash: 56E0C231A8033167FA00A694DC82F8A76C82F04F96F490060F914E2284D798E39186BA

Function 110D2BFE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 110D2C1C

Part of subcall function 110DC735: __mtinitlocknum.LIBCMT ref: 110DC74B
Part of subcall function 110DC735: __amsg_exit.LIBCMT ref: 110DC757
Part of subcall function 110DC735: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,110E2BF3,00000004,11120730,0000000C,110DD096,000000FF,00000000,00000000,00000000,00000000,?,110DAE14,00000001), ref: 110DC75F

___sbh_find_block.LIBCMT ref: 110D2C27
___sbh_free_block.LIBCMT ref: 110D2C36
RtlFreeHeap.NTDLL(00000000,000000FF,111200F0,0000000C,110DC716,00000000,111204E8,0000000C,110DC750,000000FF,-0000000F,?,110E2BF3,00000004,11120730,0000000C), ref: 110D2C66
GetLastError.KERNEL32(?,110E2BF3,00000004,11120730,0000000C,110DD096,000000FF,00000000,00000000,00000000,00000000,?,110DAE14,00000001,00000214), ref: 110D2C77

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: a9b85538557a8b0182eeb11ca8921269facb937cfa0c8c595d0f9202e0086786
Instruction ID: 4db212ab18399d6a48c30ed77fd74ec756c8cd5f0e8dbf8964952f816198e637
Opcode Fuzzy Hash: a9b85538557a8b0182eeb11ca8921269facb937cfa0c8c595d0f9202e0086786
Instruction Fuzzy Hash: 9301AD79C0531BEAEF20DFF19908B8E7BA4AF00778F605159E514AA080DB39A941CB94

Function 12037987 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,12033143,00000001,?,?,?,120332BC,?,?,?,12048C10,0000000C,12033377), ref: 1203799C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 8fac217aa9f652e8f54ec70a04afeef6d63efe9694f6380ccd52bae7a97805df
Instruction ID: fa2bebd2eb8dd9f09f644f1f711d426e6fd442087ec427e7255ec09bdc516330
Opcode Fuzzy Hash: 8fac217aa9f652e8f54ec70a04afeef6d63efe9694f6380ccd52bae7a97805df
Instruction Fuzzy Hash: D6D05E765953959EEB019E756948B663BDCA384395F004E36F81CC6144E670D541DA40

Function 110DD4AD Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,110D84CD,?), ref: 110DD4C2

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e7a10f738efb59f168740aa5a43f7f422e0a53fb314400fa8ec3f5d81fa0e8f4
Instruction ID: f2934614ab736667df920c683feaf04e1d80d459d981252a99872ac503af8591
Opcode Fuzzy Hash: e7a10f738efb59f168740aa5a43f7f422e0a53fb314400fa8ec3f5d81fa0e8f4
Instruction Fuzzy Hash: 19D02E32940304AEEB008E715C087AA3BDC9380A8CF008876F85CC6880F730D540CB40

Non-executed Functions

Function 12002CB0 Relevance: 148.1, APIs: 81, Strings: 3, Instructions: 1074COMMON

Download Yara Rule

APIs

RAND_bytes.LIBEAY32(?,00000030), ref: 12002E0A
RSA_private_decrypt.LIBEAY32(?,?,?,?,00000001), ref: 12002E28
ERR_clear_error.LIBEAY32 ref: 12002E32
OPENSSL_cleanse.LIBEAY32(?,00000030), ref: 12002FB3
ERR_put_error.LIBEAY32(00000014,0000008B,00000094,.\ssl\s3_srvr.c,00000938), ref: 12003047
ERR_put_error.LIBEAY32(00000014,0000008B,000000F9,.\ssl\s3_srvr.c,00000B99), ref: 12003AD4
EVP_PKEY_free.LIBEAY32(?), ref: 12003AED
EC_POINT_free.LIBEAY32(?,?), ref: 12003AF7
EC_KEY_free.LIBEAY32(?), ref: 12003B08
BN_CTX_free.LIBEAY32(?), ref: 12003B15

Strings

, xrefs: 12003926
0, xrefs: 12002DE5
.\ssl\s3_srvr.c, xrefs: 12002D55, 12002DC2, 12002DEF, 12002FCA, 1200300C, 12003036, 120030A3, 120030C1, 12003118, 12003150, 12003188, 1200324A, 120032F1, 12003341, 1200336E, 120033B0, 120033E6, 1200340E, 1200345A, 120034F2, 12003547, 12003572, 1200359F, 1200361C, 12003640, 12003700, 12003800, 1200382E, 120038E6, 12003906, 1200397B, 1200399C, 12003A89, 12003ABE

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorY_free$A_private_decryptD_bytesL_cleanseR_clear_errorT_freeX_free
String ID: $.\ssl\s3_srvr.c$0
API String ID: 4108830039-359311100
Opcode ID: ad88e76b24724980be90e15c0ccf6f5460026b74996b6e259ddbeada1ef2d12f
Instruction ID: 7531ca636828b0db3581c20b7b9bf61357cd51faad0d34d6b24b024fe96f8f26
Opcode Fuzzy Hash: ad88e76b24724980be90e15c0ccf6f5460026b74996b6e259ddbeada1ef2d12f
Instruction Fuzzy Hash: E9822277B44301AFF217DB20CC81FABB3E4AB49740F044B29FA855B282D771A505E7A6

Function 110BD0C0 Relevance: 65.1, APIs: 36, Strings: 1, Instructions: 374COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(00000000,?,?,00000000,?,110BD56C,?,?,?,?,?,?,?,?,?,?), ref: 110BD0D9
EVP_MD_block_size.LIBEAY32(?,00000000,?,?,00000000,?,110BD56C,?,?,?,?,?,?,?,?,?), ref: 110BD0E3
EVP_MD_size.LIBEAY32(?,?,00000000,?,?,00000000,?,110BD56C,?,?,?,?,?,?,?,?), ref: 110BD0EB

Part of subcall function 11077AD0: ERR_put_error.LIBEAY32(00000006,000000A2,0000009F,.\crypto\evp\evp_lib.c,00000139,1104474C,00000000), ref: 11077AEE

CRYPTO_malloc.LIBEAY32(00000000,.\crypto\pkcs12\p12_key.c,0000008D,?,?,?,?,00000001,?,00000000), ref: 110BD112
CRYPTO_malloc.LIBEAY32(00000000,.\crypto\pkcs12\p12_key.c,0000008E,00000000,.\crypto\pkcs12\p12_key.c,0000008D,?,?,?,?,00000001,?,00000000), ref: 110BD126
CRYPTO_malloc.LIBEAY32(00000001,.\crypto\pkcs12\p12_key.c,0000008F,00000000,.\crypto\pkcs12\p12_key.c,0000008E,00000000,.\crypto\pkcs12\p12_key.c,0000008D,?,?,?,?,00000001,?,00000000), ref: 110BD13D
CRYPTO_malloc.LIBEAY32(00000000,.\crypto\pkcs12\p12_key.c,00000096,?,?,?,?,?,?,?,?,?,?,?,?), ref: 110BD18B
BN_new.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 110BD197
BN_new.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 110BD1A0
_memset.LIBCMT ref: 110BD1E0
EVP_DigestInit_ex.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 110BD235

Strings

.\crypto\pkcs12\p12_key.c, xrefs: 110BD10C, 110BD11C, 110BD133, 110BD181, 110BD246

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_malloc$N_new$D_block_sizeD_sizeDigestInit_exR_put_errorX_init_memset
String ID: .\crypto\pkcs12\p12_key.c
API String ID: 1169939799-3219245189
Opcode ID: 9d6543fc8554aaec225a86d79408aaab11ab338c5ebe36195d904fea670b4925
Instruction ID: 62ca653ab9e1031838c84d44176710493737375c5c6e0c362d698c0bc086438c
Opcode Fuzzy Hash: 9d6543fc8554aaec225a86d79408aaab11ab338c5ebe36195d904fea670b4925
Instruction Fuzzy Hash: 6DC193BAE083425BD700CF648C81A6FF7E9ABD475CF04492DFA8597241EA31E905CB67

Function 12011180 Relevance: 56.6, APIs: 26, Strings: 6, Instructions: 603COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000001C7,data_plus_mac_plus_padding_size < 1024 * 1024,?,?,?,?), ref: 12011215
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,?), ref: 1201121E
pqueue_peek.LIBEAY32(00000000,?,?,?,?,?), ref: 12011224
SHA_Init.LIBEAY32(?,?,?), ref: 12011253
MD5_Init.LIBEAY32(?,?,?), ref: 12011288
_memset.LIBCMT ref: 1201148C
OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,00000271,mac_secret_length <= sizeof(hmac_pad),?,?,?,?,?,?), ref: 120114B2

Strings

.\ssl\s3_cbc.c, xrefs: 12011210, 12011316, 120114AD
data_plus_mac_plus_padding_size < 1024 * 1024, xrefs: 12011206
0, xrefs: 1201139E
mac_secret_length <= sizeof(hmac_pad), xrefs: 120114A3
j, xrefs: 12011980
0, xrefs: 120112B0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: InitOpen$X509_Y_get_object_memsetpqueue_peek
String ID: .\ssl\s3_cbc.c$0$0$data_plus_mac_plus_padding_size < 1024 * 1024$j$mac_secret_length <= sizeof(hmac_pad)
API String ID: 375958095-3721666550
Opcode ID: c841110446335b36d15ffe98ab18bb3af31476e7248e518345d7191768752f53
Instruction ID: d95e51f4e852f43f48c9e8f6013f789d3415e791a4e7310322a55b1a5290f8b2
Opcode Fuzzy Hash: c841110446335b36d15ffe98ab18bb3af31476e7248e518345d7191768752f53
Instruction Fuzzy Hash: 90328E769083819FD325CB64C884BDFFBE5AFC9304F444A2DE9D99B201E631D608DB92

Function 1201E070 Relevance: 44.4, APIs: 23, Strings: 2, Instructions: 698COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000102,000000E5,.\ssl\d1_pkt.c,0000037C), ref: 1201E0E5
SSL_state.SSLEAY32(?), ref: 1201E11E
pqueue_pop.LIBEAY32(?), ref: 1201E178
CRYPTO_free.LIBEAY32(?,00000000), ref: 1201E192
pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201E198
SSL_get_rbio.SSLEAY32 ref: 1201E2D4
BIO_clear_flags.LIBEAY32(00000000,0000000F), ref: 1201E2E5
BIO_set_flags.LIBEAY32(00000000,00000009,00000000,0000000F), ref: 1201E2ED
SSL_state.SSLEAY32(?), ref: 1201E3AB
SSL_get_rbio.SSLEAY32(?), ref: 1201E438
ERR_put_error.LIBEAY32(00000014,00000102,000000E5,.\ssl\d1_pkt.c,00000586), ref: 1201E6B5
ERR_put_error.LIBEAY32(00000014,00000102,00000044,.\ssl\d1_pkt.c,000003CD), ref: 1201E700

Strings

SSL alert number , xrefs: 1201E89C
.\ssl\d1_pkt.c, xrefs: 1201E0D7, 1201E145, 1201E6A4, 1201E6F2, 1201E74E, 1201E807, 1201E82A, 1201E840, 1201E860, 1201E8DA, 1201E912, 1201E974, 1201E982

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$L_get_rbioL_state$O_clear_flagsO_freeO_set_flagspqueue_freepqueue_pop
String ID: .\ssl\d1_pkt.c$SSL alert number
API String ID: 4005390593-1269415402
Opcode ID: 78801c774ebccce7c216bb1cca60b54634416ca90025645d7198826d27d50af3
Instruction ID: eb519af24fb6b2926389f16b04a3025b1470a29cd17a721c8146f2972efed678
Opcode Fuzzy Hash: 78801c774ebccce7c216bb1cca60b54634416ca90025645d7198826d27d50af3
Instruction Fuzzy Hash: 8732DF72A40642AFE355DB14CC85BAEB3E0BF45708F40473EE64A8F681D775E890E792

Function 110B7150 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 255COMMON

Download Yara Rule

APIs

BUF_MEM_new.LIBEAY32 ref: 110B7175

Part of subcall function 11060980: CRYPTO_malloc.LIBEAY32(0000000C,.\crypto\buffer\buffer.c,0000004A), ref: 11060989
Part of subcall function 11060980: ERR_put_error.LIBEAY32(00000007,00000065,00000041,.\crypto\buffer\buffer.c,0000004C), ref: 110609A4

BUF_MEM_grow.LIBEAY32(00000000,00000200), ref: 110B718E

Part of subcall function 11060A00: _memset.LIBCMT ref: 11060A22

CRYPTO_malloc.LIBEAY32(00000020,.\crypto\txt_db\txt_db.c,00000059), ref: 110B71A8
sk_new_null.LIBEAY32 ref: 110B71CA

Part of subcall function 11068B30: sk_new.LIBEAY32(00000000,11001512), ref: 11068B32

CRYPTO_malloc.LIBEAY32(00000000,.\crypto\txt_db\txt_db.c,00000060), ref: 110B71E9
CRYPTO_malloc.LIBEAY32(00000000,.\crypto\txt_db\txt_db.c,00000062), ref: 110B7208
BUF_MEM_grow_clean.LIBEAY32(00000000,?), ref: 110B7263
BIO_gets.LIBEAY32(?,?,?), ref: 110B728C
CRYPTO_malloc.LIBEAY32(?,.\crypto\txt_db\txt_db.c,0000007F), ref: 110B72D4
sk_push.LIBEAY32(?,00000000), ref: 110B7339
_fprintf.LIBCMT ref: 110B737D
CRYPTO_free.LIBEAY32(00000000,-00000040,failure in sk_push), ref: 110B7383
BUF_MEM_free.LIBEAY32(00000000), ref: 110B73C3
_fprintf.LIBCMT ref: 110B73E6
sk_free.LIBEAY32(?), ref: 110B73FA
CRYPTO_free.LIBEAY32(?), ref: 110B740A
CRYPTO_free.LIBEAY32(?), ref: 110B741A
CRYPTO_free.LIBEAY32(00000000), ref: 110B7423

Strings

OPENSSL_malloc failure, xrefs: 110B73D8
.\crypto\txt_db\txt_db.c, xrefs: 110B71A1, 110B71E3, 110B7202, 110B72CE
failure in sk_push, xrefs: 110B736F
wrong number of fields on line %ld (looking for field %d, got %d, '%s' left), xrefs: 110B7395

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_malloc$O_free$_fprintf$M_freeM_growM_grow_cleanM_newO_getsR_put_error_memsetsk_freesk_newsk_new_nullsk_push
String ID: .\crypto\txt_db\txt_db.c$OPENSSL_malloc failure$failure in sk_push$wrong number of fields on line %ld (looking for field %d, got %d, '%s' left)
API String ID: 2352617984-2807631981
Opcode ID: a3acedc2bd9266186a05eeb0221f1123d07ab8bde3a24edaaaaf67ee60d3840a
Instruction ID: a9a91054851ba4d9e1ad0b0bdb3d1090f72fcdb8d83dece12ab4e6f5071e3764
Opcode Fuzzy Hash: a3acedc2bd9266186a05eeb0221f1123d07ab8bde3a24edaaaaf67ee60d3840a
Instruction Fuzzy Hash: C581E9B9E047465BE701DF249C81B5BBBE5AF84708F0884ACEC859B381EB35E505C7A6

Function 1107F110 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1107F131
UI_get0_user_data.LIBEAY32(?,?), ref: 1107F140
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1107F19F

Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000002,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4B4
Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000004,?,?,?,?,?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4E0
Part of subcall function 1106F4A0: OPENSSL_cleanse.LIBEAY32(?,?), ref: 1106F4F6
Part of subcall function 1106F4A0: CRYPTO_free.LIBEAY32(?,?,?), ref: 1106F4FF
Part of subcall function 1106F4A0: EVP_PKEY_CTX_free.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F50F
Part of subcall function 1106F4A0: ENGINE_finish.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F51F

OPENSSL_cleanse.LIBEAY32(?,00000000), ref: 1107F1B1
CRYPTO_free.LIBEAY32(?,?,00000000), ref: 1107F1BB
OPENSSL_cleanse.LIBEAY32(00000000,?), ref: 1107F1CD
CRYPTO_free.LIBEAY32(00000000,00000000,?), ref: 1107F1D3
ERR_put_error.LIBEAY32(0000000D,000000DC,00000006,.\crypto\asn1\a_sign.c,00000107), ref: 1107F1FE
pqueue_peek.LIBEAY32(?), ref: 1107F22B
OBJ_find_sigid_by_algs.LIBEAY32(?,00000000), ref: 1107F239
OBJ_nid2obj.LIBEAY32(?,?,00000000), ref: 1107F27F
X509_ALGOR_set0.LIBEAY32(?,00000000), ref: 1107F289
OBJ_nid2obj.LIBEAY32(?,?,00000000), ref: 1107F2A1
X509_ALGOR_set0.LIBEAY32(?,00000000), ref: 1107F2AB
ASN1_item_i2d.LIBEAY32(?,?,?), ref: 1107F2C2
EVP_PKEY_size.LIBEAY32(00000000,?,?,?), ref: 1107F2CA
CRYPTO_malloc.LIBEAY32(00000000,.\crypto\asn1\a_sign.c,00000128,00000000,?,?,?), ref: 1107F2E2
EVP_DigestUpdate.LIBEAY32(?,?,00000000), ref: 1107F301
EVP_DigestSignFinal.LIBEAY32(?,00000000,?), ref: 1107F314
CRYPTO_free.LIBEAY32(?), ref: 1107F32C
ERR_put_error.LIBEAY32(0000000D,000000DC,000000D9,.\crypto\asn1\a_sign.c,000000F7), ref: 1107F3AE

Strings

.\crypto\asn1\a_sign.c, xrefs: 1107F1F0, 1107F24A, 1107F2D4, 1107F355, 1107F379, 1107F39D

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanseX509_$DigestJ_nid2objR_put_errorR_set0X_test_flags$E_finishFinalI_get0_user_dataJ_find_sigid_by_algsN1_item_i2dO_mallocSignUpdateX_cleanupX_freeY_get_objectY_sizepqueue_peek
String ID: .\crypto\asn1\a_sign.c
API String ID: 402261169-3491070742
Opcode ID: ed6a0ef40fc100b7ffc88b5118aa7c4543085f860b629ea8199ebcd4fe671d65
Instruction ID: b05439b79ac00f1b30c639edc393079451058ef4a1bfc43ca71a31b103f56f5c
Opcode Fuzzy Hash: ed6a0ef40fc100b7ffc88b5118aa7c4543085f860b629ea8199ebcd4fe671d65
Instruction Fuzzy Hash: 8C71F5B9E083416FE200DE55DC80F6FB7E8AB84708F40495DF9D997241EA71F90187AB

Function 12014160 Relevance: 35.9, APIs: 19, Strings: 1, Instructions: 853COMMON

Download Yara Rule

APIs

SSL_get_ciphers.SSLEAY32(00000000,00000000,?,?,00000000,12005B9B,?,?,?,?), ref: 12014197
sk_num.LIBEAY32(00000000,00000000,00000000,?,?,00000000,12005B9B,?,?,?,?), ref: 1201419F
sk_value.LIBEAY32(00000000,00000000,?,?), ref: 120141B2
sk_num.LIBEAY32(00000000,?,?,?,?), ref: 120141C8
ERR_put_error.LIBEAY32(00000014,00000115,00000044,.\ssl\t1_lib.c,00000521,?,?,?,?,?,?,?,?,?,?), ref: 1201430A

Strings

.\ssl\t1_lib.c, xrefs: 120142FC, 12014693

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$L_get_ciphersR_put_errorsk_value
String ID: .\ssl\t1_lib.c
API String ID: 1241052499-2047370388
Opcode ID: b1d57bcefefdafcadebb5bbd33382ecc9b9f55060c0a7a7d61af0b732bde2cda
Instruction ID: b8142d08e44ca9b66fb9a9358bb9b25fe36b1360c1876cccba7c74cc196a66da
Opcode Fuzzy Hash: b1d57bcefefdafcadebb5bbd33382ecc9b9f55060c0a7a7d61af0b732bde2cda
Instruction Fuzzy Hash: F07281B66083828FD302CF28C884B9BB7E1FF95304F054A6CE5958B352D771E909DB62

Function 1200ED30 Relevance: 35.7, APIs: 18, Strings: 2, Instructions: 667COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000094,00000044,.\ssl\s3_pkt.c,0000049E), ref: 1200EDA1

Part of subcall function 120108A0: ERR_put_error.LIBEAY32(00000014,0000009C,00000041,.\ssl\s3_both.c,000002B4), ref: 1201091C

Strings

.\ssl\s3_pkt.c, xrefs: 1200ED93, 1200EE89, 1200F25B, 1200F372, 1200F3C0, 1200F456, 1200F46C, 1200F4A5, 1200F51F, 1200F553, 1200F567, 1200F57B, 1200F5FF, 1200F60D
SSL alert number , xrefs: 1200F4E1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_pkt.c$SSL alert number
API String ID: 1767461275-2841557993
Opcode ID: 75ac7fe8de40c12a9455e81557d1bc8338022aacc55dfc40830cd0983852e9c5
Instruction ID: 5200d82c3b4bed02e8e99ac2e44f86b4bb876275126160cc321b665a98b79489
Opcode Fuzzy Hash: 75ac7fe8de40c12a9455e81557d1bc8338022aacc55dfc40830cd0983852e9c5
Instruction Fuzzy Hash: 96320472A047819BF311CF10CC88BEBB3E1BB45349F50477DE64A5B681DB71A885EB89

Function 1108B0C0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_init.LIBEAY32(00000000,00000000,?,1108B3F9,?,?), ref: 1108B0EE

Part of subcall function 1106F800: _memset.LIBCMT ref: 1106F80C

EVP_md5.LIBEAY32(00000000), ref: 1108B148
EVP_Digest.LIBEAY32(?,?,?,00000000,00000000,00000000), ref: 1108B160
EVP_md5.LIBEAY32(00000000,?,?,00000001,?,00000000), ref: 1108B1B8
EVP_rc4.LIBEAY32(00000000,00000000,?,?,00000001,?,00000000), ref: 1108B1BE
EVP_BytesToKey.LIBEAY32(00000000,00000000,00000000,?,?,00000001,?,00000000), ref: 1108B1C4
OPENSSL_cleanse.LIBEAY32(?,00000100), ref: 1108B1E1
EVP_rc4.LIBEAY32(00000000,?,00000000), ref: 1108B1F5
EVP_DecryptInit_ex.LIBEAY32(?,00000000,00000000,?,00000000), ref: 1108B200
EVP_DecryptUpdate.LIBEAY32(?,?,?,?), ref: 1108B222
EVP_DecryptFinal_ex.LIBEAY32(?,?,?), ref: 1108B244
ERR_put_error.LIBEAY32(0000000D,000000C9,0000009D,.\crypto\asn1\n_pkey.c,00000148), ref: 1108B2CD

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 1108B2DA
ASN1_item_free.LIBEAY32(00000000,1110F33C,?), ref: 1108B2E5

Strings

Enter Private Key password:, xrefs: 1108B0F4
SGCKEYSALT, xrefs: 1108B170
.\crypto\asn1\n_pkey.c, xrefs: 1108B118, 1108B283, 1108B2BC

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: Decrypt$P_md5P_rc4$BytesDigestFinal_exInit_exL_cleanseN1_item_freeO_freeR_get_stateR_put_errorUpdateX_cleanupX_init_memset
String ID: .\crypto\asn1\n_pkey.c$Enter Private Key password:$SGCKEYSALT
API String ID: 1466466802-3628393845
Opcode ID: ca98a871eaea7c14110df071ca7849f3344887cd5c97d689a47bf37069d4c384
Instruction ID: f806a489ceb4bd959013edbed1441920444f12becdc36a20c1fb1b0f541754e5
Opcode Fuzzy Hash: ca98a871eaea7c14110df071ca7849f3344887cd5c97d689a47bf37069d4c384
Instruction Fuzzy Hash: 785173B5E08346ABD310DF64CC81FABB7E9AF88714F04491DF9498B285EA74E544C7A3

Function 12012400 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 485COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 1201251A
RAND_bytes.LIBEAY32(?,0000001C,00000000), ref: 12012540
SSL_get_ciphers.SSLEAY32(?,?,00000000), ref: 12012630

Part of subcall function 12012330: SSL_get_ciphers.SSLEAY32(?), ref: 12012337
Part of subcall function 12012330: sk_num.LIBEAY32(00000000,?), ref: 12012341
Part of subcall function 12012330: sk_value.LIBEAY32(00000000,00000000), ref: 12012352
Part of subcall function 12012330: sk_num.LIBEAY32(00000000), ref: 12012362

RAND_bytes.LIBEAY32(?,00000020), ref: 1201254D
ERR_put_error.LIBEAY32(00000014,00000074,0000017B,.\ssl\s23_clnt.c,0000018E), ref: 12012597
ERR_put_error.LIBEAY32(00000014,00000074,000000B5,.\ssl\s23_clnt.c,000001BB), ref: 12012659
RAND_bytes.LIBEAY32(?,?), ref: 120126D4
SSL_get_ciphers.SSLEAY32(?,?,Function_0000ADB0), ref: 12012769
sk_num.LIBEAY32(?), ref: 120127B4
sk_value.LIBEAY32(?,00000000), ref: 120127DE

Strings

.\ssl\s23_clnt.c, xrefs: 12012589, 1201264B, 12012805, 12012845, 12012896, 12012966

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: D_bytesL_get_cipherssk_num$R_put_errorsk_value$__time64
String ID: .\ssl\s23_clnt.c
API String ID: 983946140-2564810286
Opcode ID: 068fdd3dc482564dc3bbf326625c8fe5fe67b8f7c63d3bd14cb5ace6462257ff
Instruction ID: fc5836d33a633fe7e953590637057cd8a920e2e678955849cb2c034b3807d14b
Opcode Fuzzy Hash: 068fdd3dc482564dc3bbf326625c8fe5fe67b8f7c63d3bd14cb5ace6462257ff
Instruction Fuzzy Hash: D0F135B2A083919FE702CF28CC81B9ABBD4AF95304F05476DED895F382D274E545D7A2

Function 11081050 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,00000001,0000000A,.\crypto\asn1\x_pubkey.c,00000087), ref: 11081077
EVP_PKEY_new.LIBEAY32 ref: 1108108F
ERR_put_error.LIBEAY32(0000000B,00000077,0000007C,.\crypto\asn1\x_pubkey.c,0000009E), ref: 11081183
EVP_PKEY_free.LIBEAY32(00000000), ref: 11081190

Strings

.\crypto\asn1\x_pubkey.c, xrefs: 1108106A, 1108109F, 110810C8, 110810F2, 11081103, 1108111F, 11081140, 11081159, 11081178

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_add_lockR_put_errorY_freeY_new
String ID: .\crypto\asn1\x_pubkey.c
API String ID: 1642024233-3331268683
Opcode ID: c195b82176a0f634e0b6c7b19cb3a13f19b4feec775075d5e30792a78789bef8
Instruction ID: 4d481845e7279a310e892e575864649a37ef92a9173a6f638f7a8919d60fbd7f
Opcode Fuzzy Hash: c195b82176a0f634e0b6c7b19cb3a13f19b4feec775075d5e30792a78789bef8
Instruction Fuzzy Hash: A5310675F88302BAFA20E625EC02F9FB2856F41B48F414451FA1CBA2C1FAB1F55186D6

Function 120114D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 296COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 12011521
_memset.LIBCMT ref: 120116B8

Strings

6, xrefs: 120114E0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _memset
String ID: 6
API String ID: 2102423945-498629140
Opcode ID: 9f1167567e5076677f310f966761d52f79c49aa0717c0a2c138803361eaf3d55
Instruction ID: 4489a8bc2fc41d48c615bb0e9de0b3e6b0f5a4d73cdcbf396d1fcdde84d452c5
Opcode Fuzzy Hash: 9f1167567e5076677f310f966761d52f79c49aa0717c0a2c138803361eaf3d55
Instruction Fuzzy Hash: 38A1B0766083819FC715DB64C880AEFF7E9AFC9304F444E1DE9DA8B241D631E609DB92

Function 110A90A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(0000001C,.\crypto\x509v3\v3_purp.c,000000D6), ref: 110A9106
CRYPTO_free.LIBEAY32(?), ref: 110A9164
CRYPTO_free.LIBEAY32(?,?), ref: 110A916D
BUF_strdup.LIBEAY32(?), ref: 110A917A
BUF_strdup.LIBEAY32(?,?), ref: 110A9187
sk_new.LIBEAY32(11089F80), ref: 110A91D1
sk_push.LIBEAY32(00000000,00000000), ref: 110A91EB
ERR_put_error.LIBEAY32(00000022,00000089,00000041,.\crypto\x509v3\v3_purp.c,000000E7), ref: 110A921E

Strings

.\crypto\x509v3\v3_purp.c, xrefs: 110A90FF, 110A9210

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: F_strdupO_free$O_mallocR_put_errorsk_newsk_push
String ID: .\crypto\x509v3\v3_purp.c
API String ID: 3615178250-3334384258
Opcode ID: a4e5170b16917cca21fbf3c0714fe94430aa4358231737fa72e3ac117fc77b8f
Instruction ID: 20a32911a8b6bcce27eaf8aba58d521932499ed024d9b253ccd440118a977e63
Opcode Fuzzy Hash: a4e5170b16917cca21fbf3c0714fe94430aa4358231737fa72e3ac117fc77b8f
Instruction Fuzzy Hash: 6541D179F447029BD720CEA8EC80B5FB7E4AB80758F004A2DE95997684FB31F544C791

Function 110031E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_dbg_malloc.LIBEAY32(?,?,?,?,00000081), ref: 11003222

Part of subcall function 11002F00: CRYPTO_is_mem_check_on.LIBEAY32 ref: 11002F27
Part of subcall function 11002F00: CRYPTO_mem_ctrl.LIBEAY32(00000003), ref: 11002F37
Part of subcall function 11002F00: CRYPTO_malloc.LIBEAY32(00000030,.\crypto\mem_dbg.c,000001E1,00000003), ref: 11002F48
Part of subcall function 11002F00: CRYPTO_free.LIBEAY32(?), ref: 11002F57
Part of subcall function 11002F00: CRYPTO_lock.LIBEAY32(00000009,00000014,.\crypto\mem_dbg.c,000000D4,?), ref: 11002F6A
Part of subcall function 11002F00: CRYPTO_lock.LIBEAY32(0000000A,0000001B,.\crypto\mem_dbg.c,00000109), ref: 110030CA
Part of subcall function 11002F00: CRYPTO_lock.LIBEAY32(0000000A,00000014,.\crypto\mem_dbg.c,00000112), ref: 110030E0

CRYPTO_is_mem_check_on.LIBEAY32 ref: 11003230
CRYPTO_mem_ctrl.LIBEAY32(00000003), ref: 1100323F
lh_delete.LIBEAY32(00000000,?,00000003), ref: 11003254
lh_insert.LIBEAY32(00000000,00000000), ref: 11003270
CRYPTO_lock.LIBEAY32(00000009,00000014,.\crypto\mem_dbg.c,000000D4), ref: 11003286
CRYPTO_lock.LIBEAY32(0000000A,0000001B,.\crypto\mem_dbg.c,00000109), ref: 110032BE
CRYPTO_lock.LIBEAY32(0000000A,00000014,.\crypto\mem_dbg.c,00000112), ref: 110032D4

Strings

.\crypto\mem_dbg.c, xrefs: 1100327D, 110032B5, 110032CB

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_lock$O_is_mem_check_onO_mem_ctrl$O_dbg_mallocO_freeO_malloclh_deletelh_insert
String ID: .\crypto\mem_dbg.c
API String ID: 3285418866-3062790163
Opcode ID: be105664e656e9c6376f3a4980e3d37bab721a189ee37a9ffa68932696fe1689
Instruction ID: 0c9e1ef274ff5881c7f81d12d38b8fe36a148a448b759dbe48de4aa2ff77427d
Opcode Fuzzy Hash: be105664e656e9c6376f3a4980e3d37bab721a189ee37a9ffa68932696fe1689
Instruction Fuzzy Hash: DF213779F483126FF202DB588D42F9BB7E8AB84F8CF400458FA445A692E770E400C7D2

Function 11057010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

EC_POINT_point2oct.LIBEAY32(?,?,?,00000000,00000000,?), ref: 11057035

Part of subcall function 1105EDB0: ERR_put_error.LIBEAY32(00000010,0000007B,00000042,.\crypto\ec\ec_oct.c,0000008D,?,11056EE0,?,?,?,00000000,00000000,?), ref: 1105EDD3

CRYPTO_malloc.LIBEAY32(00000000,.\crypto\ec\ec_print.c,0000008A), ref: 11057054
EC_POINT_point2oct.LIBEAY32(?,?,?,00000000,00000000,?), ref: 11057070
CRYPTO_malloc.LIBEAY32(00000002,.\crypto\ec\ec_print.c,00000092), ref: 1105708B
CRYPTO_free.LIBEAY32(00000000), ref: 1105709C

Strings

.\crypto\ec\ec_print.c, xrefs: 1105704E, 11057085

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_mallocT_point2oct$O_freeR_put_error
String ID: .\crypto\ec\ec_print.c
API String ID: 1204887134-596798755
Opcode ID: 8e9b5aa9ac340bf0506fe8ea297353e6546e2e7904f8c6ebbcc34c12814cf346
Instruction ID: f89064737eeac1b5a56a9963d7730c403e75be1e316e2299d30f0e82eb0d6b85
Opcode Fuzzy Hash: 8e9b5aa9ac340bf0506fe8ea297353e6546e2e7904f8c6ebbcc34c12814cf346
Instruction Fuzzy Hash: 14217F7AE053536BE251DA799C40F57BBDCDBC5268F1404ADFA8587342E932E80583F2

Function 110A5090 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

BUF_strdup.LIBEAY32(?), ref: 110A50CF
a2i_ipadd.LIBEAY32(?,00000000), ref: 110A50EA
a2i_ipadd.LIBEAY32(?,00000001), ref: 110A50FF
CRYPTO_free.LIBEAY32(00000000,?,00000001), ref: 110A5107
ASN1_OCTET_STRING_new.LIBEAY32 ref: 110A5117

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: a2i_ipadd$F_strdupG_newO_free
String ID:
API String ID: 3108527627-0
Opcode ID: 4e49a27587029c92104a25c75cb36758b92d69dbdc0fac4d3f548238c5acbe74
Instruction ID: 68334747766f5d7392124195b02b37b3f8a15e329b3b4781b93613f141dc2316
Opcode Fuzzy Hash: 4e49a27587029c92104a25c75cb36758b92d69dbdc0fac4d3f548238c5acbe74
Instruction Fuzzy Hash: DF21047EE0430217D600DAB87C81A6F72D9AFD9268F454539E94987205FF39F905C2E2

Function 110B7050 Relevance: 12.1, APIs: 8, Instructions: 59COMMON

Download Yara Rule

APIs

NCONF_new.LIBEAY32(00000000,?,?,?,?,110B7126,00000000,?,00000030,110708FC,00000000), ref: 110B7059

Part of subcall function 110B4F40: NCONF_default.LIBEAY32(110B705E,00000000,?,?,?,?,110B7126,00000000,?,00000030,110708FC,00000000), ref: 110B4F48
Part of subcall function 110B4F40: ERR_put_error.LIBEAY32(0000000E,0000006F,00000041,.\crypto\conf\conf_lib.c,000000ED), ref: 110B4F6A

CONF_get1_default_config_file.LIBEAY32 ref: 110B706F

Part of subcall function 110B6B10: _getenv.LIBCMT ref: 110B6B15
Part of subcall function 110B6B10: BUF_strdup.LIBEAY32(00000000,110B7074), ref: 110B6B22

NCONF_load.LIBEAY32(00000000,?,00000000), ref: 110B7082
ERR_peek_last_error.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110B7095
ERR_clear_error.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110B70A4
CONF_modules_load.LIBEAY32(00000000,?,?), ref: 110B70BB

Part of subcall function 110B6F90: NCONF_get_string.LIBEAY32(?,00000000,00000000,?,110B70C0,00000000,?,?), ref: 110B6FA5
Part of subcall function 110B6F90: NCONF_get_string.LIBEAY32(?,00000000,openssl_conf,?,110B70C0,00000000,?,?), ref: 110B6FC0
Part of subcall function 110B6F90: ERR_clear_error.LIBEAY32(00000000,?,?), ref: 110B6FCC

CRYPTO_free.LIBEAY32(00000000), ref: 110B70CA
NCONF_free.LIBEAY32(00000000), ref: 110B70D3

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: F_get_stringR_clear_error$F_defaultF_freeF_get1_default_config_fileF_loadF_modules_loadF_newF_strdupO_freeR_peek_last_errorR_put_error_getenv
String ID:
API String ID: 2300942178-0
Opcode ID: 497ae1bf682ac46cf43387eaa66267f57fd7648bf6eec211dc5603a3e1d4af1a
Instruction ID: 6665fce06a734eb3b65fc3ff21aba346c0a592900166b9e643957e97600f1743
Opcode Fuzzy Hash: 497ae1bf682ac46cf43387eaa66267f57fd7648bf6eec211dc5603a3e1d4af1a
Instruction Fuzzy Hash: 4A0128BED15A075AE222D9706C40B2B368CCF8125CF19017AFD0087281FE55FD0541EB

Function 120116DE Relevance: 10.7, APIs: 7, Instructions: 195COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?,?,?,?,?,?,?,?,?,?), ref: 1201189D
EVP_DigestInit_ex.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 120118B3
_memset.LIBCMT ref: 120118E0
EVP_DigestUpdate.LIBEAY32(?,?,?,?,0000005C,?), ref: 120118FA
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12011917
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12011938
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201194D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Init_exX_cleanupX_init_memset
String ID:
API String ID: 392347561-0
Opcode ID: 52fa8a9ff454de2c5ca34392905230d5efce2a006d97aec7a91823695140c14e
Instruction ID: d8755b48a3eaffb23e87b4ffc27fe0d4370af09c8c8d9a563d43f6050e5d5b96
Opcode Fuzzy Hash: 52fa8a9ff454de2c5ca34392905230d5efce2a006d97aec7a91823695140c14e
Instruction Fuzzy Hash: E461AE376083819FD316CB68C490AEFF7E5AFDA240F445E1DE5D68B241D630E509DB52

Function 12010CD0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000000F8,orig_len >= md_size,00000000,?,?,?,1200E6E5,?,?,00000000,?), ref: 12010D32
OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000000F9,md_size <= EVP_MAX_MD_SIZE,00000000,?,?,?,1200E6E5,?,?,00000000,?), ref: 12010D4E
_memset.LIBCMT ref: 12010D9A

Strings

.\ssl\s3_cbc.c, xrefs: 12010D2D, 12010D49
md_size <= EVP_MAX_MD_SIZE, xrefs: 12010D3F
orig_len >= md_size, xrefs: 12010D23

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Open$_memset
String ID: .\ssl\s3_cbc.c$md_size <= EVP_MAX_MD_SIZE$orig_len >= md_size
API String ID: 4184861508-1657088310
Opcode ID: 5895b9a7a28f613c080340dc0dfc139a98423c01d784487b8fcfd0d004c1499c
Instruction ID: be01475aaa3e5d4f1a890d0fea1c662f1f9355971c3eb58a2044493791c0e61d
Opcode Fuzzy Hash: 5895b9a7a28f613c080340dc0dfc139a98423c01d784487b8fcfd0d004c1499c
Instruction Fuzzy Hash: 055193767183414FC315CF29C88069BFBE2BBD9200F548B2DE9C98B342D630E909DB92

Function 110D104E Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

sk_value.LIBEAY32 ref: 110D1052
sk_num.LIBEAY32 ref: 110D108B
sk_insert.LIBEAY32(?,00000000,00000000), ref: 110D10A8
CRYPTO_free.LIBEAY32(00000000), ref: 110D10C5
BN_free.LIBEAY32(?,00000000), ref: 110D10CE
CRYPTO_free.LIBEAY32(00000000,?,00000000), ref: 110D10D4

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free$N_freesk_insertsk_numsk_value
String ID:
API String ID: 3786230172-0
Opcode ID: 2e899bf9e3158083e9f77a8e192da27304574814b893ffe9b09174dced847f66
Instruction ID: 8764ed4aea70c6ec94ba854db8d1c31e13999219ebf7c4d7ab2d3aa73535ea84
Opcode Fuzzy Hash: 2e899bf9e3158083e9f77a8e192da27304574814b893ffe9b09174dced847f66
Instruction Fuzzy Hash: 22112B77F4538207EB11FA747C50BABBFD98F425A870C46A9F88D47641EE62F5008381

Function 1106D150 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

lh_num_items.LIBEAY32(00000000,.\crypto\objects\o_names.c,0000013B), ref: 1106D173
CRYPTO_malloc.LIBEAY32(00000000), ref: 1106D180
lh_doall_arg.LIBEAY32 ref: 1106D1C0
CRYPTO_free.LIBEAY32(?), ref: 1106D20C

Strings

.\crypto\objects\o_names.c, xrefs: 1106D169

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloclh_doall_arglh_num_items
String ID: .\crypto\objects\o_names.c
API String ID: 4011223845-3691907309
Opcode ID: 2164974eed4ee5abc05272a03cbe197efc653429c7fb62650253a66eb3b37a97
Instruction ID: af7ff0f29333f265ca9e9149d27fbdd48385d4dd5e957f032864a935a2fc9d5c
Opcode Fuzzy Hash: 2164974eed4ee5abc05272a03cbe197efc653429c7fb62650253a66eb3b37a97
Instruction Fuzzy Hash: E6116AB5908312ABD600CF59CC81E8FB7E8ABC8618F04491DF5C4A7200E675E585CBA2

Function 110A1020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000030,.\crypto\x509\x509_vpm.c,000000B0,?,1109C281), ref: 110A102D
_memset.LIBCMT ref: 110A1040
CRYPTO_malloc.LIBEAY32(0000001C,.\crypto\x509\x509_vpm.c,000000B5,00000000,00000000,00000030), ref: 110A1051
CRYPTO_free.LIBEAY32(00000000), ref: 110A105E

Strings

.\crypto\x509\x509_vpm.c, xrefs: 110A1026, 110A104A

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_malloc$O_free_memset
String ID: .\crypto\x509\x509_vpm.c
API String ID: 3040167583-2273535112
Opcode ID: b4f77a509a3bb00375f4d2dbde1a0edfb70bb75c57b2ea53c9725e5b16a09a4a
Instruction ID: 9d45347ecf2b0f8ebfc06e38fd4834e6747dcee8db6b489cab9d2d5dbee237e1
Opcode Fuzzy Hash: b4f77a509a3bb00375f4d2dbde1a0edfb70bb75c57b2ea53c9725e5b16a09a4a
Instruction Fuzzy Hash: DBF06DB4F493115AE318AF687C05F867AE45F08794F0680BDF909EF395E6B4E640C6C9

Function 110BF010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000026,00000073,00000043,.\crypto\engine\eng_list.c,000000D9), ref: 110BF029

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

CRYPTO_lock.LIBEAY32(00000009,0000001E,.\crypto\engine\eng_list.c,000000DC), ref: 110BF044
CRYPTO_lock.LIBEAY32(0000000A,0000001E,.\crypto\engine\eng_list.c,000000E3), ref: 110BF064
ENGINE_free.LIBEAY32(?,0000000A,0000001E,.\crypto\engine\eng_list.c,000000E3), ref: 110BF06A

Strings

.\crypto\engine\eng_list.c, xrefs: 110BF01E, 110BF03B, 110BF05B

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_lock$E_freeO_freeR_get_stateR_put_error
String ID: .\crypto\engine\eng_list.c
API String ID: 3399167294-3096227302
Opcode ID: 194e0ee42f72ba289f635b1652c4585f9111305cedcb1f47c3968d4fdb069718
Instruction ID: 9f301b56f938bbca84b7f10e7d1dc4e2d9825f59ac8408665344afdd65b4da51
Opcode Fuzzy Hash: 194e0ee42f72ba289f635b1652c4585f9111305cedcb1f47c3968d4fdb069718
Instruction Fuzzy Hash: FBF0A73BF8035276F120E568BD06F5BA6904B80F58F050855BB047F1C7E6E0A20181D6

Function 110BF080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000026,00000074,00000043,.\crypto\engine\eng_list.c,000000ED), ref: 110BF099

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

CRYPTO_lock.LIBEAY32(00000009,0000001E,.\crypto\engine\eng_list.c,000000F0), ref: 110BF0B4
CRYPTO_lock.LIBEAY32(0000000A,0000001E,.\crypto\engine\eng_list.c,000000F7), ref: 110BF0D4
ENGINE_free.LIBEAY32(?,0000000A,0000001E,.\crypto\engine\eng_list.c,000000F7), ref: 110BF0DA

Strings

.\crypto\engine\eng_list.c, xrefs: 110BF08E, 110BF0AB, 110BF0CB

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_lock$E_freeO_freeR_get_stateR_put_error
String ID: .\crypto\engine\eng_list.c
API String ID: 3399167294-3096227302
Opcode ID: 4ae109aba941e26689569845a9c04bb0a462145851712546ef92959d735df701
Instruction ID: 1564dfd2400cbbcaaf193b3009829651b6b0593a39e4fbdf0b7f26482096f991
Opcode Fuzzy Hash: 4ae109aba941e26689569845a9c04bb0a462145851712546ef92959d735df701
Instruction Fuzzy Hash: 85F0A73BF8035272F120E569BD06F6AA6909B80F58F050C65BB087F1C7EAE1A14191D6

Function 11037060 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(00000000), ref: 110370A7
BN_new.LIBEAY32 ref: 11037083

Part of subcall function 110365E0: CRYPTO_malloc.LIBEAY32(00000014,.\crypto\bn\bn_lib.c,00000110,1103A875,?,?,00000000,1103EC44,00000000,00000000,?,?), ref: 110365EC
Part of subcall function 110365E0: ERR_put_error.LIBEAY32(00000003,00000071,00000041,.\crypto\bn\bn_lib.c,00000111,?,?,1103A875,?,?,00000000,1103EC44,00000000,00000000,?,?), ref: 1103660A

BN_new.LIBEAY32 ref: 110370B6
BN_copy.LIBEAY32(00000000,?), ref: 110370C3
BN_free.LIBEAY32(00000000), ref: 110370D0

Part of subcall function 11036630: ERR_put_error.LIBEAY32(00000003,00000078,00000072,.\crypto\bn\bn_lib.c,00000128,?,11036747,?,?,?,?,?,11034203,?,?), ref: 11036650

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N_newR_put_error$N_copyN_freeO_freeO_malloc
String ID:
API String ID: 2733396557-0
Opcode ID: cf567c6010adb74f4135cac553f7f9f31457d9fe38603579aef163dbd0039e9e
Instruction ID: 0f7706c8b5f7734dea1e0431611b0981500b3cc8a823653ead6db9dd13ab6e1d
Opcode Fuzzy Hash: cf567c6010adb74f4135cac553f7f9f31457d9fe38603579aef163dbd0039e9e
Instruction Fuzzy Hash: B701B17BE11B265F9220DAA9AC4095BF7D8AEC466AB00453AE858C3600F621FA1087E1

Function 120322D4 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 120336CC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 120336E1
UnhandledExceptionFilter.KERNEL32(120478B8), ref: 120336EC
GetCurrentProcess.KERNEL32(C0000409), ref: 12033708
TerminateProcess.KERNEL32(00000000), ref: 1203370F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d08a43e4d72525d4436a58ad8742fc3e74e87ffccaf79df441ffd05ecf2e854d
Instruction ID: 1b99e80d2e062b367123c250ba5a29c4db84f3c912e0ed9800650ffcbcd5d3c9
Opcode Fuzzy Hash: d08a43e4d72525d4436a58ad8742fc3e74e87ffccaf79df441ffd05ecf2e854d
Instruction Fuzzy Hash: 552114B98802A5DFD715CF69D5C9A84BBE4BF18341F10AF5AE909A7301E7B05980CF54

Function 11069020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000060,.\crypto\lhash\lhash.c,00000078,?,00000000,11002B89,110029C0,110029B0), ref: 1106902B
CRYPTO_malloc.LIBEAY32(00000040,.\crypto\lhash\lhash.c,0000007A,11002B89,110029C0,110029B0), ref: 11069044
CRYPTO_free.LIBEAY32(00000000,?,?,?,11002B89,110029C0,110029B0), ref: 11069053

Strings

.\crypto\lhash\lhash.c, xrefs: 11069024, 1106903D

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_malloc$O_free
String ID: .\crypto\lhash\lhash.c
API String ID: 2640950527-2500715679
Opcode ID: c3d4f0be939d73f2e9954bb721c86933510a0cd8bf5899b575c999408b13d80a
Instruction ID: e3b054471fdaae834050a5c06600e31f583f1b147b2032c2d5655264384212a0
Opcode Fuzzy Hash: c3d4f0be939d73f2e9954bb721c86933510a0cd8bf5899b575c999408b13d80a
Instruction Fuzzy Hash: 3721B0B0A00B518FE771CF2A9840647FBF8BFA4714B10491FE1CAC7A60E7B1A4448F81

Function 1104D140 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000025,0000006D,0000006C,.\crypto\dso\dso_lib.c,000000FD), ref: 1104D169

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(00000025,0000006D,0000006A,.\crypto\dso\dso_lib.c,00000101), ref: 1104D18F
ERR_put_error.LIBEAY32(00000025,0000006D,00000043,.\crypto\dso\dso_lib.c,000000F9), ref: 1104D1AA

Strings

.\crypto\dso\dso_lib.c, xrefs: 1104D15E, 1104D184, 1104D19F

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_state
String ID: .\crypto\dso\dso_lib.c
API String ID: 4246747085-2062701985
Opcode ID: 2b85ee819e1ca0d75c8c53ea1101518de0d1f7f7b690786f91a91e570d2c8e87
Instruction ID: 91a35c1c3093a43790fa28fa624ab4e31dae1d6f8865352beb43a77c077c1411
Opcode Fuzzy Hash: 2b85ee819e1ca0d75c8c53ea1101518de0d1f7f7b690786f91a91e570d2c8e87
Instruction Fuzzy Hash: 7FF0B4E8F8034336F520E5254D93F2732A62B90F0AF0084B8BB08ED1D1FEB2E1109111

Function 1104D1C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000025,0000006C,0000006C,.\crypto\dso\dso_lib.c,00000111), ref: 1104D1E9

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(00000025,0000006C,0000006A,.\crypto\dso\dso_lib.c,00000115), ref: 1104D20F
ERR_put_error.LIBEAY32(00000025,0000006C,00000043,.\crypto\dso\dso_lib.c,0000010D), ref: 1104D22A

Strings

.\crypto\dso\dso_lib.c, xrefs: 1104D1DE, 1104D204, 1104D21F

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_state
String ID: .\crypto\dso\dso_lib.c
API String ID: 4246747085-2062701985
Opcode ID: a29bec2a2e2e794d0ad9685d801a660cb77c038f34e2f4c8bc14f31f96c30737
Instruction ID: 314e0d2928edf03efcc6e79eb6fd68c28988ba9dd4c90ef2d1c70d8bd0119db8
Opcode Fuzzy Hash: a29bec2a2e2e794d0ad9685d801a660cb77c038f34e2f4c8bc14f31f96c30737
Instruction Fuzzy Hash: 66F0B4B8F8074272F614F9644D83F6B32A62BA0F0AF0080ACB705EE1C2FAB2E1118111

Function 1101F170 Relevance: 6.4, APIs: 4, Instructions: 440COMMON

Download Yara Rule

APIs

idea_encrypt.LIBEAY32(?,?), ref: 1101F25E
idea_encrypt.LIBEAY32(?,?), ref: 1101F349
idea_encrypt.LIBEAY32(?,?), ref: 1101F489
idea_encrypt.LIBEAY32(?,?), ref: 1101F561

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: idea_encrypt
String ID:
API String ID: 156252443-0
Opcode ID: 3243333e8e4b2561403570bbd27306b55d8b9c15391204786fc5409955502b1f
Instruction ID: e385df8e770226ac62bd5028118fe356282aa2eaa9227507e466219ac244bec8
Opcode Fuzzy Hash: 3243333e8e4b2561403570bbd27306b55d8b9c15391204786fc5409955502b1f
Instruction Fuzzy Hash: C7E1862050C7D64BD30ACE2E489012DFFD1EED9200B548B5EF4E78B282D679D656CBA5

Function 110171B0 Relevance: 6.4, APIs: 4, Instructions: 390COMMON

Download Yara Rule

APIs

DES_encrypt1.LIBEAY32(?,?,00000001), ref: 11017294
DES_encrypt1.LIBEAY32(?,?,00000001), ref: 11017366
DES_encrypt1.LIBEAY32(?,?,00000000), ref: 1101747E
DES_encrypt1.LIBEAY32(?,?,00000000), ref: 11017543

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: S_encrypt1
String ID:
API String ID: 184137512-0
Opcode ID: d8009e94af04ac4b5cc3117264c2661210a9ca6e8bd0c2c1ce9120a58ae0b694
Instruction ID: a6cca2d52226c77ad30bce03c8e896ab82a85cd33c8b5551641604d2a57b9c5f
Opcode Fuzzy Hash: d8009e94af04ac4b5cc3117264c2661210a9ca6e8bd0c2c1ce9120a58ae0b694
Instruction Fuzzy Hash: 63D1E82050C7E24BD30E8B3E4894139FFD1DFDA201B584B9EF4E78B282DA68D555D7A1

Function 1105F020 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

ENGINE_finish.LIBEAY32(C68B5FF7,00000000,1105F0B9,00000000), ref: 1105F02D

Part of subcall function 110BF750: ERR_put_error.LIBEAY32(00000026,0000006B,00000043,.\crypto\engine\eng_init.c,00000092,?,1106F524,?,?,1106F61A,?,?,?,?,11014053,?), ref: 110BF769

CRYPTO_free_ex_data.LIBEAY32(0000000D,1105F0B9,1105F0C9,00000000,1105F0B9,00000000), ref: 1105F03C
OPENSSL_cleanse.LIBEAY32(1105F0B9,00000018,0000000D,1105F0B9,1105F0C9,00000000,1105F0B9,00000000), ref: 1105F044
CRYPTO_free.LIBEAY32(1105F0B9,1105F0B9,00000018,0000000D,1105F0B9,1105F0C9,00000000,1105F0B9,00000000), ref: 1105F04A

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: E_finishL_cleanseO_freeO_free_ex_dataR_put_error
String ID:
API String ID: 2602333693-0
Opcode ID: e6bedeb471f493e8ceef1cc83f081202a3abc953fd081f7a7e275535fe0b1350
Instruction ID: d311fc8e20d1ac1961482b5af12dfaa5151aed69f2b104cf624286d4c18556de
Opcode Fuzzy Hash: e6bedeb471f493e8ceef1cc83f081202a3abc953fd081f7a7e275535fe0b1350
Instruction Fuzzy Hash: 3ED02B7DE4471336F120EA246C04FAB329C5F14284F05044CF848D7140EE20F50881F7

Function 1106B1F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,00000001,.\crypto\err\err.c,00000128), ref: 1106B207

Part of subcall function 11001DC0: CRYPTO_get_dynlock_value.LIBEAY32(00000041,00000000,1106BE6A,00000009,00000001,.\crypto\err\err.c,00000128,?,00000000,?,1106C497,?,00000000,11060CC0,00000007,00000068), ref: 11001DD3
Part of subcall function 11001DC0: CRYPTO_destroy_dynlockid.LIBEAY32(00000041), ref: 11001DF6

CRYPTO_lock.LIBEAY32(0000000A,00000001,.\crypto\err\err.c,0000012B), ref: 1106B230

Strings

.\crypto\err\err.c, xrefs: 1106B1FE, 1106B227

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_lock$O_destroy_dynlockidO_get_dynlock_value
String ID: .\crypto\err\err.c
API String ID: 461693643-465462020
Opcode ID: 6fa626db9dbd3fa59ee2704dd72837acf5132a1f73d792d39212abecd84d0923
Instruction ID: 3208d3d578b805d23ce01d9638312a665e33a03dce282f05907e5a02ac278d89
Opcode Fuzzy Hash: 6fa626db9dbd3fa59ee2704dd72837acf5132a1f73d792d39212abecd84d0923
Instruction Fuzzy Hash: 29E0B6B8B94217FBF610EA148C83F4573D0A794F8DF400858F518695C5D7B57194C641

Function 110A10C0 Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

BUF_strdup.LIBEAY32(?,?,00000000,?,110A17BE,?,?), ref: 110A10D2
BUF_memdup.LIBEAY32(?,?,?,00000000,?,110A17BE,?,?), ref: 110A10F0
CRYPTO_free.LIBEAY32(?,?,00000000,?,110A17BE,?,?), ref: 110A1110

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: F_memdupF_strdupO_free
String ID:
API String ID: 3243844264-0
Opcode ID: 50a75dd5ff800efdcb37d515d557658c4a98172425f188e9cad1a5890ea566fe
Instruction ID: c8f5a9452706533d4eb6a3740de93ecb50328e0eefac8619007e1321ab3588f3
Opcode Fuzzy Hash: 50a75dd5ff800efdcb37d515d557658c4a98172425f188e9cad1a5890ea566fe
Instruction Fuzzy Hash: FC01F4B6F403471BA701CEAABC8094B77D8AF842D5B058074F804CB200FF71E905C2A1

Function 110B1130 Relevance: 4.5, APIs: 3, Instructions: 32COMMON

Download Yara Rule

APIs

i2d_X509_ALGORS.LIBEAY32(110B177D,00000000,110B177D), ref: 110B114B

Part of subcall function 11080D40: ASN1_item_i2d.LIBEAY32(?,?,1110D8C0), ref: 11080D4F

CMS_signed_add1_attr_by_NID.LIBEAY32(?,000000A7,00000010,?,00000000,?), ref: 110B116D
CRYPTO_free.LIBEAY32(?,?,000000A7,00000010,?,00000000,?), ref: 110B1179

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N1_item_i2dO_freeS_signed_add1_attr_by_X509_i2d_
String ID:
API String ID: 1697744140-0
Opcode ID: e886fa97aa50dc187b916b7b25c0ecac5a363589fb5014501646a508a9d7915e
Instruction ID: 86033ad11f6a59220da29dc5fc59e84d1ed8e12b8ed12aa023356566a6ad6492
Opcode Fuzzy Hash: e886fa97aa50dc187b916b7b25c0ecac5a363589fb5014501646a508a9d7915e
Instruction Fuzzy Hash: 99F065B5B083126BE614EBA8EC44F5B77ECDB84359F14491CF58DC7280EA30F80487A6

Function 1104B0C0 Relevance: 4.5, APIs: 3, Instructions: 21COMMON

Download Yara Rule

APIs

BN_free.LIBEAY32(00000000,00000000,1104AF3B,00000000,00000000,?,110F0A38), ref: 1104B0D0

Part of subcall function 11036580: CRYPTO_free.LIBEAY32(?,?,1103E44F,?,?,11034F50,?,?), ref: 11036596
Part of subcall function 11036580: CRYPTO_free.LIBEAY32(?,?,1103E44F,?,?,11034F50,?,?), ref: 110365A6

BN_free.LIBEAY32(?,00000000,1104AF3B,00000000,00000000,?,110F0A38), ref: 1104B0E0
CRYPTO_free.LIBEAY32(?,00000000,1104AF3B,00000000,00000000,?,110F0A38), ref: 1104B0E9

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free$N_free
String ID:
API String ID: 3352138966-0
Opcode ID: e1b10add8ec87b4193f2b13a27974313a1ba3aefebdce536583990f133cc5a21
Instruction ID: 5bc2a5dcb3a264474c1668edf480ccd5012649fef0b5efb2567f143e2da5abef
Opcode Fuzzy Hash: e1b10add8ec87b4193f2b13a27974313a1ba3aefebdce536583990f133cc5a21
Instruction Fuzzy Hash: EDD05BE6F01B1117F930D9247C4095736DC4E5065EB150474FC55D7A45F621F55482D2

Function 11097120 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000023,.\crypto\pem\pvkfmt.c,000001E8), ref: 110971E6

Part of subcall function 110969F0: BN_num_bits.LIBEAY32(?,?,11097154,?,?,?,?,?,110972F3,?,?,?,?,11097340,?,00000000), ref: 110969F5
Part of subcall function 110969F0: BN_num_bits.LIBEAY32(?), ref: 11096A08
Part of subcall function 110969F0: BN_num_bits.LIBEAY32(?), ref: 11096A1B
Part of subcall function 110969F0: BN_num_bits.LIBEAY32(?,?,?,?,?,?,00000000), ref: 11096A32

Part of subcall function 11096BE0: BN_num_bits.LIBEAY32(?,00000023,?,00000000,110972A2,?,?,?,?,?,?,?,?,00000000), ref: 11096BF1
Part of subcall function 11096BE0: BN_num_bits.LIBEAY32(?,?,00000023,?,00000000,110972A2,?,?,?,?,?,?,?,?,00000000), ref: 11096C0A
Part of subcall function 11096BE0: BN_num_bits.LIBEAY32(?,?,00000004,?,?,00000023,?,00000000,110972A2,?,?), ref: 11096C30
Part of subcall function 11096BE0: BN_bn2bin.LIBEAY32(?,00000023,?,?,00000004,?,?,00000023,?,00000000,110972A2,?,?), ref: 11096C49

Strings

.\crypto\pem\pvkfmt.c, xrefs: 110971E0

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N_num_bits$N_bn2binO_malloc
String ID: .\crypto\pem\pvkfmt.c
API String ID: 2375296132-3209138957
Opcode ID: 451a5e9cc0920ee1c4d4d6310ce99f07936223b58750092b60a80bc1d004f65c
Instruction ID: ab3f627f29ca0a418d92cab1052756ad6b6907d3a7d4d890f29358d34239df4f
Opcode Fuzzy Hash: 451a5e9cc0920ee1c4d4d6310ce99f07936223b58750092b60a80bc1d004f65c
Instruction Fuzzy Hash: 9351E5329083868FE305CF58D85061A7BD1EFA6204F0546ECE899DB352E674E949CBF2

Function 1104F040 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,00000001,0000001A,.\crypto\dh\dh_lib.c,000000E6), ref: 1104F056

Strings

.\crypto\dh\dh_lib.c, xrefs: 1104F049

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_add_lock
String ID: .\crypto\dh\dh_lib.c
API String ID: 3448054635-3248442889
Opcode ID: bee81663e5db6cfdaf44364228d53f21bd231abb45c2efcbfcbe52d61c460952
Instruction ID: da40a43b252a5fe7bd63ab49f6620decbf8bed6ea6ca17627a5cf213feadf74a
Opcode Fuzzy Hash: bee81663e5db6cfdaf44364228d53f21bd231abb45c2efcbfcbe52d61c460952
Instruction Fuzzy Hash: 91C08CB7F8A28033FA2884288D83FCE12825320B85F18082AF302F61C0D5AAC8105112

Function 1104B090 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000008,.\crypto\dsa\dsa_sign.c,0000005D,1104AF74), ref: 1104B099

Strings

.\crypto\dsa\dsa_sign.c, xrefs: 1104B092

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_malloc
String ID: .\crypto\dsa\dsa_sign.c
API String ID: 1457121658-2881127324
Opcode ID: 65cdb850b49e18948eae189c66213a8454847a5169a0afec6b9b391ed82d6a74
Instruction ID: cc87415c430ffcbb16d4891656a65dca0fb352087241254619cd0ea8bbe7f7f1
Opcode Fuzzy Hash: 65cdb850b49e18948eae189c66213a8454847a5169a0afec6b9b391ed82d6a74
Instruction Fuzzy Hash: E2C08C689003020AF300CB108D02F0236E02B40748FCA80909A089E1C1E6B890048640

Function 12010B40 Relevance: 3.2, APIs: 2, Instructions: 153COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBEAY32(?,12040470,00000008), ref: 12010BC2
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12010BEF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: E_get0_nameO_memcmpX509_
String ID:
API String ID: 1738548074-0
Opcode ID: ca1e5c33d639759d80a81043816d894a5f625a48f3b25feac0fda75df6faebac
Instruction ID: df9c80e456a529ef8762219adba0eedc04e208b05e96787eb8ca52917967e2a6
Opcode Fuzzy Hash: ca1e5c33d639759d80a81043816d894a5f625a48f3b25feac0fda75df6faebac
Instruction Fuzzy Hash: 3251C272B083168FD715CE25C480796F7E2EB84358F11876DE8968B681EB35F849DB90

Function 11037170 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

BN_clear_free.LIBEAY32(?,?,?,110373A0), ref: 1103718D

Part of subcall function 11036520: OPENSSL_cleanse.LIBEAY32(110356C9,4D8B1D74,110356C5,1103EB12,110356C9,?,110356C5,?), ref: 11036538
Part of subcall function 11036520: CRYPTO_free.LIBEAY32(?,110356C5,?), ref: 11036549
Part of subcall function 11036520: OPENSSL_cleanse.LIBEAY32(110356C5,00000014,00000000,110356C5,1103EB12,110356C9,?,110356C5,?), ref: 1103655B
Part of subcall function 11036520: CRYPTO_free.LIBEAY32(110356C5,?), ref: 11036569

CRYPTO_free.LIBEAY32(?,?,?,110373A0), ref: 110371A9

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$N_clear_free
String ID:
API String ID: 2912898125-0
Opcode ID: 849bd4945935cc1313b6e2392e3c373cb7819e3080e2a21ed1c1ea6955b9a904
Instruction ID: 666300725ffe8441dc0cd13d9a8d34b3e2bda17a687404cec6a35349604e93e6
Opcode Fuzzy Hash: 849bd4945935cc1313b6e2392e3c373cb7819e3080e2a21ed1c1ea6955b9a904
Instruction Fuzzy Hash: 7BF039F7D11A17AFE301CE18C840B96B7A6BB84306F1440B4D90917241E731A960C7D2

Function 110A1130 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32 ref: 110A113C
BUF_strdup.LIBEAY32(?), ref: 110A1149

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: F_strdupO_free
String ID:
API String ID: 2295947540-0
Opcode ID: a4702e17b058324fc2e12d0dcb168b3af299912c968e4552898d8a3a9b6d4dbb
Instruction ID: bc10b2d39d636e7cf2c7d976c0dce0311497842f7eab380388feec7dce34f82e
Opcode Fuzzy Hash: a4702e17b058324fc2e12d0dcb168b3af299912c968e4552898d8a3a9b6d4dbb
Instruction Fuzzy Hash: 42D05EF5E002025BEB00DE78AC0148B77EC9F04294B04483DB886C3200EA34F890C752

Function 110A1090 Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 110A0F80: sk_pop_free.LIBEAY32(?,?,?,?,110A10A0,?,1109AAAB,?), ref: 110A0FB0
Part of subcall function 110A0F80: sk_pop_free.LIBEAY32(?,?,?,?,110A10A0,?,1109AAAB,?), ref: 110A0FCA
Part of subcall function 110A0F80: CRYPTO_free.LIBEAY32(?,?,?,110A10A0,?,1109AAAB,?), ref: 110A0FDC
Part of subcall function 110A0F80: CRYPTO_free.LIBEAY32(?,?,?,110A10A0,?,1109AAAB,?), ref: 110A0FEF
Part of subcall function 110A0F80: CRYPTO_free.LIBEAY32(?,?,?,110A10A0,?,1109AAAB,?), ref: 110A1005

CRYPTO_free.LIBEAY32(?,?,1109AAAB,?), ref: 110A10A4
CRYPTO_free.LIBEAY32(?,?,?,1109AAAB,?), ref: 110A10AA

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free$sk_pop_free
String ID:
API String ID: 2355794056-0
Opcode ID: 3238c184898512ffc6158cc7acb48d995b6b664531b494480a3b75b7cbd39ddb
Instruction ID: de6c02916435e87b1d870a3f3253c605b98848bee532d28347b6d56907491372
Opcode Fuzzy Hash: 3238c184898512ffc6158cc7acb48d995b6b664531b494480a3b75b7cbd39ddb
Instruction Fuzzy Hash: 7FC08036E06631175501DA547C00DCF339C1F485587050544F8446B304DE74FDC143D6

Function 11019150 Relevance: 1.7, APIs: 1, Instructions: 243COMMON

Download Yara Rule

APIs

DES_encrypt1.LIBEAY32(?,?,00000001), ref: 11019258

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: S_encrypt1
String ID:
API String ID: 184137512-0
Opcode ID: ff9b15b52deca62ebaa38b0ca9071aa3c1004d55f718c4cf3a169315640dbf9a
Instruction ID: 73c3b4ed548069d19cec1cae304f3c66ba3c65a844eb60241c16afa879ab85e2
Opcode Fuzzy Hash: ff9b15b52deca62ebaa38b0ca9071aa3c1004d55f718c4cf3a169315640dbf9a
Instruction Fuzzy Hash: B581923060C3A68FD709CF29889022EFBE1EFD9350F444A5EE4E5DB281D679D945CB92

Function 11023080 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

CAST_encrypt.LIBEAY32(?,?), ref: 11023172

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: T_encrypt
String ID:
API String ID: 2450657872-0
Opcode ID: 6bcede52b035971eae6912ec877b7c76f91df850a1f53fc6270381ce685e8e52
Instruction ID: d4c585130b5b1991176514647dd1d45772cae86815610746f54f83e60e0126e4
Opcode Fuzzy Hash: 6bcede52b035971eae6912ec877b7c76f91df850a1f53fc6270381ce685e8e52
Instruction Fuzzy Hash: 1C51403560D3918FC309CB6D849055EFFE1AFEA104F884AAEF4D597352C624D909CBA2

Function 11017100 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DES_encrypt1.LIBEAY32(?,?,?), ref: 11017165

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: S_encrypt1
String ID:
API String ID: 184137512-0
Opcode ID: a08fb9c647ff2026b3a9567685b4ad8942b0e050a6e956218bce15a6e64da2ba
Instruction ID: 94bc23967bfde7424ca2a6b2ad78c062557cc2f4d46e597e4bcc4e1c375b61a1
Opcode Fuzzy Hash: a08fb9c647ff2026b3a9567685b4ad8942b0e050a6e956218bce15a6e64da2ba
Instruction Fuzzy Hash: 57114F2450C6D08ED34EC72D4895429BFD3DADB201B49C5DDE4E68B2AAC8388419CBB1

Function 11069180 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,.\crypto\mem_dbg.c,00000112), ref: 110691B4

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_free
String ID:
API String ID: 2581946324-0
Opcode ID: fd037761c2471a639a4499b5764c0a0aeacfc403afecfecb555e9c034b3a6739
Instruction ID: d6d8e56d86038648c081c506180877dc9072afb1232ff55ff026ea7705dbf482
Opcode Fuzzy Hash: fd037761c2471a639a4499b5764c0a0aeacfc403afecfecb555e9c034b3a6739
Instruction Fuzzy Hash: DDF0AF75A04711DFD314CB69E800897B3FAEFC8305B10896EE94A87A10E631F946CBA1

Function 1104F070 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_get_ex_new_index.LIBEAY32(00000008,?,?,?,?,?), ref: 1104F08B

Part of subcall function 11003E60: CRYPTO_lock.LIBEAY32(00000009,00000002,.\crypto\ex_data.c,000000C9), ref: 11003E77
Part of subcall function 11003E60: CRYPTO_lock.LIBEAY32(0000000A,00000002,.\crypto\ex_data.c,000000CC), ref: 11003EA0

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_lock$O_get_ex_new_index
String ID:
API String ID: 3549159141-0
Opcode ID: 81770565e4672e10a2e4cd25bcb26133c896d477ecc3dcc54f11202f72697cd9
Instruction ID: dd9bf0e00ae359131aa3624afe14a5a4186b7986f7a20db952ddd84b24607c5c
Opcode Fuzzy Hash: 81770565e4672e10a2e4cd25bcb26133c896d477ecc3dcc54f11202f72697cd9
Instruction Fuzzy Hash: 58D0C2B9618241BFE244DA48D891D2BB3E9ABD8754F40C94CB59987281D670AC048B72

Function 11005050 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f65996b6ae66981263cfd540a4a6a1d75c2676f988244983c9afcc62f16048b
Instruction ID: de62238587f1324dd2f97462d0c00b37de2a01c7f2dc869eec1d96310c18bab5
Opcode Fuzzy Hash: 0f65996b6ae66981263cfd540a4a6a1d75c2676f988244983c9afcc62f16048b
Instruction Fuzzy Hash: 7222D632E0C7684FD718CE2A8CD5165FBE3ABC4214F0E816DE8EA57246DD79540B87D4

Function 110311A0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f033f2cd575d1ad0939d04b59c5d0006a33a79247a5504789d9ec5a36d90ec0
Instruction ID: 9d55d2564ac5ab1c26220ed1b89e13f47eb3b09217a9ee307af589f5c08307eb
Opcode Fuzzy Hash: 8f033f2cd575d1ad0939d04b59c5d0006a33a79247a5504789d9ec5a36d90ec0
Instruction Fuzzy Hash: 5A8124B19187418FC718CF29C884AABBBF5FFC8314F548A6DE49A8B641D731E509CB52

Function 110310B0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384a583e0575bfec80ce4e2ae99ab5cfbb98b2bbcd6ad6e677d11979e4252054
Instruction ID: 51c091b532a6d0d8439cd6f2ad4218b28527727bb98ff77eaf512f6513c7c8ec
Opcode Fuzzy Hash: 384a583e0575bfec80ce4e2ae99ab5cfbb98b2bbcd6ad6e677d11979e4252054
Instruction Fuzzy Hash: 7121AC72A24B414FD310CE7988806E7BBF5BBC8222F154A6DE9A683A80DB31F5048B50

Function 12010DEB Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96be947ac8efdc2ce317c98567de75f083b6ad1bd4b85fce95430ec22506840e
Instruction ID: 399ce0dcc7f7db57af35775b4abbd81ce2d0554d8c912f6f37d3b3daeb0531c0
Opcode Fuzzy Hash: 96be947ac8efdc2ce317c98567de75f083b6ad1bd4b85fce95430ec22506840e
Instruction Fuzzy Hash: C111243A7083510FC715CE3A88E10ABFBD3ABDA204F499A6DD9C6CB342C920D80BD741

Function 1202EAF0 Relevance: 124.4, APIs: 60, Strings: 11, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EVP_des_cbc.LIBEAY32 ref: 1202EAF0
EVP_add_cipher.LIBEAY32(00000000), ref: 1202EAF6
EVP_des_ede3_cbc.LIBEAY32(00000000), ref: 1202EAFB
EVP_add_cipher.LIBEAY32(00000000,00000000), ref: 1202EB01
EVP_idea_cbc.LIBEAY32(00000000,00000000), ref: 1202EB06
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000), ref: 1202EB0C
EVP_rc4.LIBEAY32(00000000,00000000,00000000), ref: 1202EB11
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000), ref: 1202EB17
EVP_rc2_cbc.LIBEAY32(00000000,00000000,00000000,00000000), ref: 1202EB1C
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000), ref: 1202EB22
EVP_rc2_40_cbc.LIBEAY32(00000000,00000000,00000000,00000000,00000000), ref: 1202EB27
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB2D
EVP_aes_128_cbc.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB32
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB38
EVP_aes_192_cbc.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB3D
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB43
EVP_aes_256_cbc.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB48
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB4E
EVP_aes_128_gcm.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB53
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB59
EVP_aes_256_gcm.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB5E
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB64
i2d_X509_PKEY.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB69
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB6F
i2d_X509_PKEY.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB74
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB7A
i2d_X509_PKEY.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB7F
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB85
i2d_X509_PKEY.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB8A
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB90
EVP_camellia_128_cbc.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB95
EVP_add_cipher.LIBEAY32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1202EB9B
EVP_camellia_256_cbc.LIBEAY32 ref: 1202EBA3
EVP_add_cipher.LIBEAY32(00000000), ref: 1202EBA9
EVP_seed_cbc.LIBEAY32(00000000), ref: 1202EBAE
EVP_add_cipher.LIBEAY32(00000000,00000000), ref: 1202EBB4
EVP_md5.LIBEAY32(00000000,00000000), ref: 1202EBB9
EVP_add_digest.LIBEAY32(00000000,00000000,00000000), ref: 1202EBBF
OBJ_NAME_add.LIBEAY32(ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EBD3
OBJ_NAME_add.LIBEAY32(ssl3-md5,00008001,MD5,ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EBE7
EVP_sha1.LIBEAY32(ssl3-md5,00008001,MD5,ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EBEC
EVP_add_digest.LIBEAY32(00000000,ssl3-md5,00008001,MD5,ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EBF2
OBJ_NAME_add.LIBEAY32(ssl3-sha1,00008001,SHA1,00000000,ssl3-md5,00008001,MD5,ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EC06
OBJ_NAME_add.LIBEAY32(RSA-SHA1-2,00008001,RSA-SHA1,ssl3-sha1,00008001,SHA1,00000000,ssl3-md5,00008001,MD5,ssl2-md5,00008001,MD5,00000000,00000000,00000000), ref: 1202EC1A
EVP_sha224.LIBEAY32 ref: 1202EC22
EVP_add_digest.LIBEAY32(00000000), ref: 1202EC28
EVP_sha256.LIBEAY32(00000000), ref: 1202EC2D
EVP_add_digest.LIBEAY32(00000000,00000000), ref: 1202EC33
EVP_sha384.LIBEAY32(00000000,00000000), ref: 1202EC38
EVP_add_digest.LIBEAY32(00000000,00000000,00000000), ref: 1202EC3E
EVP_sha512.LIBEAY32(00000000,00000000,00000000), ref: 1202EC43
EVP_add_digest.LIBEAY32(00000000,00000000,00000000,00000000), ref: 1202EC49
EVP_dss1.LIBEAY32(00000000,00000000,00000000,00000000), ref: 1202EC4E
EVP_add_digest.LIBEAY32(00000000,00000000,00000000,00000000,00000000), ref: 1202EC54
OBJ_NAME_add.LIBEAY32(DSA-SHA1-old,00008001,DSA-SHA1,00000000,00000000,00000000,00000000,00000000), ref: 1202EC68
OBJ_NAME_add.LIBEAY32(DSS1,00008001,DSA-SHA1,DSA-SHA1-old,00008001,DSA-SHA1,00000000,00000000,00000000,00000000,00000000), ref: 1202EC7C
OBJ_NAME_add.LIBEAY32(dss1,00008001,DSA-SHA1,DSS1,00008001,DSA-SHA1,DSA-SHA1-old,00008001,DSA-SHA1,00000000,00000000,00000000,00000000,00000000), ref: 1202EC90
EVP_ecdsa.LIBEAY32(dss1,00008001,DSA-SHA1,DSS1,00008001,DSA-SHA1,DSA-SHA1-old,00008001,DSA-SHA1,00000000,00000000,00000000,00000000,00000000), ref: 1202EC95
EVP_add_digest.LIBEAY32(00000000,dss1,00008001,DSA-SHA1,DSS1,00008001,DSA-SHA1,DSA-SHA1-old,00008001,DSA-SHA1,00000000,00000000,00000000,00000000,00000000), ref: 1202EC9B
SSL_COMP_get_compression_methods.SSLEAY32 ref: 1202ECA3

Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(DES-CBC,1202ECAD), ref: 12027FF5
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028004
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028013
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028022
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028031
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028040
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202804F
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202805E
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202806D
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202807C
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202808B
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202809A
Part of subcall function 12027FF0: EVP_get_cipherbyname.LIBEAY32(id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280A9
Part of subcall function 12027FF0: EVP_get_digestbyname.LIBEAY32(MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280B8
Part of subcall function 12027FF0: EVP_MD_size.LIBEAY32(00000000,MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280C3
Part of subcall function 12027FF0: OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B5,ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0), ref: 120280E3
Part of subcall function 12027FF0: EVP_get_digestbyname.LIBEAY32(SHA1,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1202ECAD), ref: 120280F0
Part of subcall function 12027FF0: EVP_MD_size.LIBEAY32(00000000,SHA1), ref: 120280FB
Part of subcall function 12027FF0: OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B9,ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0), ref: 1202811B
Part of subcall function 12027FF0: EVP_get_digestbyname.LIBEAY32(md_gost94), ref: 12028128
Part of subcall function 12027FF0: EVP_MD_size.LIBEAY32(00000000), ref: 1202813A
Part of subcall function 12027FF0: OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001BF,ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0), ref: 1202815A
Part of subcall function 12027FF0: EVP_get_digestbyname.LIBEAY32(gost-mac), ref: 12028167
Part of subcall function 12027FF0: EVP_get_digestbyname.LIBEAY32(SHA256), ref: 12028196
Part of subcall function 12027FF0: EVP_MD_size.LIBEAY32(00000000,SHA256), ref: 120281A1

Strings

ssl2-md5, xrefs: 1202EBCE
dss1, xrefs: 1202EC8B
ssl3-md5, xrefs: 1202EBE2
DSA-SHA1, xrefs: 1202EC59, 1202EC6D, 1202EC81
RSA-SHA1-2, xrefs: 1202EC15
DSS1, xrefs: 1202EC77
MD5, xrefs: 1202EBC4, 1202EBD8
RSA-SHA1, xrefs: 1202EC0B
ssl3-sha1, xrefs: 1202EC01
DSA-SHA1-old, xrefs: 1202EC63
SHA1, xrefs: 1202EBF7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_add_cipher$P_get_cipherbyname$P_add_digest$E_add$P_get_digestbyname$D_sizeX509_i2d_$Open$P_aes_128_cbcP_aes_128_gcmP_aes_192_cbcP_aes_256_cbcP_aes_256_gcmP_camellia_128_cbcP_camellia_256_cbcP_des_cbcP_des_ede3_cbcP_dss1P_ecdsaP_get_compression_methodsP_idea_cbcP_md5P_rc2_40_cbcP_rc2_cbcP_rc4P_seed_cbcP_sha1P_sha224P_sha256P_sha384P_sha512
String ID: DSA-SHA1$DSA-SHA1-old$DSS1$MD5$RSA-SHA1$RSA-SHA1-2$SHA1$dss1$ssl2-md5$ssl3-md5$ssl3-sha1
API String ID: 1621996721-581511803
Opcode ID: 2baec109acf997531b6e8e05af666dbcdc739443e2a5b42ab0bcb09ba96c6716
Instruction ID: 35294fed563add02086dcf95eaf9a3c93bb99bd94f8dba18cd291da0830cecab
Opcode Fuzzy Hash: 2baec109acf997531b6e8e05af666dbcdc739443e2a5b42ab0bcb09ba96c6716
Instruction Fuzzy Hash: 0221779FAA42513DEAD3F3F24D4AEBED23D2D1E787B619B20B540BA0418C39B1543176

Function 1202E660 Relevance: 105.3, APIs: 29, Strings: 31, Instructions: 334COMMON

Download Yara Rule

APIs

BIO_puts.LIBEAY32(?,SSL-Session:), ref: 1202E679
BIO_printf.LIBEAY32(?, Protocol : %s,DTLSv1-bad), ref: 1202E703
BIO_printf.LIBEAY32(?, Cipher : %s,?), ref: 1202E755
BIO_puts.LIBEAY32(?, Session-ID: ), ref: 1202E76B
BIO_printf.LIBEAY32(?,%02X,?), ref: 1202E78E
BIO_puts.LIBEAY32(?, Session-ID-ctx: ), ref: 1202E7AA
BIO_printf.LIBEAY32(?,%02X,?), ref: 1202E7CD
BIO_puts.LIBEAY32(?, Master-Key: ), ref: 1202E7E9
BIO_printf.LIBEAY32(?,%02X,?), ref: 1202E80C
BIO_puts.LIBEAY32(?, Key-Arg : ), ref: 1202E828
BIO_puts.LIBEAY32(?,None), ref: 1202E845
BIO_puts.LIBEAY32(?, PSK identity: ), ref: 1202E888
BIO_printf.LIBEAY32(?,12043BD8,?), ref: 1202E8AE
BIO_puts.LIBEAY32(?, PSK identity hint: ), ref: 1202E8C4
BIO_printf.LIBEAY32(?,12043BD8,?), ref: 1202E8EA
BIO_puts.LIBEAY32(?, SRP username: ), ref: 1202E900
BIO_printf.LIBEAY32(?,12043BD8,?), ref: 1202E926
BIO_printf.LIBEAY32(?, TLS session ticket lifetime hint: %ld (seconds),?), ref: 1202E947
BIO_puts.LIBEAY32(?, TLS session ticket:), ref: 1202E966
BIO_dump_indent.LIBEAY32(?,?,?,00000004), ref: 1202E987
BIO_printf.LIBEAY32(?, Compression: %d,?), ref: 1202E9D3
BIO_printf.LIBEAY32(?, Compression: %d (%s),?,?), ref: 1202E9ED
BIO_printf.LIBEAY32(?, Start Time: %ld,?), ref: 1202EA0E
BIO_printf.LIBEAY32(?, Timeout : %ld (sec),?), ref: 1202EA2B
BIO_puts.LIBEAY32(?,12043AE8), ref: 1202EA3D
BIO_puts.LIBEAY32(?, Verify return code: ), ref: 1202EA4F
X509_verify_cert_error_string.LIBEAY32(?), ref: 1202EA62
BIO_printf.LIBEAY32(?,%ld (%s),?,00000000,?), ref: 1202EA75

Strings

TLS session ticket:, xrefs: 1202E960
Key-Arg : , xrefs: 1202E822
PSK identity hint: , xrefs: 1202E8BE
Start Time: %ld, xrefs: 1202EA08
Timeout : %ld (sec), xrefs: 1202EA25
Session-ID: , xrefs: 1202E765
Protocol : %s, xrefs: 1202E6FD
Compression: %d, xrefs: 1202E9CD
DTLSv1, xrefs: 1202E6D6
TLSv1.1, xrefs: 1202E6BA
None, xrefs: 1202E83F, 1202E8A2, 1202E8A7, 1202E8DE, 1202E8E3, 1202E91A, 1202E91F
SSL-Session:, xrefs: 1202E673
Session-ID-ctx: , xrefs: 1202E7A4
Cipher : %s, xrefs: 1202E74F
SSLv3, xrefs: 1202E69E
Compression: %d (%s), xrefs: 1202E9E7
%ld (%s), xrefs: 1202EA6F
Master-Key: , xrefs: 1202E7E3
Cipher : %04lX, xrefs: 1202E744
Cipher : %06lX, xrefs: 1202E739
unknown, xrefs: 1202E6F7, 1202E6FC
DTLSv1.2, xrefs: 1202E6E4
%02X, xrefs: 1202E788, 1202E7C7, 1202E806, 1202E866
DTLSv1-bad, xrefs: 1202E6F0
SSLv2, xrefs: 1202E690
TLS session ticket lifetime hint: %ld (seconds), xrefs: 1202E941
SRP username: , xrefs: 1202E8FA
Verify return code: , xrefs: 1202EA49
TLSv1, xrefs: 1202E6C8
TLSv1.2, xrefs: 1202E6AC
PSK identity: , xrefs: 1202E882

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_printf$O_puts$O_dump_indentX509_verify_cert_error_string
String ID: Compression: %d$ Compression: %d (%s)$ Key-Arg : $ Master-Key: $ PSK identity hint: $ PSK identity: $ SRP username: $ Session-ID-ctx: $ Start Time: %ld$ TLS session ticket lifetime hint: %ld (seconds)$ TLS session ticket:$ Timeout : %ld (sec)$ Cipher : %04lX$ Cipher : %06lX$ Cipher : %s$ Protocol : %s$ Session-ID: $ Verify return code: $%02X$%ld (%s)$DTLSv1$DTLSv1-bad$DTLSv1.2$None$SSL-Session:$SSLv2$SSLv3$TLSv1$TLSv1.1$TLSv1.2$unknown
API String ID: 3894298237-1121984357
Opcode ID: 00f9c78d5c11c397253e9135e0ae6756f877550590773ac4b0768028b3d3a5a5
Instruction ID: e4161d616db819d450100f187c335c45a457f37b3c6049ca4121712aceba185f
Opcode Fuzzy Hash: 00f9c78d5c11c397253e9135e0ae6756f877550590773ac4b0768028b3d3a5a5
Instruction Fuzzy Hash: 99A1CEA7BC02911AE612D7218D84FBBB3E86B51746FA4573AFD49D5201F710FD01B2A2

Function 12027FF0 Relevance: 87.6, APIs: 27, Strings: 23, Instructions: 108COMMON

Download Yara Rule

APIs

EVP_get_cipherbyname.LIBEAY32(DES-CBC,1202ECAD), ref: 12027FF5
EVP_get_cipherbyname.LIBEAY32(DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028004
EVP_get_cipherbyname.LIBEAY32(RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028013
EVP_get_cipherbyname.LIBEAY32(RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028022
EVP_get_cipherbyname.LIBEAY32(IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028031
EVP_get_cipherbyname.LIBEAY32(AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 12028040
EVP_get_cipherbyname.LIBEAY32(AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202804F
EVP_get_cipherbyname.LIBEAY32(CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202805E
EVP_get_cipherbyname.LIBEAY32(CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202806D
EVP_get_cipherbyname.LIBEAY32(gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202807C
EVP_get_cipherbyname.LIBEAY32(SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202808B
EVP_get_cipherbyname.LIBEAY32(id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 1202809A
EVP_get_cipherbyname.LIBEAY32(id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280A9
EVP_get_digestbyname.LIBEAY32(MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280B8
EVP_MD_size.LIBEAY32(00000000,MD5,id-aes256-GCM,id-aes128-GCM,SEED-CBC,gost89-cnt,CAMELLIA-256-CBC,CAMELLIA-128-CBC,AES-256-CBC,AES-128-CBC,IDEA-CBC,RC2-CBC,RC4,DES-EDE3-CBC,DES-CBC,1202ECAD), ref: 120280C3
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B5,ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0), ref: 120280E3
EVP_get_digestbyname.LIBEAY32(SHA1,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1202ECAD), ref: 120280F0
EVP_MD_size.LIBEAY32(00000000,SHA1), ref: 120280FB
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001B9,ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0), ref: 1202811B
EVP_get_digestbyname.LIBEAY32(md_gost94), ref: 12028128
EVP_MD_size.LIBEAY32(00000000), ref: 1202813A
OpenSSLDie.LIBEAY32(.\ssl\ssl_ciph.c,000001BF,ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0), ref: 1202815A
EVP_get_digestbyname.LIBEAY32(gost-mac), ref: 12028167
EVP_get_digestbyname.LIBEAY32(SHA256), ref: 12028196
EVP_MD_size.LIBEAY32(00000000,SHA256), ref: 120281A1
EVP_get_digestbyname.LIBEAY32(SHA384,00000000,SHA256), ref: 120281B0
EVP_MD_size.LIBEAY32(00000000,SHA384,00000000,SHA256), ref: 120281BB

Strings

AES-256-CBC, xrefs: 12028045
DES-CBC, xrefs: 12027FF0
ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0, xrefs: 1202814B
SHA256, xrefs: 12028191
DES-EDE3-CBC, xrefs: 12027FFA
gost-mac, xrefs: 12028162, 1202816C
CAMELLIA-256-CBC, xrefs: 12028063
IDEA-CBC, xrefs: 12028027
md_gost94, xrefs: 12028123
ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0, xrefs: 1202810C
.\ssl\ssl_ciph.c, xrefs: 120280DE, 12028116, 12028155
SHA1, xrefs: 120280EB
SHA384, xrefs: 120281A6
SEED-CBC, xrefs: 12028081
id-aes128-GCM, xrefs: 12028090
RC4, xrefs: 12028009
MD5, xrefs: 120280AE
RC2-CBC, xrefs: 12028018
ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0, xrefs: 120280D4
id-aes256-GCM, xrefs: 1202809F
gost89-cnt, xrefs: 12028072
CAMELLIA-128-CBC, xrefs: 12028054
AES-128-CBC, xrefs: 12028036

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_get_cipherbyname$P_get_digestbyname$D_size$Open
String ID: .\ssl\ssl_ciph.c$AES-128-CBC$AES-256-CBC$CAMELLIA-128-CBC$CAMELLIA-256-CBC$DES-CBC$DES-EDE3-CBC$IDEA-CBC$MD5$RC2-CBC$RC4$SEED-CBC$SHA1$SHA256$SHA384$gost-mac$gost89-cnt$id-aes128-GCM$id-aes256-GCM$md_gost94$ssl_mac_secret_size[SSL_MD_GOST94_IDX] >= 0$ssl_mac_secret_size[SSL_MD_MD5_IDX] >= 0$ssl_mac_secret_size[SSL_MD_SHA1_IDX] >= 0
API String ID: 2986206148-2187843582
Opcode ID: 261e087ccb26be8bcc2c66f8931fd1e7a89f4f92faedf6a965e306bca7758251
Instruction ID: 0cc9f94acf067f83bd11123ea392e7040fcbb7400ea75cb82054b84d413f48f8
Opcode Fuzzy Hash: 261e087ccb26be8bcc2c66f8931fd1e7a89f4f92faedf6a965e306bca7758251
Instruction Fuzzy Hash: 2B3121BBEC13516DE781EB70CD845EDB7B57B0C3097558B39E40496A41EF34A044BBA1

Function 12029C80 Relevance: 65.1, APIs: 2, Strings: 35, Instructions: 301COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000080,.\ssl\ssl_ciph.c,00000745), ref: 1202A080
BIO_snprintf.LIBEAY32(?,?,12041564,?,00000008,?,12042B68,AESGCM(128),unknown,12042BD4), ref: 1202A0DA

Strings

RC2(40), xrefs: 12029F82
RC2(56), xrefs: 12029F89
ECDSA, xrefs: 12029EAD
RC4(40), xrefs: 12029F49
SHA256, xrefs: 1202A032
AES(256), xrefs: 12029FA5
RC2(128), xrefs: 12029F90
RC4(128), xrefs: 12029F6D
.\ssl\ssl_ciph.c, xrefs: 1202A07A
DES(40), xrefs: 12029F20
GOST94, xrefs: 12029E30
RSA, xrefs: 12029D6E, 12029E56
None, xrefs: 12029E2B
3DES(168), xrefs: 12029F34
GOST89(256), xrefs: 12029FCA
SSLv3, xrefs: 12029D02
Camellia(128), xrefs: 12029FD8
AESGCM(128), xrefs: 1202A002, 1202A0CA
Camellia(256), xrefs: 12029FD1
IDEA(128), xrefs: 12029F97
AESGCM(256), xrefs: 12029FFB
unknown, xrefs: 12029CE9, 12029ECD, 12029FF4, 1202A060, 1202A0C5
RC4(56), xrefs: 12029F53
SHA1, xrefs: 1202A028
SHA384, xrefs: 1202A03C
SSLv2, xrefs: 12029CF3
DES(56), xrefs: 12029F2A
SEED(128), xrefs: 12029FDF
RC4(64), xrefs: 12029F63
Buffer too small, xrefs: 1202A0AA
AES(128), xrefs: 12029F9E
MD5, xrefs: 1202A01E
TLSv1.2, xrefs: 12029D0C
KRB5, xrefs: 12029D1D
OPENSSL_malloc Error, xrefs: 1202A091

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocO_snprintf
String ID: .\ssl\ssl_ciph.c$3DES(168)$AES(128)$AES(256)$AESGCM(128)$AESGCM(256)$Buffer too small$Camellia(128)$Camellia(256)$DES(40)$DES(56)$ECDSA$GOST89(256)$GOST94$IDEA(128)$KRB5$MD5$None$OPENSSL_malloc Error$RC2(128)$RC2(40)$RC2(56)$RC4(128)$RC4(40)$RC4(56)$RC4(64)$RSA$SEED(128)$SHA1$SHA256$SHA384$SSLv2$SSLv3$TLSv1.2$unknown
API String ID: 2516193342-2218918110
Opcode ID: 0e65da44fa39ebd5e6d4f772d7e49797ee73627436b4b03f8d59bb8c796d0e74
Instruction ID: 89aa287454b689f5491053f5cad6e2c5bc2d98329690f486f7d29e5e1ed5b1c9
Opcode Fuzzy Hash: 0e65da44fa39ebd5e6d4f772d7e49797ee73627436b4b03f8d59bb8c796d0e74
Instruction Fuzzy Hash: B0B1A4736083C9CBD611CE10D28065DBAE0AB48798FF08B6FDD865F641CB369985F792

Function 12018E50 Relevance: 61.7, APIs: 31, Strings: 4, Instructions: 497COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(0000008C,.\ssl\t1_enc.c,0000017A), ref: 12018EEF
EVP_CIPHER_CTX_init.LIBEAY32(00000000), ref: 12018F06
COMP_CTX_free.LIBEAY32(?), ref: 12018F3F
COMP_CTX_new.LIBEAY32(?), ref: 12018F55
CRYPTO_malloc.LIBEAY32(00004540,.\ssl\t1_enc.c,00000193), ref: 12018F95
EVP_CIPHER_CTX_new.LIBEAY32 ref: 1201900E
EVP_MD_CTX_create.LIBEAY32 ref: 12019037
COMP_CTX_free.LIBEAY32(?), ref: 12019055
COMP_CTX_new.LIBEAY32(?), ref: 1201906B
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120190EF
UI_get0_user_data.LIBEAY32(?), ref: 12019111
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019163
X509_TRUST_get0_name.LIBEAY32(?), ref: 12019185
X509_PURPOSE_get0_name.LIBEAY32(?,?,?,?), ref: 12019221
EVP_PKEY_new_mac_key.LIBEAY32(?,00000000,?), ref: 1201923F
EVP_DigestSignInit.LIBEAY32(?,00000000,?,00000000,00000000), ref: 12019260
EVP_PKEY_free.LIBEAY32(00000000), ref: 12019271
UI_get0_user_data.LIBEAY32(?), ref: 1201928C

Part of subcall function 120248A0: EVP_MD_CTX_destroy.LIBEAY32(?,?,1200CB00,?,?), ref: 120248AC
Part of subcall function 120248A0: EVP_MD_CTX_create.LIBEAY32(?,1200CB00,?,?), ref: 120248BA
Part of subcall function 120248A0: EVP_DigestInit_ex.LIBEAY32(00000000,1200CB00,00000000,?,1200CB00,?,?), ref: 120248D1

EVP_PKEY_free.LIBEAY32(00000000), ref: 12019359
ERR_put_error.LIBEAY32(00000014,000000D1,00000044,.\ssl\t1_enc.c,000001FE,00000000), ref: 12019371
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 120193A4
EVP_CipherInit_ex.LIBEAY32(?,?,00000000,?,00000000,?), ref: 120193CC
EVP_CIPHER_CTX_ctrl.LIBEAY32(?,00000012,?,?), ref: 120193E1
ERR_put_error.LIBEAY32(00000014,000000D1,00000041,.\ssl\t1_enc.c,00000274), ref: 1201945F
OPENSSL_cleanse.LIBEAY32(?,00000040), ref: 12019475
OPENSSL_cleanse.LIBEAY32(?,00000040,?,00000040), ref: 12019484
OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000040,?,00000040), ref: 12019490
OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000020,?,00000040,?,00000040), ref: 1201949C

Strings

IV block, xrefs: 12019328
server write key, xrefs: 120191C0
.\ssl\t1_enc.c, xrefs: 12018EE5, 12018F6C, 12018F8B, 12019082, 120190AE, 12019363, 12019451
client write key, xrefs: 120191E6, 120192C7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_cleanseX509_$E_get0_nameX_new$DigestI_get0_user_dataInit_exO_mallocR_put_errorX_createX_freeY_free$CipherInitSignT_get0_nameX_cleanupX_ctrlX_destroyX_initY_new_mac_key
String ID: .\ssl\t1_enc.c$IV block$client write key$server write key
API String ID: 2805114850-2198003478
Opcode ID: 8a876205d51a396a4c05cbfc7b5fcff62fe1011aa2bc8f20b8e99272e6ab6832
Instruction ID: 1f31d589f5f46df56df40eb958d6c993f51fd2232347215ff1f0f2ee443d58e7
Opcode Fuzzy Hash: 8a876205d51a396a4c05cbfc7b5fcff62fe1011aa2bc8f20b8e99272e6ab6832
Instruction Fuzzy Hash: 610291B66043459FE311DF50CC85FABB7E5AB88308F144A2CEA999F281E770F644DB52

Function 1202FB60 Relevance: 61.7, APIs: 34, Strings: 1, Instructions: 454COMMON

Download Yara Rule

APIs

SSL_shutdown.SSLEAY32 ref: 1202FBA2
SSL_set_connect_state.SSLEAY32 ref: 1202FBB6
SSL_clear.SSLEAY32 ref: 1202FBCC
BIO_ctrl.LIBEAY32(?,?,?,?), ref: 1202FBEB

Strings

.\ssl\bio_ssl.c, xrefs: 1202FCF1, 1202FDDE, 1202FE21

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_clearL_set_connect_stateL_shutdownO_ctrl
String ID: .\ssl\bio_ssl.c
API String ID: 215724878-1980322992
Opcode ID: 21d8fc88233fc7864e817dee0530d3a29e4336c177ae9baac59295abbd59bae2
Instruction ID: 52dd82985813bb45ca9265bf292b95540e6947dcfab142d84260f9a5eff3a54b
Opcode Fuzzy Hash: 21d8fc88233fc7864e817dee0530d3a29e4336c177ae9baac59295abbd59bae2
Instruction Fuzzy Hash: 74D1BCBB7013009FD701DF99E8809AAB3E4FB88766F50473AF94887641D721F815AAA1

Function 1200C8F0 Relevance: 61.7, APIs: 34, Strings: 1, Instructions: 409COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_enc.c,000000F3,120403E8), ref: 1200C94F
CRYPTO_malloc.LIBEAY32(0000008C,.\ssl\s3_enc.c,000000FF), ref: 1200C99A
EVP_CIPHER_CTX_init.LIBEAY32(00000000), ref: 1200C9B1
ERR_put_error.LIBEAY32(00000014,00000081,00000041,.\ssl\s3_enc.c,000001A4), ref: 1200C9EA
COMP_CTX_free.LIBEAY32(?), ref: 1200CA04
COMP_CTX_new.LIBEAY32(?), ref: 1200CA17
ERR_put_error.LIBEAY32(00000014,00000081,0000008E,.\ssl\s3_enc.c,00000116), ref: 1200CA3F
CRYPTO_malloc.LIBEAY32(00004000,.\ssl\s3_enc.c,0000011B), ref: 1200CA68
CRYPTO_malloc.LIBEAY32(0000008C,.\ssl\s3_enc.c,00000126), ref: 1200CABD
EVP_CIPHER_CTX_init.LIBEAY32(00000000), ref: 1200CAE1
COMP_CTX_free.LIBEAY32(?), ref: 1200CB1C
COMP_CTX_new.LIBEAY32(?), ref: 1200CB2F
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 1200CB77
EVP_MD_size.LIBEAY32(?), ref: 1200CB89
UI_get0_user_data.LIBEAY32(?), ref: 1200CBA2
X509_TRUST_get0_name.LIBEAY32(?), ref: 1200CBF3
EVP_MD_CTX_init.LIBEAY32(?), ref: 1200CC88
EVP_md5.LIBEAY32(00000000), ref: 1200CCB1
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200CCBC
EVP_DigestUpdate.LIBEAY32(?,?,00000000), ref: 1200CCD7
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200CCF3
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200CD0F
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200CD2B
EVP_md5.LIBEAY32(00000000), ref: 1200CD49
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200CD54
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200CD6C
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200CD84
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200CD9C
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200CDB3
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200CDC4
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200CDD9
EVP_CipherInit_ex.LIBEAY32(?,00000000,00000000,?,?,?,?), ref: 1200CE04
OPENSSL_cleanse.LIBEAY32(?,00000040), ref: 1200CE1B
OPENSSL_cleanse.LIBEAY32(?,00000010,?,00000040), ref: 1200CE27

Strings

.\ssl\s3_enc.c, xrefs: 1200C94A, 1200C990, 1200C9DC, 1200CA2E, 1200CA5E, 1200CAB3, 1200CAD4, 1200CB46

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$X_cleanup$Init_exO_mallocX_init$Final_exL_cleanseP_md5R_put_errorX_freeX_new$CipherD_sizeI_get0_user_dataOpenT_get0_nameX509_
String ID: .\ssl\s3_enc.c
API String ID: 3668226773-1985432667
Opcode ID: 1218d8c01f6cad37b25f2d3f20450bdd232b8234977fd05f94f3e5b1dc5da556
Instruction ID: f7ed554b9a4ea5c1b1b8e284908b344356d3902ab3fda3f1c7a7be9e17ee5e92
Opcode Fuzzy Hash: 1218d8c01f6cad37b25f2d3f20450bdd232b8234977fd05f94f3e5b1dc5da556
Instruction Fuzzy Hash: 0BE181B7A043419FF355DB64DC81FABB3F4AF88344F044A2DE5869B281EA70E504EB56

Function 12026170 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 214COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000014C,000000B3,.\ssl\ssl_cert.c,0000048A,?,?,?,?,1200BACF,?,?,?), ref: 120261AA
X509_STORE_new.LIBEAY32(?,?,?,?,1200BACF,?,?,?), ref: 120261C7
sk_num.LIBEAY32(?,?,?,?,?,1200BACF,?,?,?), ref: 120261DF
sk_value.LIBEAY32(?,00000000), ref: 120261F5
X509_STORE_add_cert.LIBEAY32(?,00000000,?,00000000), ref: 12026203
ERR_peek_last_error.LIBEAY32 ref: 1202620F
ERR_clear_error.LIBEAY32 ref: 12026236
sk_num.LIBEAY32(?), ref: 12026240
X509_STORE_add_cert.LIBEAY32(?,00000000), ref: 12026257
ERR_peek_last_error.LIBEAY32 ref: 12026263
ERR_clear_error.LIBEAY32 ref: 1202628A
X509_STORE_CTX_init.LIBEAY32(?,?,?,00000000,?,?,?,?,1200BACF,?,?,?), ref: 120262BB
ERR_put_error.LIBEAY32(00000014,0000014C,0000000B,.\ssl\ssl_cert.c,000004AE), ref: 120262DA
X509_STORE_free.LIBEAY32(?), ref: 1202642F

Strings

.\ssl\ssl_cert.c, xrefs: 12026199, 120262CC, 12026347
Verify error:, xrefs: 1202636E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$E_add_certR_clear_errorR_peek_last_errorR_put_errorsk_num$E_freeE_newX_initsk_value
String ID: .\ssl\ssl_cert.c$Verify error:
API String ID: 1253840708-3471143958
Opcode ID: 67835d0d3e170b28bd96c13ac749183f14745a3dee8d902bbb9b416ffdd07bd8
Instruction ID: 84971fd9e8511f43fad8fe1ad77c57b31f0f1f17ed7591d55e43666699731bef
Opcode Fuzzy Hash: 67835d0d3e170b28bd96c13ac749183f14745a3dee8d902bbb9b416ffdd07bd8
Instruction Fuzzy Hash: 0461B5B76043416FE663DBA48C40FFBB2F89F89306F448B39F98546141EA75E444A362

Function 12018830 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

EVP_MD_size.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?), ref: 12018893
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,000000AA,chunk >= 0), ref: 120188B0
EVP_MD_CTX_init.LIBEAY32(?), ref: 120188BD
EVP_MD_CTX_init.LIBEAY32(?,?), ref: 120188C7
EVP_MD_CTX_init.LIBEAY32(?,?,?), ref: 120188D1
EVP_MD_CTX_set_flags.LIBEAY32(?,00000008,?,?,?), ref: 120188DD
EVP_PKEY_new_mac_key.LIBEAY32(00000357,00000000,?,?,?,00000008,?,?,?), ref: 120188F2
EVP_DigestSignInit.LIBEAY32(?,00000000,?,00000000,00000000), ref: 12018911
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 1201892B
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1201894D
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018973
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018999
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 120189BF
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 120189E5
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018A07
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018A21
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018A43
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018A68
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018A8A
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018AB0
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018AD6
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018AFC
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12018B1E
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018B41
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018B74
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 12018B8A
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 12018BAE
EVP_PKEY_free.LIBEAY32(?), ref: 12018BDD
EVP_MD_CTX_cleanup.LIBEAY32(?,?), ref: 12018BE7
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?), ref: 12018BF1
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?,?), ref: 12018BFB
OPENSSL_cleanse.LIBEAY32(?,00000040,?,?,?,?), ref: 12018C0A

Strings

.\ssl\t1_enc.c, xrefs: 120188AB
chunk >= 0, xrefs: 120188A1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Sign$FinalX_copy_ex$X_cleanupX_init$D_sizeInitL_cleanseOpenX_set_flagsY_freeY_new_mac_key
String ID: .\ssl\t1_enc.c$chunk >= 0
API String ID: 2523695285-2139598294
Opcode ID: 7d2c253d562fec93ee4bbd688ab1aa6a0e78096e5e91d152bf732caab39f6d1c
Instruction ID: ef883baf7e197b7e5a7302c38baf424ab5e13d06de84e7d861db8c729d525ad1
Opcode Fuzzy Hash: 7d2c253d562fec93ee4bbd688ab1aa6a0e78096e5e91d152bf732caab39f6d1c
Instruction Fuzzy Hash: F6A12FB7504341AFE751DBA1CC80FABB3F8AF88345F044F1DB98596140EA75E608DB62

Function 12004540 Relevance: 56.4, APIs: 31, Strings: 1, Instructions: 390COMMON

Download Yara Rule

APIs

i2d_SSL_SESSION.SSLEAY32(?,00000000), ref: 12004583
CRYPTO_malloc.LIBEAY32(00000000,.\ssl\s3_srvr.c,00000D61), ref: 120045AC
EVP_CIPHER_CTX_init.LIBEAY32(?), ref: 120045C3
HMAC_CTX_init.LIBEAY32(?,?), ref: 120045D0
i2d_SSL_SESSION.SSLEAY32(?,?,?,?), ref: 120045E5

Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,00000001), ref: 1202CC3D
Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,?,?,00000001), ref: 1202CC5D
Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,?), ref: 1202CD88
Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,?), ref: 1202CDC4

d2i_SSL_SESSION.SSLEAY32(00000000,?,00000000), ref: 12004601

Part of subcall function 1202D4D0: asn1_GetSequence.LIBEAY32(?,?), ref: 1202D552
Part of subcall function 1202D4D0: ERR_put_error.LIBEAY32(0000000D,00000067,?,.\ssl\ssl_asn1.c,0000027E), ref: 1202E601
Part of subcall function 1202D4D0: asn1_add_error.LIBEAY32(00000000,?,0000000D,00000067,?,.\ssl\ssl_asn1.c,0000027E), ref: 1202E617
Part of subcall function 1202D4D0: SSL_SESSION_free.SSLEAY32(00000000), ref: 1202E630

i2d_SSL_SESSION.SSLEAY32 ref: 1200461D

Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,?), ref: 1202CE00
Part of subcall function 1202CB90: ASN1_INTEGER_set.LIBEAY32(?,?), ref: 1202CE9E
Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000), ref: 1202CF3F

i2d_SSL_SESSION.SSLEAY32(00000000,?,00000000,00000000), ref: 12004643

Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000,?,00000000), ref: 1202CF4C
Part of subcall function 1202CB90: i2d_ASN1_OCTET_STRING.LIBEAY32(?,00000000,?,00000000,?,00000000), ref: 1202CF59
Part of subcall function 1202CB90: i2d_ASN1_OCTET_STRING.LIBEAY32(?,00000000,?,00000000,?,00000000,?,00000000), ref: 1202CF69
Part of subcall function 1202CB90: i2d_ASN1_OCTET_STRING.LIBEAY32(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 1202CF79
Part of subcall function 1202CB90: i2d_ASN1_OCTET_STRING.LIBEAY32(?,00000000), ref: 1202CF91
Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000), ref: 1202CFAC
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000001,?,00000000), ref: 1202CFBA
Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000), ref: 1202CFD5
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000002,?,00000000), ref: 1202CFE3
Part of subcall function 1202CB90: i2d_X509.LIBEAY32(?,00000000), ref: 1202CFF9
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000003,?,00000000), ref: 1202D007
Part of subcall function 1202CB90: i2d_ASN1_OCTET_STRING.LIBEAY32(?,00000000), ref: 1202D01A
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000004,?,00000000), ref: 1202D026
Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000), ref: 1202D041
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000005,?,00000000), ref: 1202D04F
Part of subcall function 1202CB90: i2d_ASN1_INTEGER.LIBEAY32(?,00000000), ref: 1202D06A
Part of subcall function 1202CB90: ASN1_object_size.LIBEAY32(00000001,00000000,00000009,?,00000000), ref: 1202D078

BUF_MEM_grow.LIBEAY32(?,?,00000000,?,?,00000000,00000000), ref: 12004672
CRYPTO_free.LIBEAY32(00000000), ref: 12004745
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,00000000), ref: 1200474F
HMAC_CTX_cleanup.LIBEAY32(?,?,00000000), ref: 1200475C
RAND_bytes.LIBEAY32(?,00000010,?,?,?,?,?,00000000,00000000), ref: 1200478A
EVP_aes_128_cbc.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 120047AB
EVP_EncryptInit_ex.LIBEAY32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 120047B6
EVP_sha256.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 120047C8
HMAC_Init_ex.LIBEAY32(?,?,00000010,00000000,00000000), ref: 120047DF
X509_get_issuer_name.LIBEAY32(?), ref: 120048F7
X509_get_issuer_name.LIBEAY32(?,?,?,00000000,?), ref: 12004914
EVP_EncryptUpdate.LIBEAY32(?,?,?,00000000,?,?,?,?,00000000,?), ref: 12004930
EVP_EncryptFinal.LIBEAY32(?,?,?), ref: 12004957
HMAC_Update.LIBEAY32(?,?,?), ref: 1200497F
HMAC_Final.LIBEAY32(?,?,?), ref: 120049A1
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120049B6
HMAC_CTX_cleanup.LIBEAY32(?,?), ref: 120049C3
CRYPTO_free.LIBEAY32(00000000), ref: 12004A2D
SSL_SESSION_free.SSLEAY32(00000000,?,?,00000000,00000000), ref: 12004654

Part of subcall function 12026C00: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,00000358,?,12026E1B,?,?,?,12021577,?,00000000,?), ref: 12026C22
Part of subcall function 12026C00: CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026C3C
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026C47
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026C52
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026C5D
Part of subcall function 12026C00: X509_free.LIBEAY32(?), ref: 12026C83
Part of subcall function 12026C00: sk_free.LIBEAY32(?), ref: 12026C96
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CA9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CBC
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CD9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CF6
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D09
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D1C
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D2F
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 12026D3D
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12026D43

SSL_SESSION_free.SSLEAY32(00000000,00000000,00000000), ref: 12004A5E
CRYPTO_free.LIBEAY32(00000000), ref: 12004A67
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,00000000), ref: 12004A71
HMAC_CTX_cleanup.LIBEAY32(?,?,00000000), ref: 12004A7E

Strings

.\ssl\s3_srvr.c, xrefs: 120045A6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: i2d_$O_free$N1_object_sizeR_setX_cleanup$L_cleanse$EncryptN_free$FinalInit_exUpdateX509_get_issuer_nameX_init$D_bytesM_growO_add_lockO_free_ex_dataO_mallocP_aes_128_cbcP_sha256R_put_errorSequenceX509X509_freeasn1_asn1_add_errord2i_sk_free
String ID: .\ssl\s3_srvr.c
API String ID: 1633968417-3445611115
Opcode ID: c9fa052870428f9c3605b053922f3104ed7865b66af8dcdd3ce0419a0f24e3dc
Instruction ID: a57783f2aebda3f3d64f6ed6d87d65724f16a13e86732047c9894a8d7b60cf4f
Opcode Fuzzy Hash: c9fa052870428f9c3605b053922f3104ed7865b66af8dcdd3ce0419a0f24e3dc
Instruction Fuzzy Hash: 04F149B66043419FE351CF64C880BABB7F8FF89344F054A1DE99987241EB70E509DBA6

Function 120161B0 Relevance: 56.3, APIs: 31, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

HMAC_CTX_init.LIBEAY32(?,?,?,?,12018702,?,?,?), ref: 120161F9
EVP_CIPHER_CTX_init.LIBEAY32(?,?,?,?,?,12018702,?,?,?), ref: 12016203
EVP_sha256.LIBEAY32(00000000,?,?), ref: 12016278
HMAC_Init_ex.LIBEAY32(?,?,00000010,00000000,00000000,?,?), ref: 1201628F
EVP_aes_128_cbc.LIBEAY32(00000000,?,0000000A,?,?,?,?,?,?,?), ref: 120162AC
EVP_DecryptInit_ex.LIBEAY32(?,00000000,00000000,?,0000000A,?,?,?,?,?,?,?), ref: 120162B7
EVP_MD_size.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 120162CF
X509_get_issuer_name.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 120162E8
HMAC_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12016304
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201630E
HMAC_Update.LIBEAY32(?,-00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201633F
HMAC_Final.LIBEAY32(?,?,00000000), ref: 12016361
HMAC_CTX_cleanup.LIBEAY32(?), ref: 12016379
CRYPTO_memcmp.LIBEAY32(?,?,?,?), ref: 1201638F
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 120163A0
X509_get_issuer_name.LIBEAY32(?), ref: 120163CA
X509_get_issuer_name.LIBEAY32(?,?), ref: 120163DC
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,00000DEB,?,?), ref: 120163F5
EVP_DecryptUpdate.LIBEAY32(?,00000000,?,?,?), ref: 12016418
EVP_DecryptFinal.LIBEAY32(?,?,?), ref: 12016439
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 1201644A
CRYPTO_free.LIBEAY32(00000000,?), ref: 12016450
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 12016482
d2i_SSL_SESSION.SSLEAY32(00000000,?,?,?), ref: 12016497

Part of subcall function 1202D4D0: asn1_GetSequence.LIBEAY32(?,?), ref: 1202D552
Part of subcall function 1202D4D0: ERR_put_error.LIBEAY32(0000000D,00000067,?,.\ssl\ssl_asn1.c,0000027E), ref: 1202E601
Part of subcall function 1202D4D0: asn1_add_error.LIBEAY32(00000000,?,0000000D,00000067,?,.\ssl\ssl_asn1.c,0000027E), ref: 1202E617
Part of subcall function 1202D4D0: SSL_SESSION_free.SSLEAY32(00000000), ref: 1202E630

CRYPTO_free.LIBEAY32(00000000,00000000,?,?,?), ref: 120164A9
SSL_SESSION_free.SSLEAY32(00000000), ref: 12016511
ERR_clear_error.LIBEAY32 ref: 12016536
EVP_CIPHER_CTX_cleanup.LIBEAY32(?), ref: 1201655D
CRYPTO_free.LIBEAY32(00000000,?), ref: 12016563
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?), ref: 1201656F
HMAC_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 1201657C

Strings

.\ssl\t1_lib.c, xrefs: 120163EF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X_cleanup$DecryptO_freeX509_get_issuer_name$FinalInit_exN_freeUpdateX_init$D_sizeO_mallocO_memcmpP_aes_128_cbcP_sha256R_clear_errorR_put_errorSequenceasn1_asn1_add_errord2i_
String ID: .\ssl\t1_lib.c
API String ID: 465146920-2047370388
Opcode ID: edd50ab8f3402744687929bc69f7c050f96ed7a3e2331edb0f132e49aaf8f7e9
Instruction ID: 91d8ae6fe0d19013c7ba1d2e3ea8b5b55ff49d0d4d9c548670618eacc71cfa40
Opcode Fuzzy Hash: edd50ab8f3402744687929bc69f7c050f96ed7a3e2331edb0f132e49aaf8f7e9
Instruction Fuzzy Hash: 73A1B0B7A04340AFD365DB65CC41BEFB3E8AF88715F444A2DE5498A140EB35F604D7A2

Function 120264B0 Relevance: 54.6, APIs: 30, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000180,.\ssl\ssl_cert.c,000000DE,?,1202373E,?), ref: 120264CA
ERR_put_error.LIBEAY32(00000014,000000DD,00000041,.\ssl\ssl_cert.c,000000E0), ref: 120264EB
_memset.LIBCMT ref: 12026503
RSA_up_ref.LIBEAY32(00000000,00000000,00000180,?), ref: 12026568
DHparams_dup.LIBEAY32(?,00000000,?,00000000,00000180,?), ref: 1202658A
ERR_put_error.LIBEAY32(00000014,000000DD,00000005,.\ssl\ssl_cert.c,000000FF,?,00000000,00000180,?), ref: 120265AC
RSA_free.LIBEAY32(?,00000000,?,00000000,00000180,?), ref: 1202698B
DH_free.LIBEAY32(?,00000000,?,00000000,00000180,?), ref: 1202699B
EC_KEY_free.LIBEAY32(?,00000000,?,00000000,00000180,?), ref: 120269AB
CRYPTO_free.LIBEAY32(00000000,00000000,00000164,0000015C,00000000,?,00000000,00000180,?), ref: 120269D2

Strings

.\ssl\ssl_cert.c, xrefs: 120264C0, 120264DD, 1202659E, 120265D5, 1202663C, 1202668C, 120266B4, 120266FE, 1202678E, 120267D4, 120267F4, 12026828, 1202688A, 120268F8, 12026928

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$A_freeA_up_refH_freeHparams_dupO_freeO_mallocY_free_memset
String ID: .\ssl\ssl_cert.c
API String ID: 3746222461-3404700246
Opcode ID: 13e86b37c9497c62a262c0e6013d956ed19a91bf15846632bafb637e4b66a2b1
Instruction ID: 78d7110daaac5d7cda60de5956d770c4eeb7f9949568bcd0dc9d7543a72519f0
Opcode Fuzzy Hash: 13e86b37c9497c62a262c0e6013d956ed19a91bf15846632bafb637e4b66a2b1
Instruction Fuzzy Hash: FBE1ACB6B40701AFDB55CF64CC81BD6F3E4BB48704F44862AE94A9B680EB71F110DBA0

Function 12003B40 Relevance: 54.6, APIs: 30, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 12003B6E
X509_get_pubkey.LIBEAY32(?), ref: 12003BD1
BIO_free.LIBEAY32(?), ref: 12003FEC
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200400C
EVP_PKEY_free.LIBEAY32(00000000,?), ref: 12004012

Strings

.\ssl\s3_srvr.c, xrefs: 12003BFA, 12003CA0, 12003D24, 12003D83, 12003DA5, 12003DDD, 12003E05, 12003E51, 12003E9F, 12003ED2, 12003F05, 12003F38, 12003FAC

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeX509_get_pubkeyX_cleanupX_initY_free
String ID: .\ssl\s3_srvr.c
API String ID: 804101390-3445611115
Opcode ID: 610c9e6ba86ddfc028592b027ccef7c0986e67ac3521c31def09cc3c93b47abb
Instruction ID: 54519650d735b884a34c7f2fe0508a2eeeedc1adc41a948217d3e3845cb2d872
Opcode Fuzzy Hash: 610c9e6ba86ddfc028592b027ccef7c0986e67ac3521c31def09cc3c93b47abb
Instruction Fuzzy Hash: 08C10577A84345AFF313DB10CC45FABB3A4AB14745F000728FA45AB1C2E760E945E7A6

Function 12024280 Relevance: 52.8, APIs: 24, Strings: 6, Instructions: 263COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A9,000000C4,.\ssl\ssl_lib.c,00000761), ref: 120242A5
SSL_get_ex_data_X509_STORE_CTX_idx.SSLEAY32 ref: 120242B4
ERR_put_error.LIBEAY32(00000014,000000A9,0000010D,.\ssl\ssl_lib.c,0000076C), ref: 120242D3
ERR_put_error.LIBEAY32(00000014,000000A9,00000041,.\ssl\ssl_lib.c,00000821), ref: 1202463C
SSL_CTX_free.SSLEAY32(00000000), ref: 12024649

Strings

ssl2-md5, xrefs: 12024447
SSLv2, xrefs: 120243F2
.\ssl\ssl_lib.c, xrefs: 12024294, 120242C2, 120242E0, 120242F1, 12024463, 1202448E, 120244B9, 12024598, 120245D1, 120245F2, 1202462B
ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2, xrefs: 120243F9, 12024407
ssl3-md5, xrefs: 12024472
ssl3-sha1, xrefs: 1202449D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$L_get_ex_data_X509_X_freeX_idx
String ID: .\ssl\ssl_lib.c$ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2$SSLv2$ssl2-md5$ssl3-md5$ssl3-sha1
API String ID: 3383897061-2105291685
Opcode ID: f0834ae69fe46aca6f9699231aab0da62cc0b439a583adbb578faab0f4780ca2
Instruction ID: b43e9cb41667c8873ff79bdc8a026199e4309d31eda1da11298bbccfad1b5974
Opcode Fuzzy Hash: f0834ae69fe46aca6f9699231aab0da62cc0b439a583adbb578faab0f4780ca2
Instruction Fuzzy Hash: BFA1C4B6A40B009EE322DF258C85BD7FBF4EF84705F514A1FD5DA9A251E7B07000AB52

Function 11079050 Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 257COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 110790A5
d2i_PBEPARAM.LIBEAY32(00000000,?), ref: 110790DA

Part of subcall function 11090F70: ASN1_item_d2i.LIBEAY32(?,?,00000000,111113F4,110790DF,00000000,?), ref: 11090F84

ERR_put_error.LIBEAY32(00000006,00000075,00000072,.\crypto\evp\p5_crpt.c,00000063), ref: 110790F5

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 1107916D
EVP_DigestUpdate.LIBEAY32(?,?,00000000), ref: 11079184
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1107919F
PBEPARAM_free.LIBEAY32(00000000), ref: 110791B0
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000,00000000), ref: 110791C1
EVP_MD_size.LIBEAY32(?), ref: 110791D6

Strings

EVP_CIPHER_iv_length(cipher) <= 16, xrefs: 110792B4
EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp), xrefs: 11079276
.\crypto\evp\p5_crpt.c, xrefs: 110790EA, 11079280, 110792BE

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: Digest$Update$D_sizeFinal_exInit_exM_freeN1_item_d2iO_freeR_get_stateR_put_errorX_initd2i_
String ID: .\crypto\evp\p5_crpt.c$EVP_CIPHER_iv_length(cipher) <= 16$EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)
API String ID: 3378387796-1101013461
Opcode ID: 11fcf00cc7a6d1bf55f3539542f27137e3953e8cf8433b51597481af4342c35c
Instruction ID: e2975654fcee04c151e03dcdd73b141a4d6a7ae7586638eaa3e640400026561c
Opcode Fuzzy Hash: 11fcf00cc7a6d1bf55f3539542f27137e3953e8cf8433b51597481af4342c35c
Instruction Fuzzy Hash: E881C5BAD08301ABD710DB649C40FAFB3E8AB88314F45492DF98993245FA75E614C7A7

Function 110851D0 Relevance: 50.9, APIs: 22, Strings: 7, Instructions: 184COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(?,?,%*sTrusted Uses:%*s,?,110F1DCF,?,110F1DCF,?,?,?,?,110850F7,?,?,00000000), ref: 1108522A
BIO_puts.LIBEAY32(?,1110D834), ref: 11085243

Part of subcall function 11061130: ERR_put_error.LIBEAY32(00000020,0000006E,00000078,.\crypto\bio\bio_lib.c,0000010D,?,?,?,110612BC,?,110F9204,?,?,1107573F,?,00000000), ref: 1106117B

sk_value.LIBEAY32(?,00000000,00000000), ref: 11085258
OBJ_obj2txt.LIBEAY32(?,00000050,00000000), ref: 11085268
BIO_puts.LIBEAY32(?,?,?,00000050,00000000), ref: 11085273
sk_num.LIBEAY32(?,?,?,?,00000050,00000000), ref: 1108527C
BIO_puts.LIBEAY32(?,110F07EC), ref: 1108528E
BIO_printf.LIBEAY32(?,%*sTrusted Uses:%*s,?,110F1DCF,?,110F1DCF,?,?,?,?,110850F7,?,?,00000000), ref: 11085220

Part of subcall function 110655A0: BIO_vprintf.LIBEAY32(?,?,?,11003678,?,%ld bytes leaked in %d chunks,?,?), ref: 110655AF

BIO_printf.LIBEAY32(?,%*sNo Trusted Uses.,?,110F1DCF,?,?,?,?,110850F7,?,?,00000000), ref: 1108529F
BIO_printf.LIBEAY32 ref: 110852CB
sk_num.LIBEAY32(00000000), ref: 110852D6
BIO_puts.LIBEAY32(?,1110D834), ref: 110852EF
sk_value.LIBEAY32(00000000,00000000,00000000), ref: 11085305
OBJ_obj2txt.LIBEAY32(?,00000050,00000000,?,?,?,?,%*sRejected Uses:%*s,?,110F1DCF,?,110F1DCF), ref: 11085315
BIO_puts.LIBEAY32(?,?,?,00000050,00000000,?,?,?,?,%*sRejected Uses:%*s,?,110F1DCF,?,110F1DCF), ref: 11085320
sk_num.LIBEAY32(00000000,?,?,?,00000050,00000000,?,?,?,?,%*sRejected Uses:%*s,?,110F1DCF,?,110F1DCF), ref: 1108532A
BIO_puts.LIBEAY32(?,110F07EC,?,?,%*sRejected Uses:%*s,?,110F1DCF,?,110F1DCF), ref: 1108533C
BIO_printf.LIBEAY32(?,%*sNo Rejected Uses.,?,110F1DCF), ref: 1108534D
BIO_printf.LIBEAY32(?,%*sAlias: %s,?,110F1DCF,?), ref: 1108536C
BIO_printf.LIBEAY32(?,%*sKey Id: ,?,110F1DCF), ref: 11085386
BIO_printf.LIBEAY32(?,%s%02X,110F1800,00000000), ref: 110853B4
BIO_write.LIBEAY32(?,110F07EC,00000001), ref: 110853CC

Strings

%*sKey Id: , xrefs: 11085380
%s%02X, xrefs: 110853AE
%*sNo Rejected Uses., xrefs: 11085347
%*sAlias: %s, xrefs: 11085366
%*sTrusted Uses:%*s, xrefs: 11085215
%*sRejected Uses:%*s, xrefs: 110852C0
%*sNo Trusted Uses., xrefs: 11085299

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_printf$O_puts$sk_num$J_obj2txtsk_value$O_vprintfO_writeR_put_error
String ID: %*sAlias: %s$%*sKey Id: $%*sNo Rejected Uses.$%*sNo Trusted Uses.$%*sRejected Uses:%*s$%*sTrusted Uses:%*s$%s%02X
API String ID: 201746209-4209260575
Opcode ID: 5877ddf3efa05063942c7c0cf041b81225bd4ae5bea0ff7e0a82142ce5b65444
Instruction ID: 03aaa14ba72bc605fc5164d4f667182a17b8777da9e7f3ea829f9d545fc99cf0
Opcode Fuzzy Hash: 5877ddf3efa05063942c7c0cf041b81225bd4ae5bea0ff7e0a82142ce5b65444
Instruction Fuzzy Hash: 7A513579D083026FE211EA55CC81FAFB3ED9F86708F84455EF84456246FA76B904C7B2

Function 12023F50 Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,00000010,.\ssl\ssl_lib.c,00000239), ref: 12023F72
X509_VERIFY_PARAM_free.LIBEAY32(?), ref: 12023F8A
CRYPTO_free_ex_data.LIBEAY32(00000001,?,?), ref: 12023F9C
BIO_pop.LIBEAY32(?), ref: 12023FB3
BIO_free.LIBEAY32(?), ref: 12023FC2
BIO_free_all.LIBEAY32(?), ref: 12023FD9
BIO_free_all.LIBEAY32(?), ref: 12023FEE
BUF_MEM_free.LIBEAY32(?), ref: 12023FFE
sk_free.LIBEAY32(?), ref: 1202400E
sk_free.LIBEAY32(?), ref: 1202401E
SSL_SESSION_free.SSLEAY32(00000000,?), ref: 1202403C
EVP_MD_CTX_destroy.LIBEAY32(?), ref: 12024058
EVP_MD_CTX_destroy.LIBEAY32(?), ref: 12024075
CRYPTO_free.LIBEAY32(?), ref: 120240A5
SSL_CTX_free.SSLEAY32(?), ref: 120240B8
CRYPTO_free.LIBEAY32(?), ref: 120240CB
CRYPTO_free.LIBEAY32(?), ref: 120240DE
CRYPTO_free.LIBEAY32(?), ref: 120240F1
sk_pop_free.LIBEAY32(?,120319B0), ref: 12024109
sk_pop_free.LIBEAY32(?,120319BC), ref: 12024121
CRYPTO_free.LIBEAY32(?), ref: 12024134
CRYPTO_free.LIBEAY32(?), ref: 12024147
sk_pop_free.LIBEAY32(?,12031824), ref: 1202415F
SSL_CTX_free.SSLEAY32(?), ref: 12024182
CRYPTO_free.LIBEAY32(?), ref: 12024195
sk_free.LIBEAY32(?), ref: 120241A8
CRYPTO_free.LIBEAY32(?), ref: 120241B1

Strings

.\ssl\ssl_lib.c, xrefs: 12023F62

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$sk_freesk_pop_free$M_freeO_free_allX_destroyX_free$N_freeO_add_lockO_free_ex_dataO_popX509_
String ID: .\ssl\ssl_lib.c
API String ID: 957874568-3333140318
Opcode ID: 3c52f49e34f1e728bf7e9ff6afb01804511ee3fc203c3fa05e031f52af123550
Instruction ID: cf261fc76e28e948c8a6cd979b5e4efa0a06eba555d1284e0b21c6d4b90dfd43
Opcode Fuzzy Hash: 3c52f49e34f1e728bf7e9ff6afb01804511ee3fc203c3fa05e031f52af123550
Instruction Fuzzy Hash: C25170F7F007015BEA62CB719C45BA7B3F8AF14705F460A29E85BD7240EA34F514E662

Function 120196D0 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 375COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019708
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201971B
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019721
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,000002F9,n >= 0), ref: 1201973C
pqueue_peek.LIBEAY32(?), ref: 12019765
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019786
X509_TRUST_get0_name.LIBEAY32(?), ref: 120197A1
_fprintf.LIBCMT ref: 120197D2
RAND_bytes.LIBEAY32(?,00000000), ref: 120197E1
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201980E
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019821
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019827
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,00000318,n >= 0), ref: 12019842
X509_TRUST_get_flags.LIBEAY32 ref: 120198A2
X509_PURPOSE_get0_name.LIBEAY32(00000000), ref: 120198AE
EVP_CIPHER_CTX_ctrl.LIBEAY32(?,00000016,0000000D,00000008), ref: 12019990
EVP_Cipher.LIBEAY32(?,?,?,?), ref: 12019A3A
X509_PURPOSE_get0_name.LIBEAY32(?,?,?,?,?), ref: 12019A48
X509_PURPOSE_get0_name.LIBEAY32(?), ref: 12019A88
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019ABD
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019AD0
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019AD6

Strings

n >= 0, xrefs: 1201972D, 12019833
%s:%d: rec->data != rec->input, xrefs: 120197C4
.\ssl\t1_enc.c, xrefs: 12019737, 120197BF, 1201983D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$Y_get_object$E_get0_name$D_size$Open$CipherD_bytesT_get0_nameT_get_flagsX_ctrl_fprintfpqueue_peek
String ID: %s:%d: rec->data != rec->input$.\ssl\t1_enc.c$n >= 0
API String ID: 1325399572-3097570779
Opcode ID: 7c2d75b673550f5a5bdbfdbf61770333899a14ad98c29f0beb1eecaa109d8c47
Instruction ID: b0db5f1805e2bfc12b9747067e17a0bd6e82ba0476afb0df54893316bda611f5
Opcode Fuzzy Hash: 7c2d75b673550f5a5bdbfdbf61770333899a14ad98c29f0beb1eecaa109d8c47
Instruction Fuzzy Hash: 23D1F277A043458FD755CF68C8807ABB7E5BF88315F444A2DF88A8B241EB31E904D792

Function 12007990 Relevance: 44.1, APIs: 23, Strings: 2, Instructions: 335COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 120079BE
EVP_PKEY_CTX_new.LIBEAY32(?,00000000), ref: 120079F0
EVP_PKEY_sign_init.LIBEAY32(00000000), ref: 12007A07
EVP_sha1.LIBEAY32 ref: 12007A17
EVP_PKEY_CTX_ctrl.LIBEAY32(00000000,000000FF,000000F8,00000001,00000000,00000000), ref: 12007A29
ERR_clear_error.LIBEAY32 ref: 12007A53
BIO_ctrl.LIBEAY32(?,00000003,00000000,?), ref: 12007A86
EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 12007AB8
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12007AD3
EVP_SignFinal.LIBEAY32(?,?,?,?), ref: 12007AEE
ERR_put_error.LIBEAY32(00000014,00000099,00000044,.\ssl\s3_clnt.c,00000CD8), ref: 12007B36
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12007B47
EVP_PKEY_CTX_free.LIBEAY32(00000000,?), ref: 12007B4D
RSA_sign.LIBEAY32(00000072,?,00000024,?,?,?), ref: 12007B9D
ERR_put_error.LIBEAY32(00000014,00000099,00000004,.\ssl\s3_clnt.c,00000CF1), ref: 12007BBC
DSA_sign.LIBEAY32(?,?,00000014,?,?,?), ref: 12007BFF
ERR_put_error.LIBEAY32(00000014,00000099,0000000A,.\ssl\s3_clnt.c,00000CFE), ref: 12007C1E
ERR_put_error.LIBEAY32(00000014,00000099,00000044,.\ssl\s3_clnt.c,00000CC2), ref: 12007D01
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12007D6B
EVP_PKEY_CTX_free.LIBEAY32(00000000,?), ref: 12007D71

Strings

.\ssl\s3_clnt.c, xrefs: 12007B28, 12007B69, 12007BAE, 12007C10, 12007C71, 12007CF3
@, xrefs: 12007CBD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$A_signDigestX_cleanupX_free$FinalInit_exO_ctrlP_sha1R_clear_errorSignUpdateX_ctrlX_initX_newY_sign_init
String ID: .\ssl\s3_clnt.c$@
API String ID: 3225417783-226317790
Opcode ID: 89f7290343ca01f9c44fa0d9e616e75b5e3ed2716a01e5c3c4ec0b99c378d1dd
Instruction ID: 2fa8b55117e831f77b2d1160655eb9a96475a0d633f9d3c944768861cabf3f08
Opcode Fuzzy Hash: 89f7290343ca01f9c44fa0d9e616e75b5e3ed2716a01e5c3c4ec0b99c378d1dd
Instruction Fuzzy Hash: C5C1D177604342AFF315CB20CC81FABB7F9AB88744F044A1DFA865B291E674E505D7A2

Function 1200C680 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 1200C6B0
EVP_MD_CTX_set_flags.LIBEAY32(?,00000008,?), ref: 1200C6BC
EVP_MD_CTX_init.LIBEAY32(?,?,00000008,?), ref: 1200C6C6
OPENSSL_cleanse.LIBEAY32(?,00000014), ref: 1200C6DB
EVP_MD_CTX_cleanup.LIBEAY32(?,?,00000014), ref: 1200C6E5
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?,00000014), ref: 1200C6EF
_memset.LIBCMT ref: 1200C731
EVP_sha1.LIBEAY32(00000000), ref: 1200C73F
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200C74A
EVP_DigestUpdate.LIBEAY32(?,?,00000001), ref: 1200C765
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200C78C
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200C7AC
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200C7CD
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200C7E9
EVP_md5.LIBEAY32(00000000), ref: 1200C7FB
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200C806
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200C829
EVP_DigestUpdate.LIBEAY32(?,?,00000014), ref: 1200C845

Strings

.\ssl\s3_enc.c, xrefs: 1200C8AA
A, xrefs: 1200C6A9

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Init_exX_cleanupX_init$Final_exL_cleanseP_md5P_sha1X_set_flags_memset
String ID: .\ssl\s3_enc.c$A
API String ID: 2225596141-2546957612
Opcode ID: 0033950d6c21694e83d2f539e9eca81ffcc53dc760f5b51920c73bc1e924ca65
Instruction ID: c2527e94a8702ab90a3fbba4052261db362077a38c01b8b08ce35417ecadf452
Opcode Fuzzy Hash: 0033950d6c21694e83d2f539e9eca81ffcc53dc760f5b51920c73bc1e924ca65
Instruction Fuzzy Hash: C751A77B504300ABE341DB60DC41FABB3E9AB98784F444F2DBA5687140EB34F108D7A6

Function 1201FA70 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 331COMMON

Download Yara Rule

APIs

Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F953
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000), ref: 1201F95C
Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F98B
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000), ref: 1201F994
Part of subcall function 1201F940: SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201F9B9
Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,00000028,00000000,00000000), ref: 1201F9D3
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201F9DC
Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F9F4
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201F9FD
Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FA1E
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FA27
Part of subcall function 1201F940: SSL_get_wbio.SSLEAY32(?,0000002A,?,00000000), ref: 1201FA4E
Part of subcall function 1201F940: BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FA57

SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000,?,?,?,1201ABA0,?,00000016), ref: 1201FAA3
BIO_ctrl.LIBEAY32(00000000), ref: 1201FAAC
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000112,s->d1->mtu >= dtls1_min_mtu(s)), ref: 1201FAD5
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000118,s->init_num == (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH), ref: 1201FB09
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1201FB24
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201FB3D
EVP_MD_size.LIBEAY32(00000000,?), ref: 1201FB43
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1201FB61
X509_TRUST_get_flags.LIBEAY32 ref: 1201FB7C

Strings

s->init_num == (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH, xrefs: 1201FAFA
len == (unsigned int)ret, xrefs: 1201FD1D
s->d1->mtu >= dtls1_min_mtu(s), xrefs: 1201FAC6
.\ssl\d1_both.c, xrefs: 1201FAD0, 1201FB04, 1201FD27

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_wbioO_ctrl$OpenX509_X_flags$D_sizeL_ctrlT_get_flagsY_get_object
String ID: .\ssl\d1_both.c$len == (unsigned int)ret$s->d1->mtu >= dtls1_min_mtu(s)$s->init_num == (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH
API String ID: 3879861461-2432215641
Opcode ID: fb2b1f97d9ceed337ed9e5b48ba8e7380a8107828b7d2b9b5b00ad0c184849d6
Instruction ID: dcdbe5b8f2da482683e4a41d6ee3c430d7bdf183cc9afcc219a5952f46a29443
Opcode Fuzzy Hash: fb2b1f97d9ceed337ed9e5b48ba8e7380a8107828b7d2b9b5b00ad0c184849d6
Instruction Fuzzy Hash: F1B127779083408FD311CB28CC88BA6F7F5AF64318F18876DE9898F382E672E545D651

Function 1200D310 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(00000000), ref: 1200D365
pqueue_peek.LIBEAY32(00000000,00000000), ref: 1200D36B
ERR_put_error.LIBEAY32(00000014,0000011D,00000144,.\ssl\s3_enc.c,000002CF), ref: 1200D3AD

Part of subcall function 1200D120: CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D141
Part of subcall function 1200D120: ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D171

EVP_MD_CTX_init.LIBEAY32(?), ref: 1200D3CE
EVP_MD_CTX_set_flags.LIBEAY32(?,00000008,?), ref: 1200D3DA
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?,00000008,?), ref: 1200D3E5
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,00000008,?), ref: 1200D3EF
EVP_MD_size.LIBEAY32(00000000,?,?,?,?,00000008,?), ref: 1200D3F5
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D41F
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D442
EVP_DigestUpdate.LIBEAY32(?,1204E7B8,00000030), ref: 1200D45D
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D47C
X509_NAME_ENTRY_get_object.LIBEAY32(?,00000000), ref: 1200D493
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200D4A1
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D4C0
EVP_DigestUpdate.LIBEAY32(?,1204E7E8,00000030), ref: 1200D4D7
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D4F2
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D509
ERR_put_error.LIBEAY32(00000014,0000011D,00000044,.\ssl\s3_enc.c,000002E6), ref: 1200D528
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200D53D

Strings

.\ssl\s3_enc.c, xrefs: 1200D39C, 1200D51A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$R_put_errorX509_Y_get_object$Final_ex$D_sizeInit_exO_mallocX_cleanupX_copy_exX_initX_set_flagspqueue_peek
String ID: .\ssl\s3_enc.c
API String ID: 598271980-1985432667
Opcode ID: a7d057e3c6f448be36fc27fc815ce090c45a998c646efc25b0837d86658c0fbd
Instruction ID: ecfd0a61c74a4aab7463eabd17578f22e329a240ffc05c1744fe9a27691d6a8e
Opcode Fuzzy Hash: a7d057e3c6f448be36fc27fc815ce090c45a998c646efc25b0837d86658c0fbd
Instruction Fuzzy Hash: 0551A3BB504301ABE345DB64DC81FAFB3F9AB98345F444A2DF94687240EA35F5089B62

Function 1202C9F0 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBEAY32 ref: 1202C9FE
BIO_s_file.LIBEAY32 ref: 1202CA03
BIO_new.LIBEAY32(00000000), ref: 1202CA09
ERR_put_error.LIBEAY32(00000014,000000DC,00000007,.\ssl\ssl_rsa.c,000002B8), ref: 1202CA2A
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202CA42
ERR_put_error.LIBEAY32(00000014,000000DC,00000002,.\ssl\ssl_rsa.c,000002BD), ref: 1202CA61
BIO_free.LIBEAY32(00000000), ref: 1202CA6A

Strings

.\ssl\ssl_rsa.c, xrefs: 1202CA1C, 1202CA53, 1202CAA0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_fileR_clear_error
String ID: .\ssl\ssl_rsa.c
API String ID: 503379859-614043423
Opcode ID: 980c7630391b434e60d14eb0515ef0b674964c2153f1911f6cba55f8094b2950
Instruction ID: c4ba08e7df21b0d691cb03b93022d3a08e479fa2c8caef11b693e8aa21e50b19
Opcode Fuzzy Hash: 980c7630391b434e60d14eb0515ef0b674964c2153f1911f6cba55f8094b2950
Instruction Fuzzy Hash: 9F410BBBB803417EF153D3A44C46FBBB2BC8B84716F550729FA42662C1FE65F41062A2

Function 12025A90 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

sk_new.LIBEAY32(12025A70), ref: 12025AAD
BIO_s_file.LIBEAY32(12025A70), ref: 12025AB4
BIO_new.LIBEAY32(00000000,12025A70), ref: 12025ABA
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 12025ADE
PEM_read_bio_X509.LIBEAY32(00000000,?,00000000,00000000), ref: 12025AF6
sk_new_null.LIBEAY32 ref: 12025B0A
X509_get_subject_name.LIBEAY32(?), ref: 12025B1A
X509_NAME_dup.LIBEAY32(00000000), ref: 12025B27
sk_find.LIBEAY32(00000000,00000000), ref: 12025B37
X509_NAME_free.LIBEAY32(00000000), ref: 12025B44
sk_push.LIBEAY32(00000000,00000000), ref: 12025B4F
sk_push.LIBEAY32(00000000,00000000,00000000,00000000), ref: 12025B56
PEM_read_bio_X509.LIBEAY32(00000000,?,00000000,00000000), ref: 12025B68
ERR_put_error.LIBEAY32(00000014,000000B9,00000041,.\ssl\ssl_cert.c,00000382), ref: 12025B89
sk_pop_free.LIBEAY32(00000000,Function_00031824), ref: 12025B9B
sk_free.LIBEAY32(00000000), ref: 12025BAA
BIO_free.LIBEAY32(00000000), ref: 12025BB7
X509_free.LIBEAY32(?), ref: 12025BC8
ERR_clear_error.LIBEAY32 ref: 12025BD4
ERR_put_error.LIBEAY32(00000014,000000B9,00000041,.\ssl\ssl_cert.c,00000375), ref: 12025BF4

Strings

.\ssl\ssl_cert.c, xrefs: 12025B7B, 12025BE6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_read_bio_R_put_errorX509X509_sk_push$E_dupE_freeO_ctrlO_freeO_newO_s_fileR_clear_errorX509_freeX509_get_subject_namesk_findsk_freesk_newsk_new_nullsk_pop_free
String ID: .\ssl\ssl_cert.c
API String ID: 2244018195-3404700246
Opcode ID: bc96ea04ca8b7c77e23bd5e82dea8ea863a5c9ee93c23856312e1ad47eefc050
Instruction ID: a2a38224bbe43637242d05e58b906e5b6052b5452de0ccb283d83a5e7722985b
Opcode Fuzzy Hash: bc96ea04ca8b7c77e23bd5e82dea8ea863a5c9ee93c23856312e1ad47eefc050
Instruction Fuzzy Hash: 9A3107FBA003012BF647E2A46C42FFBA9BC8F94746F890725BE0755181FA63E51471B6

Function 12030980 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

BN_dup.LIBEAY32(?), ref: 12030A28
BN_dup.LIBEAY32(?), ref: 12030A49
BN_dup.LIBEAY32(?), ref: 12030A6A
BN_dup.LIBEAY32(?), ref: 12030A8B
BN_dup.LIBEAY32(?), ref: 12030AA8
BN_dup.LIBEAY32(?), ref: 12030AC5
BN_dup.LIBEAY32(?), ref: 12030AE2
BN_dup.LIBEAY32(?), ref: 12030AFF
BUF_strdup.LIBEAY32(?), ref: 12030B2E
ERR_put_error.LIBEAY32(00000014,00000139,00000044,.\ssl\tls_srp.c,000000B5), ref: 12030B57
CRYPTO_free.LIBEAY32(?), ref: 12030B66
BN_free.LIBEAY32(?,?), ref: 12030B72
BN_free.LIBEAY32(?,?,?), ref: 12030B7E
BN_free.LIBEAY32(?,?,?,?), ref: 12030B8A
BN_free.LIBEAY32(?,?,?,?,?), ref: 12030B96
BN_free.LIBEAY32(?,?,?,?,?,?), ref: 12030BA2
BN_free.LIBEAY32(?,?,?,?,?,?,?), ref: 12030BAE
BN_free.LIBEAY32(?,?,?,?,?,?,?,?), ref: 12030BBA
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 12030BC6

Strings

.\ssl\tls_srp.c, xrefs: 12030B16, 12030B49

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_dupN_free$F_strdupO_freeR_put_error
String ID: .\ssl\tls_srp.c
API String ID: 3179395272-3972901604
Opcode ID: faecc18638428bd04df3146afcede789208e0a3319be521024efa1c4fadf4608
Instruction ID: 407e7f36ce8f96c29f82eb6967dfa67b4eca0f2ffec902b8d76d7ea9f1546bfd
Opcode Fuzzy Hash: faecc18638428bd04df3146afcede789208e0a3319be521024efa1c4fadf4608
Instruction Fuzzy Hash: E451F8B6A05B429FDB56DF788880AE7F2F5BB09306F104E3DE56AC7200E731B4549B81

Function 12006360 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32 ref: 120063FD
ERR_put_error.LIBEAY32(00000014,00000090,00000041,.\ssl\s3_clnt.c,000004BD), ref: 1200641F
ERR_put_error.LIBEAY32(00000014,00000090,000000EF,.\ssl\s3_clnt.c,00000521,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120066DE
CRYPTO_add_lock.LIBEAY32(00000010,00000001,00000003,.\ssl\s3_clnt.c,00000538), ref: 12006713
X509_free.LIBEAY32(?), ref: 12006731
X509_free.LIBEAY32(?), ref: 1200674F
CRYPTO_add_lock.LIBEAY32(00000010,00000001,00000003,.\ssl\s3_clnt.c,00000544), ref: 12006769
EVP_PKEY_free.LIBEAY32(?), ref: 120067D1
X509_free.LIBEAY32(00000005,?), ref: 120067DB
sk_pop_free.LIBEAY32(?,Function_000316CE,00000005,?), ref: 120067EA

Strings

.\ssl\s3_clnt.c, xrefs: 120063E9, 12006411, 12006457, 12006536, 1200655B, 12006574, 1200658D, 120065A3, 1200665F, 12006690, 120066C0, 12006703, 1200675C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_free$O_add_lockR_put_error$Y_freesk_new_nullsk_pop_free
String ID: .\ssl\s3_clnt.c
API String ID: 800983268-2155475665
Opcode ID: 37c2fb9036f5aacf79722627f9a43061b1aae8e8cb74489adf4a265cb9ab44c8
Instruction ID: 33adad5d9ea4fb2705f6ae47f6c3ecde5817d83df845115bcd66f037cd468a20
Opcode Fuzzy Hash: 37c2fb9036f5aacf79722627f9a43061b1aae8e8cb74489adf4a265cb9ab44c8
Instruction Fuzzy Hash: D9C12272A04301AFF701CF54CC84FAAB7E5AB44345F144779F9896B282D670E504EBA5

Function 1202C050 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202C0CB
BIO_new.LIBEAY32(00000000), ref: 1202C0D1
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202C0F8
ERR_put_error.LIBEAY32(00000014,00000151,00000043,.\ssl\ssl_rsa.c,000003CB), ref: 1202C2DD
CRYPTO_free.LIBEAY32(?), ref: 1202C2EA
CRYPTO_free.LIBEAY32(?,?), ref: 1202C2F4
CRYPTO_free.LIBEAY32(?,?,?), ref: 1202C2FE
CRYPTO_free.LIBEAY32(00000000,?,?,?), ref: 1202C304
BIO_free.LIBEAY32(?), ref: 1202C319

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C0E6, 1202C109, 1202C1D2, 1202C268, 1202C28E, 1202C29F, 1202C2B0, 1202C2BE, 1202C2CF
SERVERINFO FOR , xrefs: 1202C065

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_ctrlO_newO_s_fileR_put_error
String ID: .\ssl\ssl_rsa.c$SERVERINFO FOR
API String ID: 775051240-3219124774
Opcode ID: a2c6c82c24b77d65fed5375cbe4f3ed04d4c8520694628086a4196902b61e330
Instruction ID: 208a93f4e483c159839fe8003ebf9ba421c593f0ad97a3c12b9c5c53c4fc3ece
Opcode Fuzzy Hash: a2c6c82c24b77d65fed5375cbe4f3ed04d4c8520694628086a4196902b61e330
Instruction Fuzzy Hash: F571C7B3648341AFD341CFA4CC81EABB7E9BB88704F554B2EF58697140EA70E6449B52

Function 11059130 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

EC_POINT_is_at_infinity.LIBEAY32(?,?), ref: 11059167

Part of subcall function 11052380: ERR_put_error.LIBEAY32(00000010,00000076,00000042,.\crypto\ec\ec_lib.c,000003C3), ref: 1105239E

ERR_put_error.LIBEAY32(00000010,000000B1,0000006A,.\crypto\ec\ec_key.c,00000133), ref: 11059186

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

BN_CTX_new.LIBEAY32 ref: 11059196
EC_POINT_new.LIBEAY32(?), ref: 110591AA
EC_POINT_is_on_curve.LIBEAY32(?,?,00000000), ref: 110591C5
ERR_put_error.LIBEAY32(00000010,000000B1,0000006B,.\crypto\ec\ec_key.c,0000013E), ref: 110591E4
BN_CTX_free.LIBEAY32(00000000), ref: 11059300
EC_POINT_free.LIBEAY32(00000000), ref: 1105930D
ERR_put_error.LIBEAY32(00000010,000000B1,00000043,.\crypto\ec\ec_key.c,0000012E), ref: 11059331

Strings

.\crypto\ec\ec_key.c, xrefs: 11059178, 110591D6, 11059203, 11059271, 110592AB, 110592DE, 11059323

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_stateT_freeT_is_at_infinityT_is_on_curveT_newX_freeX_new
String ID: .\crypto\ec\ec_key.c
API String ID: 979443285-3738767715
Opcode ID: 085c551c40d233c6e99cb779505d79f4f2750992e470160cd9c0536521cd19a8
Instruction ID: e2ef884f42b27596492e64ae995e02c55a9dc8c051c7e9ef9b3898a4a88700e9
Opcode Fuzzy Hash: 085c551c40d233c6e99cb779505d79f4f2750992e470160cd9c0536521cd19a8
Instruction Fuzzy Hash: 7241D6B9F4034677F6E0E6559D43FA736989B41B5CF004458FE4AAA2C2FAB1F5408162

Function 12022860 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000C,.\ssl\ssl_lib.c,00000842), ref: 1202287F
X509_VERIFY_PARAM_free.LIBEAY32(?), ref: 1202289A
SSL_CTX_flush_sessions.SSLEAY32(?,00000000), ref: 120228AB
CRYPTO_free_ex_data.LIBEAY32(00000002,?,?), ref: 120228BD
lh_free.LIBEAY32(00000000), ref: 120228CD
X509_STORE_free.LIBEAY32(?), ref: 120228DD
sk_free.LIBEAY32(?), ref: 120228ED
sk_free.LIBEAY32(?), ref: 120228FD
sk_pop_free.LIBEAY32(?,12031824), ref: 12022928
sk_pop_free.LIBEAY32(?,Function_000316CE), ref: 12022940
sk_free.LIBEAY32(?), ref: 1202295D
CRYPTO_free.LIBEAY32(?), ref: 12022970
SSL_CTX_SRP_CTX_free.SSLEAY32(?), ref: 12022979
ENGINE_finish.LIBEAY32(?), ref: 1202298C
CRYPTO_free.LIBEAY32(?), ref: 120229BF
CRYPTO_free.LIBEAY32(?), ref: 120229D2
CRYPTO_free.LIBEAY32(?), ref: 120229E5
CRYPTO_free.LIBEAY32(?), ref: 120229EE

Strings

.\ssl\ssl_lib.c, xrefs: 12022872

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$sk_free$X509_sk_pop_free$E_finishE_freeM_freeO_add_lockO_free_ex_dataX_flush_sessionsX_freelh_free
String ID: .\ssl\ssl_lib.c
API String ID: 880251562-3333140318
Opcode ID: 6854d3fbaf5a97c30807bd3416cfb497dd8f748f76025eb1c6258390c84898a6
Instruction ID: 7f836d557c535808cdf2aa5ac7551d96e51ffa3a0555a508149646280480d358
Opcode Fuzzy Hash: 6854d3fbaf5a97c30807bd3416cfb497dd8f748f76025eb1c6258390c84898a6
Instruction Fuzzy Hash: A34190F7E007015FEB52CBB59C05BE7B2EC6F14705F850A39E85AE7240FA25F514A2A2

Function 120095E0 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 392COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000087,00000106,.\ssl\s3_clnt.c,00000846,?,00000002,0000000A), ref: 120096A1
ERR_put_error.LIBEAY32(00000014,00000087,000000E8,.\ssl\s3_clnt.c,0000084F,?,00000002,0000000A), ref: 120096E9
sk_new.LIBEAY32(Function_00025A70), ref: 12009709
CRYPTO_free.LIBEAY32(?), ref: 12009741
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_clnt.c,00000863), ref: 1200976B

Part of subcall function 1200E3D0: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E41A

sk_pop_free.LIBEAY32(?,Function_00031824), ref: 12009A8D
X509_NAME_free.LIBEAY32(?), ref: 12009AB3
sk_pop_free.LIBEAY32(?,Function_00031824), ref: 12009AC9
ERR_put_error.LIBEAY32(00000014,00000087,00000084,.\ssl\s3_clnt.c,000008A2,?,00000002,00000032), ref: 12009AFD
ERR_clear_error.LIBEAY32 ref: 12009B37
ERR_put_error.LIBEAY32(00000014,00000087,00000041,.\ssl\s3_clnt.c,000008C2), ref: 12009B87

Part of subcall function 1200D120: CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D141
Part of subcall function 1200D120: ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D171

Strings

.\ssl\s3_clnt.c, xrefs: 12009690, 120096D8, 12009765, 12009826, 12009934, 12009984, 120099B8, 12009AEC, 12009B50, 12009B68, 12009B79

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_mallocsk_pop_free$E_freeO_freeR_clear_errorX509_X_remove_sessionsk_new
String ID: .\ssl\s3_clnt.c
API String ID: 2789717944-2155475665
Opcode ID: 1e9920e164ddf1c7814243886f48951c1a266837117bc2825b90fcf7a854094c
Instruction ID: bbadc3df8dcacb1777cc4ce74d34447a2a4b8901ac2922714f233caf9e665350
Opcode Fuzzy Hash: 1e9920e164ddf1c7814243886f48951c1a266837117bc2825b90fcf7a854094c
Instruction Fuzzy Hash: F2E1E172644300AFF356CF24CC85FA6B7E0BF44B44F008B2DE58A6A782D7B1A544DB95

Function 12004030 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000089,000000C7,.\ssl\s3_srvr.c,00000C9A), ref: 120040BC

Part of subcall function 1200E3D0: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E41A

ERR_put_error.LIBEAY32(00000014,00000089,000000E9,.\ssl\s3_srvr.c,00000CA3), ref: 12004100
ERR_put_error.LIBEAY32(00000014,00000089,00000106,.\ssl\s3_srvr.c,00000CAD), ref: 12004155
X509_free.LIBEAY32(?), ref: 1200444F
sk_pop_free.LIBEAY32(?,Function_000316CE), ref: 12004465
sk_pop_free.LIBEAY32(?,Function_000316CE), ref: 12004486

Strings

.\ssl\s3_srvr.c, xrefs: 120040AB, 120040EF, 1200413F, 120041BA, 12004211, 120042C9, 12004304, 12004387, 12004429

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_pop_free$X509_freeX_remove_session
String ID: .\ssl\s3_srvr.c
API String ID: 2042108797-3445611115
Opcode ID: 7a56c4bafc42ac8b932ddb556bb9f0551685f8c41b31ca4bd9aec3cc46456635
Instruction ID: 8aad7b51acc3d3ad040125090ac7c9f893fbf3ae9dd974236029a8c3744425e2
Opcode Fuzzy Hash: 7a56c4bafc42ac8b932ddb556bb9f0551685f8c41b31ca4bd9aec3cc46456635
Instruction Fuzzy Hash: 5DB1247BB40300ABF202DB10DC85FAA77E4EB44781F0A4779FD496B2C2D671A504E6A9

Function 12024900 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000BA,000000C3,.\ssl\ssl_lib.c,0000012B), ref: 1202491F
ERR_put_error.LIBEAY32(00000014,000000BA,000000E4,.\ssl\ssl_lib.c,0000012F), ref: 12024947

Strings

.\ssl\ssl_lib.c, xrefs: 1202490E, 12024936, 1202495B, 12024A24, 12024A86, 12024AAC, 12024B8A, 12024BF8
s->sid_ctx_length <= sizeof s->sid_ctx, xrefs: 12024A1A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_lib.c$s->sid_ctx_length <= sizeof s->sid_ctx
API String ID: 1767461275-2654578500
Opcode ID: b446bdbeb6c767b14d8bd26a84b0c4dd5b2a1f6a104fa8e1ae57e50fbd3c1ec3
Instruction ID: 46d77672ce8ee07beebffaac3e9f1fbb4d78131e09a41d4241e6b8d938db09ff
Opcode Fuzzy Hash: b446bdbeb6c767b14d8bd26a84b0c4dd5b2a1f6a104fa8e1ae57e50fbd3c1ec3
Instruction Fuzzy Hash: 77915AB6A402449FEB61DF24CCC1BDA77B4BB48704F45867AED0D9F286E770A540DBA0

Function 12025C00 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

sk_set_cmp_func.LIBEAY32(?,12025A70), ref: 12025C25
BIO_s_file.LIBEAY32(?,12025A70), ref: 12025C2E
BIO_new.LIBEAY32(00000000,?,12025A70), ref: 12025C34
ERR_put_error.LIBEAY32(00000014,000000D8,00000041,.\ssl\ssl_cert.c,000003BE), ref: 12025C55
BIO_free.LIBEAY32(00000000), ref: 12025C64
X509_free.LIBEAY32(?), ref: 12025C75
sk_set_cmp_func.LIBEAY32(?,?), ref: 12025C83
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 12025C9F
PEM_read_bio_X509.LIBEAY32(00000000,?,00000000,00000000), ref: 12025CB5
X509_get_subject_name.LIBEAY32(?), ref: 12025CC6
X509_NAME_dup.LIBEAY32(00000000), ref: 12025CD3
sk_find.LIBEAY32(?,00000000), ref: 12025CE7
X509_NAME_free.LIBEAY32(00000000), ref: 12025CF4
sk_push.LIBEAY32(?,00000000), ref: 12025CFF
PEM_read_bio_X509.LIBEAY32(00000000,?,00000000,00000000), ref: 12025D11
ERR_clear_error.LIBEAY32 ref: 12025D1D

Strings

.\ssl\ssl_cert.c, xrefs: 12025C47

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_read_bio_X509X509_sk_set_cmp_func$E_dupE_freeO_ctrlO_freeO_newO_s_fileR_clear_errorR_put_errorX509_freeX509_get_subject_namesk_findsk_push
String ID: .\ssl\ssl_cert.c
API String ID: 1498395276-3404700246
Opcode ID: ac8051d1c3c0b508a3c070eca8ef412d76b2217dc6f5ccf0b68b43b010e40bcf
Instruction ID: fc860c74e72d6abfc545da810fe02ec01e68aaa718f259c9169038c3d9dd493a
Opcode Fuzzy Hash: ac8051d1c3c0b508a3c070eca8ef412d76b2217dc6f5ccf0b68b43b010e40bcf
Instruction Fuzzy Hash: 6E2129B7A403002FE242D6B46C41FFFB5BC8F44742F840625FE0695181FA26F10562B7

Function 12026C00 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,00000358,?,12026E1B,?,?,?,12021577,?,00000000,?), ref: 12026C22
CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026C3C
OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026C47
OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026C52
OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026C5D
X509_free.LIBEAY32(?), ref: 12026C83
sk_free.LIBEAY32(?), ref: 12026C96
CRYPTO_free.LIBEAY32(?), ref: 12026CA9
CRYPTO_free.LIBEAY32(?), ref: 12026CBC
CRYPTO_free.LIBEAY32(?), ref: 12026CD9
CRYPTO_free.LIBEAY32(?), ref: 12026CF6
CRYPTO_free.LIBEAY32(?), ref: 12026D09
CRYPTO_free.LIBEAY32(?), ref: 12026D1C
CRYPTO_free.LIBEAY32(?), ref: 12026D2F
OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 12026D3D
CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12026D43

Part of subcall function 12025680: CRYPTO_add_lock.LIBEAY32(12026D6D,000000FF,0000000F,.\ssl\ssl_cert.c,00000293,?,12026C75,?), ref: 120256A2
Part of subcall function 12025680: sk_pop_free.LIBEAY32(00000000,Function_000316CE,?,?,?,12026C75,?), ref: 120256BA
Part of subcall function 12025680: X509_free.LIBEAY32(00000000,?,?,?,?,?,12026C75,?), ref: 120256D7
Part of subcall function 12025680: RSA_free.LIBEAY32(E4868B00,?,?,?,12026C75,?), ref: 120256F4
Part of subcall function 12025680: DH_free.LIBEAY32(8B000000,?,?,?,12026C75,?), ref: 12025707
Part of subcall function 12025680: EC_KEY_free.LIBEAY32(8B178B08,?,?,?,12026C75,?), ref: 1202571A
Part of subcall function 12025680: CRYPTO_free.LIBEAY32(12026C75,?,?,?,12026C75,?), ref: 12025723

Strings

.\ssl\ssl_sess.c, xrefs: 12026C12

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$O_add_lockX509_free$A_freeH_freeO_free_ex_dataY_freesk_freesk_pop_free
String ID: .\ssl\ssl_sess.c
API String ID: 2707118759-1959455021
Opcode ID: 49a68a7eb938cb06ca749fb8a4774c8915bf0d9988b427a59b3e87d86de1d04d
Instruction ID: 9a8a6fcd82d0b8c4abfd331142daa52b3126af7e45dcaaab6eacdc583821471e
Opcode Fuzzy Hash: 49a68a7eb938cb06ca749fb8a4774c8915bf0d9988b427a59b3e87d86de1d04d
Instruction Fuzzy Hash: 2031AFE7E40701AFEA52D7728C05BE7B2EC9F18705F444A29A95B97280EE34F114E662

Function 1200DB30 Relevance: 28.8, APIs: 19, Instructions: 271COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200DB9E
EVP_MD_size.LIBEAY32(00000000,?), ref: 1200DBA4
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200DC08
EVP_MD_CTX_init.LIBEAY32(?), ref: 1200DCC8
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?), ref: 1200DCEC
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DD0B
EVP_DigestUpdate.LIBEAY32(?,1204E7B8,00000030), ref: 1200DD26
EVP_DigestUpdate.LIBEAY32(?,?,00000008), ref: 1200DD42
EVP_DigestUpdate.LIBEAY32(?,?,00000001), ref: 1200DD5E
EVP_DigestUpdate.LIBEAY32(?,?,00000002), ref: 1200DD76
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DD93
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200DDAB
EVP_MD_CTX_copy_ex.LIBEAY32(?,?), ref: 1200DDC1
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DDE0
EVP_DigestUpdate.LIBEAY32(?,1204E7E8,00000030), ref: 1200DDF7
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200DE0E
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200DE25
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200DE3E

Part of subcall function 12011150: X509_NAME_ENTRY_get_object.LIBEAY32(?,1200DC28,?), ref: 12011155
Part of subcall function 12011150: pqueue_peek.LIBEAY32(00000000,?,1200DC28,?), ref: 1201115B

EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200DE5E

Part of subcall function 12011180: OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000001C7,data_plus_mac_plus_padding_size < 1024 * 1024,?,?,?,?), ref: 12011215
Part of subcall function 12011180: X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,?), ref: 1201121E
Part of subcall function 12011180: pqueue_peek.LIBEAY32(00000000,?,?,?,?,?), ref: 12011224
Part of subcall function 12011180: SHA_Init.LIBEAY32(?,?,?), ref: 12011253

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$X509_Y_get_object$Final_exX_cleanupX_copy_expqueue_peek$D_sizeInitOpenX_flagsX_init
String ID:
API String ID: 2514736885-0
Opcode ID: ebccebf5a702aa6fcaab9b370846125a10f3027a83b2afacccec095761811a8a
Instruction ID: ae9947a4d5c02d18aed9c673431d7a771fe4988f9d85d36a212389cbf463b421
Opcode Fuzzy Hash: ebccebf5a702aa6fcaab9b370846125a10f3027a83b2afacccec095761811a8a
Instruction Fuzzy Hash: EB91A4B75083419FE314DB64DC40FABF7E9AF98784F044A2DF99987241E634E508DBA2

Function 12024CC0 Relevance: 28.7, APIs: 19, Instructions: 231COMMON

Download Yara Rule

APIs

SSL_new.SSLEAY32(?), ref: 12024CCE

Part of subcall function 12024900: ERR_put_error.LIBEAY32(00000014,000000BA,000000C3,.\ssl\ssl_lib.c,0000012B), ref: 1202491F

SSL_copy_session_id.SSLEAY32(00000000,?), ref: 12024CFF
X509_VERIFY_PARAM_get_depth.LIBEAY32(?), ref: 12024DC3
X509_VERIFY_PARAM_set_depth.LIBEAY32(?,00000000,?), ref: 12024DCD
CRYPTO_dup_ex_data.LIBEAY32(00000001,000000F0,?,?,00000000,?), ref: 12024E06
BIO_ctrl.LIBEAY32(?,0000000C,00000000,0000000C), ref: 12024E25
BIO_ctrl.LIBEAY32(?,0000000C,00000000,00000010), ref: 12024E49

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlX509_$L_copy_session_idL_newM_get_depthM_set_depthO_dup_ex_dataR_put_error
String ID:
API String ID: 4256526275-0
Opcode ID: 226bb95d8d809b139a240ca10d98ad565e9de629083c4b44d638a602b3e4e92c
Instruction ID: 8ecfc8450fa8ce095f73895ea64551fa54597dbea7c409e43a6032574c7f13b2
Opcode Fuzzy Hash: 226bb95d8d809b139a240ca10d98ad565e9de629083c4b44d638a602b3e4e92c
Instruction Fuzzy Hash: 8B81ECB6A00A02AFD755DF65D880AA6F7F4FB48305F518B2EE96E83700E730F4549B91

Function 110BB0C0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

X509_check_private_key.LIBEAY32(?,?), ref: 110BB0CC

Part of subcall function 11098480: X509_PUBKEY_get.LIBEAY32(?), ref: 11098494
Part of subcall function 11098480: EVP_PKEY_cmp.LIBEAY32(00000000,?), ref: 110984A8
Part of subcall function 11098480: ERR_put_error.LIBEAY32(0000000B,00000080,00000075,.\crypto\x509\x509_cmp.c,0000015A), ref: 110984E8
Part of subcall function 11098480: EVP_PKEY_free.LIBEAY32(00000000), ref: 110984F5

ERR_put_error.LIBEAY32(00000021,00000089,0000007F,.\crypto\pkcs7\pk7_smime.c,000000A3), ref: 110BB0EB

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

PKCS7_add_signature.LIBEAY32(?,?,?,?), ref: 110BB106
ERR_put_error.LIBEAY32(00000021,00000089,0000007C,.\crypto\pkcs7\pk7_smime.c,000000A9), ref: 110BB127

Strings

.\crypto\pkcs7\pk7_smime.c, xrefs: 110BB0DD, 110BB119, 110BB186

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_stateS7_add_signatureX509_X509_check_private_keyY_cmpY_freeY_get
String ID: .\crypto\pkcs7\pk7_smime.c
API String ID: 2279823101-1824083065
Opcode ID: ebca3286d236f0eb07069254c60edb8c3ecfe5e4874ccbca2673f891bb6d3624
Instruction ID: 862050fd902a2197f0300ba4a3fee63166185ed76f795e919fc6fc9aa7711b89
Opcode Fuzzy Hash: ebca3286d236f0eb07069254c60edb8c3ecfe5e4874ccbca2673f891bb6d3624
Instruction Fuzzy Hash: 9851D76EE047023BFA20E1267D02B2B75DC4F5272AF550679FD58F12C2FA91F54480BA

Function 12027980 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279A1
CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_sess.c,000002F1,?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279B4
lh_insert.LIBEAY32(?,?,00000009,0000000C,.\ssl\ssl_sess.c,000002F1,?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279C2
SSL_SESSION_free.SSLEAY32(00000000,00000000), ref: 120279DF

Part of subcall function 12026C00: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,00000358,?,12026E1B,?,?,?,12021577,?,00000000,?), ref: 12026C22
Part of subcall function 12026C00: CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026C3C
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026C47
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026C52
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026C5D
Part of subcall function 12026C00: X509_free.LIBEAY32(?), ref: 12026C83
Part of subcall function 12026C00: sk_free.LIBEAY32(?), ref: 12026C96
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CA9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CBC
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CD9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CF6
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D09
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D1C
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D2F
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 12026D3D
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12026D43

lh_retrieve.LIBEAY32(?,?), ref: 120279EE
SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000), ref: 12027A12
SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000), ref: 12027A29
SSL_CTX_ctrl.SSLEAY32(?,00000014,00000000,00000000,?,0000002B,00000000,00000000), ref: 12027A37
lh_retrieve.LIBEAY32(?,?), ref: 12027A55
lh_delete.LIBEAY32(?,?), ref: 12027A66
SSL_SESSION_free.SSLEAY32(00000000), ref: 12027A8B
SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000,00000000), ref: 12027A9A
SSL_CTX_ctrl.SSLEAY32(?,00000014,00000000,00000000,?,0000002B,00000000,00000000,00000000), ref: 12027AA8
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_sess.c,0000032C), ref: 12027AC2
SSL_SESSION_free.SSLEAY32(?), ref: 12027AD2

Strings

.\ssl\ssl_sess.c, xrefs: 1202798D, 120279AB, 12027AB9

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$X_ctrl$L_cleanse$N_free$O_add_lockO_locklh_retrieve$O_free_ex_dataX509_freelh_deletelh_insertsk_free
String ID: .\ssl\ssl_sess.c
API String ID: 2887299644-1959455021
Opcode ID: 511473f394b4eeca6713c691834213c270dab35dfdaa8a8aa75963491baa2526
Instruction ID: 112bae0d8900aa7300dc4885adaf741fc2822fb4d58a26b2fba2cfbb103e1994
Opcode Fuzzy Hash: 511473f394b4eeca6713c691834213c270dab35dfdaa8a8aa75963491baa2526
Instruction Fuzzy Hash: 5031097BB8030177E626E6704C86FBB62BC9B54B55F440B16FA006A2C1EBA1F510A1F1

Function 1202B400 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

X509_check_private_key.LIBEAY32(?,?,?,?,1202B5E9,?), ref: 1202B41B
X509_check_private_key.LIBEAY32(?,?,?,?,1202B5E9,?), ref: 1202B43D
ERR_clear_error.LIBEAY32(?,?,1202B5E9,?), ref: 1202B44E
ERR_put_error.LIBEAY32(00000014,000000C1,000000F7,.\ssl\ssl_rsa.c,000000C2,?), ref: 1202B47C
X509_get_pubkey.LIBEAY32(?,?,?), ref: 1202B4A5
ERR_put_error.LIBEAY32(00000014,000000C1,00000041,.\ssl\ssl_rsa.c,000000CA,?,?), ref: 1202B4C8
EVP_PKEY_free.LIBEAY32(00000000,00000014,000000C1,00000041,.\ssl\ssl_rsa.c,000000CA,?,?), ref: 1202B4CF
EVP_PKEY_copy_parameters.LIBEAY32(00000000,?,?,?), ref: 1202B4DF
EVP_PKEY_free.LIBEAY32(?,00000000,?,?,?), ref: 1202B4E9
ERR_clear_error.LIBEAY32(?,?,?,?,?), ref: 1202B4F1
RSA_flags.LIBEAY32(?,?,?,?,?,?), ref: 1202B500
X509_check_private_key.LIBEAY32(00000000,?,?,?,?,?,?), ref: 1202B510
X509_free.LIBEAY32(?,?,?,?,?,?,?,?), ref: 1202B51F
EVP_PKEY_free.LIBEAY32(?,?,?), ref: 1202B53B
CRYPTO_add_lock.LIBEAY32(?,00000001,0000000A,.\ssl\ssl_rsa.c,000000E8,?,?), ref: 1202B555

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B46B, 1202B4BA, 1202B548

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_check_private_keyY_free$R_clear_errorR_put_error$A_flagsO_add_lockX509_freeX509_get_pubkeyY_copy_parameters
String ID: .\ssl\ssl_rsa.c
API String ID: 678739067-614043423
Opcode ID: 00a27720f8fdae39ae7aa9252e9938efe7386216fef9abf8cbaf606260b40ef0
Instruction ID: 0698502849cb07dd4a1a0d96f1535d6cfad2fef76432e3c98a8f2dc9bb00ffb0
Opcode Fuzzy Hash: 00a27720f8fdae39ae7aa9252e9938efe7386216fef9abf8cbaf606260b40ef0
Instruction Fuzzy Hash: 313126B7B406066BEB02DFB4AC41B9A73AC6B15315F454736FD08AB1C0F671F154A2A1

Function 1202C3B0 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202C3C2
BIO_new.LIBEAY32(00000000), ref: 1202C3C8
ERR_put_error.LIBEAY32(00000014,000000C8,00000007,.\ssl\ssl_rsa.c,0000005C), ref: 1202C3E6
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202C3FE
ERR_put_error.LIBEAY32(00000014,000000C8,00000002,.\ssl\ssl_rsa.c,00000061), ref: 1202C41A
BIO_free.LIBEAY32(00000000), ref: 1202C423

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C3D8, 1202C40C, 1202C47D, 1202C4D1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: bad5e5703ff695f66807d7588c63098fdd8c65eb7b3835d36428f6d06e85f57e
Instruction ID: d29062a7dccf743056bd721244fef0b6b4a56eca408783f77c31b8415148e220
Opcode Fuzzy Hash: bad5e5703ff695f66807d7588c63098fdd8c65eb7b3835d36428f6d06e85f57e
Instruction Fuzzy Hash: B1313CB7B812007FF152D3589C42FBFB3A4CB94B62F194236F7065B1C1E961B92462A6

Function 1202C840 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202C852
BIO_new.LIBEAY32(00000000), ref: 1202C858
ERR_put_error.LIBEAY32(00000014,000000AD,00000007,.\ssl\ssl_rsa.c,000001CF), ref: 1202C879
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202C891
ERR_put_error.LIBEAY32(00000014,000000AD,00000002,.\ssl\ssl_rsa.c,000001D4), ref: 1202C8B0
BIO_free.LIBEAY32(00000000), ref: 1202C8B9

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C86B, 1202C8A2, 1202C910, 1202C967

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: e3d7689c3a6bc53c670a7b29010583a6d9b94b0456bbcc8ed87f902c9c349d2e
Instruction ID: 53079f1544536733bbc3101941512433567890800a3411d2deb89e09804a8b90
Opcode Fuzzy Hash: e3d7689c3a6bc53c670a7b29010583a6d9b94b0456bbcc8ed87f902c9c349d2e
Instruction Fuzzy Hash: F331FEB7B812007FE502D358DC42FBFB3A4CB85B22F194237F647AA1C1D561A52562A3

Function 12025730 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(?,?,?,?,1200436F,?,?), ref: 1202576D
sk_value.LIBEAY32(?,00000000,?), ref: 1202577C
X509_STORE_CTX_init.LIBEAY32(?,?,00000000,?,?,00000000,?), ref: 12025789
ERR_put_error.LIBEAY32(00000014,000000CF,0000000B,.\ssl\ssl_cert.c,000002D6,?,?,?,?,?,?,?), ref: 120257A8
X509_STORE_CTX_set_flags.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 120257D1
SSL_get_ex_data_X509_STORE_CTX_idx.SSLEAY32(?,?,?,?,?,?,?,?,?,?), ref: 120257DA

Part of subcall function 12024F80: CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,00000094,00000000,120242B9), ref: 12024FA2
Part of subcall function 12024F80: X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 12024FC1
Part of subcall function 12024F80: CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,0000009B), ref: 12024FE2

X509_STORE_CTX_set_ex_data.LIBEAY32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 120257E5
X509_STORE_CTX_set_default.LIBEAY32(?,ssl_client,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12025803
X509_VERIFY_PARAM_get_flags.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 12025814
X509_VERIFY_PARAM_set1.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1202581D
X509_VERIFY_PARAM_set_depth.LIBEAY32(?,?), ref: 12025835
X509_verify_cert.LIBEAY32(?), ref: 1202585F
X509_STORE_CTX_cleanup.LIBEAY32(?), ref: 12025878

Strings

.\ssl\ssl_cert.c, xrefs: 1202579A
ssl_client, xrefs: 120257F1
ssl_server, xrefs: 120257F8, 120257FD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$O_lock$L_get_ex_data_M_get_flagsM_set1M_set_depthR_put_errorX509_verify_certX_cleanupX_get_ex_new_indexX_idxX_initX_set_defaultX_set_ex_dataX_set_flagssk_numsk_value
String ID: .\ssl\ssl_cert.c$ssl_client$ssl_server
API String ID: 3995431402-2548101035
Opcode ID: 7e6160191a2dfb882e768790898d54fbe3620fa59fe6d5103dbae88b4b8100cb
Instruction ID: 24a3ed48dea11c1a11d78d7287151df44ef5a0f109c914ee5655011f6fd846eb
Opcode Fuzzy Hash: 7e6160191a2dfb882e768790898d54fbe3620fa59fe6d5103dbae88b4b8100cb
Instruction Fuzzy Hash: CA31AA7B600340ABD756D764DC40FEB73F8AB88302F444A2DE94A97241FA35F5099765

Function 12011AA0 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 467COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s23_srvr.c,00000196,s->version <= TLS_MAX_VERSION), ref: 12011B5B
_strncmp.LIBCMT ref: 12011D99
_strncmp.LIBCMT ref: 12011DAD
_strncmp.LIBCMT ref: 12011DC1
_strncmp.LIBCMT ref: 12011DD5
_strncmp.LIBCMT ref: 12011DE9
ERR_put_error.LIBEAY32(00000014,00000076,000000FC,.\ssl\s23_srvr.c,00000283), ref: 120120EF

Part of subcall function 120131A0: BIO_read.LIBEAY32(?,?,?,00000000,?,?,12011E44,?,ECAE3310), ref: 120131C8
Part of subcall function 120131A0: BIO_read.LIBEAY32(?,?,?), ref: 12013207

Strings

HEAD , xrefs: 12011DBC
POST , xrefs: 12011DA8
GET , xrefs: 12011D94
.\ssl\s23_srvr.c, xrefs: 12011B56, 12011B7F, 12011BFF, 12011CBA, 12011DFE, 12011E12, 12011E2B, 12011ED8, 12011FDC, 1201200F, 120120E1
CONNECT, xrefs: 12011DE4
PUT , xrefs: 12011DD0
s->version <= TLS_MAX_VERSION, xrefs: 12011B4C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _strncmp$O_read$OpenR_put_error
String ID: .\ssl\s23_srvr.c$CONNECT$GET $HEAD $POST $PUT $s->version <= TLS_MAX_VERSION
API String ID: 4149642059-1747794495
Opcode ID: a5580d89938f339101f04d8367100b8cb958792d9dfdf6948cbdff4059971d11
Instruction ID: ee0d4088dba103c0ea8a8cfacab21ed6e6aa026d01f03e0a3771f63465a386f8
Opcode Fuzzy Hash: a5580d89938f339101f04d8367100b8cb958792d9dfdf6948cbdff4059971d11
Instruction Fuzzy Hash: 7A020576A047929FE32ACF24CC84B96FBE5BF44304F04871DE8855E682E3B5E151EB91

Function 1200B370 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 401COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000D5,00000004,.\ssl\s3_lib.c,00000CA3), ref: 1200B3BA

Strings

.\ssl\s3_lib.c, xrefs: 1200B3AC, 1200B47A, 1200B49A, 1200B4D6, 1200B4EF, 1200B50F, 1200B54B, 1200B564, 1200B582, 1200B5B2, 1200B5FF, 1200B66A, 1200B67B, 1200B68F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_lib.c
API String ID: 1767461275-3880942756
Opcode ID: 5db6386ad529cb2d10157664db61b2e347b81e498eaf3f105030c4633b6f1423
Instruction ID: 34db53c2580501af29eeb9c329c38eefc56243d4e9ca2ca7ebbf5903f6a7b4c3
Opcode Fuzzy Hash: 5db6386ad529cb2d10157664db61b2e347b81e498eaf3f105030c4633b6f1423
Instruction Fuzzy Hash: 11C103B77407004BF211DE68EC80BEAB3D1EBC436AF25467AEA49D7341E632F905A745

Function 12027330 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(000000F4,.\ssl\ssl_sess.c,000000EE,?,?,?,12006922,?,00000000), ref: 12027342
CRYPTO_add_lock.LIBEAY32(?,00000001,0000000F,.\ssl\ssl_sess.c,00000111), ref: 120273DB
CRYPTO_add_lock.LIBEAY32(?,00000001,00000003,.\ssl\ssl_sess.c,00000114), ref: 12027401
BUF_strdup.LIBEAY32(?), ref: 12027416
BUF_strdup.LIBEAY32(?), ref: 12027439
sk_dup.LIBEAY32(?), ref: 1202745C
CRYPTO_dup_ex_data.LIBEAY32(00000003,000000C0,?), ref: 1202747C
BUF_strdup.LIBEAY32(?,?,?,?), ref: 12027499
BUF_memdup.LIBEAY32(?,?,?,?,?), ref: 120274C1
BUF_memdup.LIBEAY32(?,?,?,?,?), ref: 120274E5
BUF_memdup.LIBEAY32(?,?,?,?,?), ref: 1202750B
BUF_strdup.LIBEAY32(?,?,?,?), ref: 12027536
ERR_put_error.LIBEAY32(00000014,0000015C,00000041,.\ssl\ssl_sess.c,0000015D), ref: 1202755B
SSL_SESSION_free.SSLEAY32(00000000,00000014,0000015C,00000041,.\ssl\ssl_sess.c,0000015D), ref: 12027561

Strings

.\ssl\ssl_sess.c, xrefs: 12027338, 120273CB, 120273F4, 1202754D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: F_strdup$F_memdup$O_add_lock$N_freeO_dup_ex_dataO_mallocR_put_errorsk_dup
String ID: .\ssl\ssl_sess.c
API String ID: 54277970-1959455021
Opcode ID: 29aebaf3c0b3ae29e191d07122a3655fadecf061cfd1b999ad04ceaa1a32db57
Instruction ID: 5550b902bad49c0d087dc6d622da15cee4a81f96cc7fbe74b731cbe4547ebf23
Opcode Fuzzy Hash: 29aebaf3c0b3ae29e191d07122a3655fadecf061cfd1b999ad04ceaa1a32db57
Instruction Fuzzy Hash: 3E51A1B2A402559FDB66CF348C91BE976E8AB08701F84463AED0EDF285EB70D540E770

Function 1200D580 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 1200D5B4
EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 1200D5D5
EVP_DigestUpdate.LIBEAY32(?), ref: 1200D600
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D622
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200D642
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200D663
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D682
EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 1200D6A6
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D6BD
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200D6D8
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1200D6F3
ERR_put_error.LIBEAY32(00000014,00000184,00000044,.\ssl\s3_enc.c,00000388), ref: 1200D72D
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200D73C
OPENSSL_cleanse.LIBEAY32(?,00000040,?), ref: 1200D748

Strings

.\ssl\s3_enc.c, xrefs: 1200D71F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Final_exInit_ex$L_cleanseR_put_errorX_cleanupX_init
String ID: .\ssl\s3_enc.c
API String ID: 2537293699-1985432667
Opcode ID: 19f72657138a2a458951a4c9dbd0ac7dd006d9a489bf3d136e87b75b8ca23b8c
Instruction ID: 8ea24a3f24286e36ba69ca7849038dbc1a13e68d6198700ff1ea1633ef4ec831
Opcode Fuzzy Hash: 19f72657138a2a458951a4c9dbd0ac7dd006d9a489bf3d136e87b75b8ca23b8c
Instruction Fuzzy Hash: AB5193BB6043419BE341DB64CC44F9BB3E9AB98740F044B6DFA4A87245F630F609DB62

Function 12031090 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SRP_Verify_B_mod_N.LIBEAY32(?,?,?,?,?), ref: 120310C4
SRP_Calc_u.LIBEAY32(?,?,?), ref: 120310E9
SRP_Calc_x.LIBEAY32(?,?,00000000), ref: 12031133
SRP_Calc_client_key.LIBEAY32(?,?,?,?,?,?), ref: 1203116D
BN_num_bits.LIBEAY32(00000000), ref: 1203117C
CRYPTO_malloc.LIBEAY32(-00000007,.\ssl\tls_srp.c,00000191,00000000), ref: 1203119A
BN_bn2bin.LIBEAY32(00000000,00000000), ref: 120311AA
OPENSSL_cleanse.LIBEAY32(00000000,-00000007), ref: 120311C8
CRYPTO_free.LIBEAY32(00000000,00000000,-00000007), ref: 120311CE
BN_clear_free.LIBEAY32(00000000), ref: 120311DB
BN_clear_free.LIBEAY32(?,00000000), ref: 120311E5
OPENSSL_cleanse.LIBEAY32(00000000,00000001), ref: 12031201
CRYPTO_free.LIBEAY32(00000000,00000000,00000001), ref: 12031207
BN_clear_free.LIBEAY32(?), ref: 12031214

Strings

.\ssl\tls_srp.c, xrefs: 12031194

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_free$L_cleanseO_free$B_mod_Calc_client_keyCalc_uCalc_xN_bn2binN_num_bitsO_mallocVerify_
String ID: .\ssl\tls_srp.c
API String ID: 2586719652-3972901604
Opcode ID: 378b0c502b8aed684fd5ca72ef9360943b2f066cbad9e3b080b08009c2cafc6d
Instruction ID: 0de410b299f2ab724d68063cdf4174e139d96f76b8389eb33131fdddcbf11082
Opcode Fuzzy Hash: 378b0c502b8aed684fd5ca72ef9360943b2f066cbad9e3b080b08009c2cafc6d
Instruction Fuzzy Hash: 2B4149B7600601AFD252DB659C80DBBB3F9ABC9711F144A1CF89A83200EA35F9059662

Function 12025D30 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,00000018,.\ssl\ssl_cert.c,000003F5), ref: 12025D72
OPENSSL_DIR_read.LIBEAY32(?,?,00000009,00000018,.\ssl\ssl_cert.c,000003F5), ref: 12025D7D
BIO_snprintf.LIBEAY32(?,00000400,%s/%s,?,00000000), ref: 12025DCF
SSL_add_file_cert_subjects_to_stack.SSLEAY32(?,?), ref: 12025DF0
OPENSSL_DIR_read.LIBEAY32(?,?), ref: 12025E06
GetLastError.KERNEL32(.\ssl\ssl_cert.c,0000040E), ref: 12025E2A
ERR_put_error.LIBEAY32(00000002,0000000A,00000000), ref: 12025E35
ERR_add_error_data.LIBEAY32(00000003,OPENSSL_DIR_read(&ctx, ',?,1204151C,00000002,0000000A,00000000), ref: 12025E47
ERR_put_error.LIBEAY32(00000014,000000D7,00000002,.\ssl\ssl_cert.c,00000410,00000003,OPENSSL_DIR_read(&ctx, ',?,1204151C,00000002,0000000A,00000000), ref: 12025E5F
ERR_put_error.LIBEAY32(00000014,000000D7,0000010E,.\ssl\ssl_cert.c,000003FF), ref: 12025E7F
OPENSSL_DIR_end.LIBEAY32 ref: 12025EA0
CRYPTO_lock.LIBEAY32(0000000A,00000018,.\ssl\ssl_cert.c,00000419), ref: 12025EB6

Strings

%s/%s, xrefs: 12025DC0
.\ssl\ssl_cert.c, xrefs: 12025D5F, 12025E25, 12025E51, 12025E6E, 12025EAD
OPENSSL_DIR_read(&ctx, ', xrefs: 12025E40

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_lockR_read$ErrorL_add_file_cert_subjects_to_stackLastO_snprintfR_add_error_dataR_end
String ID: %s/%s$.\ssl\ssl_cert.c$OPENSSL_DIR_read(&ctx, '
API String ID: 2099322235-4005729725
Opcode ID: 0840ede5bed67ad0b61296d1a8a6829f4135ab8838cc9ecf4b395af2cddf3c3f
Instruction ID: 3de07f955f1aac999ecc6e2f3a0b95def8fa119a9728e7f39f4185ccf15e585b
Opcode Fuzzy Hash: 0840ede5bed67ad0b61296d1a8a6829f4135ab8838cc9ecf4b395af2cddf3c3f
Instruction Fuzzy Hash: 95416BB76403016FFA19C710DC85FFAB7A8DB44705F80472DF7466A4C1EA72A505A2A6

Function 110AF020 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

BIO_s_null.LIBEAY32(?,?,110AF21C,?), ref: 110AF044
BIO_new.LIBEAY32(00000000,?,?,110AF21C,?), ref: 110AF04A

Part of subcall function 11061620: CRYPTO_malloc.LIBEAY32(00000040,.\crypto\bio\bio_lib.c,00000046,?,11003852,00000000,0000000A,00000014,.\crypto\mem_dbg.c,00000112), ref: 1106162A
Part of subcall function 11061620: ERR_put_error.LIBEAY32(00000020,0000006C,00000041,.\crypto\bio\bio_lib.c,00000048,00000014,.\crypto\mem_dbg.c,00000112), ref: 11061645

BIO_s_mem.LIBEAY32 ref: 110AF060
BIO_new.LIBEAY32(00000000), ref: 110AF066
BIO_ctrl.LIBEAY32(00000000,00000082,00000000,00000000,00000000), ref: 110AF077
ERR_put_error.LIBEAY32(0000002E,0000006B,00000041,.\crypto\cms\cms_smime.c,0000004F), ref: 110AF094
BIO_read.LIBEAY32(00000000,?,00001000), ref: 110AF0AC

Part of subcall function 11060FB0: ERR_put_error.LIBEAY32(00000020,0000006F,00000078,.\crypto\bio\bio_lib.c,000000CE), ref: 11061003

BIO_write.LIBEAY32(?,?,00000000,110AF21C,?), ref: 110AF0C7
BIO_read.LIBEAY32(00000000,?,00001000,?,?,?,110AF21C,?), ref: 110AF0DE
EVP_CIPHER_CTX_nid.LIBEAY32(00000000,110AF21C,?), ref: 110AF0ED
BIO_ctrl.LIBEAY32(00000000,00000071,00000000,00000000,?,110AF21C,?), ref: 110AF103
SMIME_text.LIBEAY32(?,?), ref: 110AF11F
ERR_put_error.LIBEAY32(0000002E,0000006B,0000008C,.\crypto\cms\cms_smime.c,00000066,?,?,?,110AF21C,?), ref: 110AF13B
BIO_free.LIBEAY32(?,?,110AF21C,?), ref: 110AF14C

Strings

.\crypto\cms\cms_smime.c, xrefs: 110AF089, 110AF12D

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_newO_read$E_textO_freeO_mallocO_s_memO_s_nullO_writeX_nid
String ID: .\crypto\cms\cms_smime.c
API String ID: 2484170655-2159935803
Opcode ID: 269bb9bd28be838b9c160e03d1e95a23f925c97fd6c6690ffae8ad8ecd203232
Instruction ID: fdf738e26f78fe1c1eaedbdacd3fe426a19468959e650a390ad892586d413c30
Opcode Fuzzy Hash: 269bb9bd28be838b9c160e03d1e95a23f925c97fd6c6690ffae8ad8ecd203232
Instruction Fuzzy Hash: FC310DB9E8439626F621D6A0EC41FAF318C4B45B8CF04046CFE44E52C5FAE5B544C1E3

Function 120251E0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000D,.\ssl\ssl_cert.c,000001CC,?,120215E6,?), ref: 12025202
RSA_free.LIBEAY32(?), ref: 1202521A
DH_free.LIBEAY32(?), ref: 1202522A
EC_KEY_free.LIBEAY32(?), ref: 1202523A
CRYPTO_free.LIBEAY32(?), ref: 12025256
CRYPTO_free.LIBEAY32(?), ref: 12025269
CRYPTO_free.LIBEAY32(?), ref: 1202527C
CRYPTO_free.LIBEAY32(?), ref: 1202528F
CRYPTO_free.LIBEAY32(?), ref: 120252A2
X509_STORE_free.LIBEAY32(?), ref: 120252B5
X509_STORE_free.LIBEAY32(?), ref: 120252C8
CRYPTO_free.LIBEAY32(?), ref: 120252DB
CRYPTO_free.LIBEAY32(?), ref: 12025309
CRYPTO_free.LIBEAY32(?), ref: 12025312

Strings

.\ssl\ssl_cert.c, xrefs: 120251F2

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$E_freeX509_$A_freeH_freeO_add_lockY_free
String ID: .\ssl\ssl_cert.c
API String ID: 3424883474-3404700246
Opcode ID: 29a3523ee6391acdd9c17ce8a2e6dce1f328f0457e8946c01122dd2c3b88efdf
Instruction ID: 41fdd3a2d0ae1fddddace518e8b775a2fc83d8d9bf43c05e95d736369d67dcff
Opcode Fuzzy Hash: 29a3523ee6391acdd9c17ce8a2e6dce1f328f0457e8946c01122dd2c3b88efdf
Instruction Fuzzy Hash: 6D31A1F7F007015BE956D772AC41BE7B2EC5F05705F444A24E84BD6280FA36F118E2A6

Function 1200E470 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000008F,00000044,.\ssl\s3_pkt.c,0000014E), ref: 1200E4D0
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200E63E
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200E655
EVP_MD_size.LIBEAY32(00000000,?), ref: 1200E65B
OpenSSLDie.LIBEAY32(.\ssl\s3_pkt.c,000001DB,mac_size <= EVP_MAX_MD_SIZE), ref: 1200E679
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200E69C
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200E6C0
CRYPTO_memcmp.LIBEAY32(?,?,00000000), ref: 1200E71D

Strings

.\ssl\s3_pkt.c, xrefs: 1200E4C2, 1200E674, 1200E7DD, 1200E827, 1200E874, 1200E897, 1200E8B0, 1200E8C9, 1200E8E2, 1200E8FB, 1200E914, 1200E92D, 1200E943
mac_size <= EVP_MAX_MD_SIZE, xrefs: 1200E66A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_X_flagsY_get_object$D_sizeO_memcmpOpenR_put_error
String ID: .\ssl\s3_pkt.c$mac_size <= EVP_MAX_MD_SIZE
API String ID: 3638955776-1757382070
Opcode ID: 64a2e1bd025369d394d181991e835b34455d0dc22a4f4d51d151c3598d581107
Instruction ID: 42b6c42e6782be2a51e5230c9ccdb03974eef9d033252d6b07f9a85d695aaae4
Opcode Fuzzy Hash: 64a2e1bd025369d394d181991e835b34455d0dc22a4f4d51d151c3598d581107
Instruction Fuzzy Hash: 4FC12977A44341ABF321CF24CC81BAAB7E5AB84745F148738FA59AB2C1E770E840D795

Function 12007E90 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 331COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000082,00000044,.\ssl\s3_clnt.c,00000DCD), ref: 12007EF9
ERR_put_error.LIBEAY32(00000014,00000082,000000FA,.\ssl\s3_clnt.c,00000E65), ref: 120082E4

Strings

<, xrefs: 120082BF
.\ssl\s3_clnt.c, xrefs: 12007EEB, 12007F4C, 12007F65, 12007F7E, 12007FD8, 12007FFA, 1200803E, 1200807A, 12008095, 120080C1, 120080FB, 1200812E, 120081AB, 12008203, 1200824D, 1200829C, 120082BA, 120082D3
(, xrefs: 12007EAF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: ($.\ssl\s3_clnt.c$<
API String ID: 1767461275-1055020220
Opcode ID: 23799c89e78e9bb8534a99524df34b7d981c19130b05a678f8a7a7f9f09f3fd9
Instruction ID: 1f5e5cccdaa1685684fd51d9240d04d2ce09dc208490dab75948242f992ac505
Opcode Fuzzy Hash: 23799c89e78e9bb8534a99524df34b7d981c19130b05a678f8a7a7f9f09f3fd9
Instruction Fuzzy Hash: A8B136737407009FF306CA10CC86FEA77D1BF84799F054729FA466B2D2D274AA44E695

Function 12028310 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 263COMMON

Download Yara Rule

APIs

sk_find.LIBEAY32(00000000,?,?,?,00000000,1202E9BB,?,00000000,00000000,00000000,00000000,?), ref: 1202835F
sk_value.LIBEAY32(00000000,00000000), ref: 12028373

Strings

AES-128-CBC-HMAC-SHA256, xrefs: 12028660
AES-128-CBC-HMAC-SHA1, xrefs: 12028606
RC4-HMAC-MD5, xrefs: 120285E6
AES-256-CBC-HMAC-SHA256, xrefs: 1202867F
AES-256-CBC-HMAC-SHA1, xrefs: 12028640

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_findsk_value
String ID: AES-128-CBC-HMAC-SHA1$AES-128-CBC-HMAC-SHA256$AES-256-CBC-HMAC-SHA1$AES-256-CBC-HMAC-SHA256$RC4-HMAC-MD5
API String ID: 2186935275-741925770
Opcode ID: 02298c773dd47754594cf054106500400b02c2626c2e03a199900947749cf5f2
Instruction ID: d90cb9fbea4e60f5a2bbedac8cad7c5e68e9f132f4c77d6a5329e6dceff1174c
Opcode Fuzzy Hash: 02298c773dd47754594cf054106500400b02c2626c2e03a199900947749cf5f2
Instruction Fuzzy Hash: 2DA17F7A604252CFD715CE14D48479AB3E1BB48315F940B2BF9818B780D736EB90EBA2

Function 12025F90 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBEAY32(?,0000000A), ref: 1202600A
ERR_put_error.LIBEAY32(00000014,0000013E,0000000B,.\ssl\ssl_cert.c,00000465,?,?,?,?,?,00000000), ref: 12026029
X509_STORE_CTX_init.LIBEAY32(?,?,00000000,00000000,?,00000000), ref: 1202607E
X509_verify_cert.LIBEAY32(?,?,?,?,?,?,00000000), ref: 1202609D
ERR_clear_error.LIBEAY32(?,?,?,?,?,?,00000000), ref: 120260A2
sk_num.LIBEAY32(?,?,?,?,?,?,?,00000000), ref: 120260AE
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 120260E4
sk_value.LIBEAY32(?,00000000,?,?,?,?,?,?,?,00000000), ref: 120260C6

Part of subcall function 12025EE0: i2d_X509.LIBEAY32(00000000,00000000,?,00000000,12026123,?,?,00000000,?,?,00000000), ref: 12025EF3
Part of subcall function 12025EE0: BUF_MEM_grow_clean.LIBEAY32(12026123,00000003,?,00000000,?,?,00000000), ref: 12025F09
Part of subcall function 12025EE0: i2d_X509.LIBEAY32(00000000), ref: 12025F43
Part of subcall function 12025EE0: ERR_put_error.LIBEAY32(00000014,0000013F,00000007,.\ssl\ssl_cert.c,00000426,?,00000000,?,?,00000000), ref: 12025F77

X509_STORE_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,00000000), ref: 120260F5
sk_num.LIBEAY32(?,?,00000000), ref: 12026100
sk_value.LIBEAY32(?,00000000,?,?,00000000), ref: 12026112
sk_num.LIBEAY32(?,?,?,?,?,?,00000000), ref: 12026130
X509_STORE_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 12026151

Strings

.\ssl\ssl_cert.c, xrefs: 1202601B, 1202608F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$X509_$M_grow_cleanR_put_errorX509X_cleanupi2d_sk_value$R_clear_errorX509_verify_certX_init
String ID: .\ssl\ssl_cert.c
API String ID: 3599936654-3404700246
Opcode ID: 807bd7ef6520d837f60d0c791c3762228c17faf0ffa1906c895711fa088acfa7
Instruction ID: cfdd24a718d34e198bed54042ea7a6a2fc29b505420ecd9510d45044333f87fa
Opcode Fuzzy Hash: 807bd7ef6520d837f60d0c791c3762228c17faf0ffa1906c895711fa088acfa7
Instruction Fuzzy Hash: A941D8B77003015FD751CB64DC81BEBB3E89B94355F44463AFE0687242FA36F409A292

Function 1202C630 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202C642
BIO_new.LIBEAY32(00000000), ref: 1202C648
ERR_put_error.LIBEAY32(00000014,000000CE,00000007,.\ssl\ssl_rsa.c,000000FA), ref: 1202C669
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202C681
ERR_put_error.LIBEAY32(00000014,000000CE,00000002,.\ssl\ssl_rsa.c,000000FF), ref: 1202C6A0
BIO_free.LIBEAY32(00000000), ref: 1202C6A9

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C65B, 1202C692, 1202C706, 1202C73A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: 5884dd94d286786813bea932bdd44da659bce1396f256fc5edcaf881a858e25d
Instruction ID: 8d0726582abca3cf0092084f3e3f94ae21ed4cbffc4f816a9bafcbe6c49b2a63
Opcode Fuzzy Hash: 5884dd94d286786813bea932bdd44da659bce1396f256fc5edcaf881a858e25d
Instruction Fuzzy Hash: C63149B7B802053FF112D358DC42FBBB3A8CB84B22F150236F606AB181D961B95072A6

Function 1202B5F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202B602
BIO_new.LIBEAY32(00000000), ref: 1202B608
ERR_put_error.LIBEAY32(00000014,000000CB,00000007,.\ssl\ssl_rsa.c,00000147), ref: 1202B629
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202B641
ERR_put_error.LIBEAY32(00000014,000000CB,00000002,.\ssl\ssl_rsa.c,0000014C), ref: 1202B660
BIO_free.LIBEAY32(00000000), ref: 1202B669

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B61B, 1202B652, 1202B6C6, 1202B6FA

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: 8084c00cedd57297da85c038cd05e08b5eb01aac010fcc6b810af33412a18514
Instruction ID: 52b59cf63b76c90425b5be2d7733ab7857cf6d62b1544d7fb2ece74997006824
Opcode Fuzzy Hash: 8084c00cedd57297da85c038cd05e08b5eb01aac010fcc6b810af33412a18514
Instruction Fuzzy Hash: 4E314E777802007FF152D3589C42FBFB3A8CB80752F180636F705AB1C1E561B91062A2

Function 1202BB90 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202BBA2
BIO_new.LIBEAY32(00000000), ref: 1202BBA8
ERR_put_error.LIBEAY32(00000014,000000B0,00000007,.\ssl\ssl_rsa.c,00000274), ref: 1202BBC9
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202BBE1
ERR_put_error.LIBEAY32(00000014,000000B0,00000002,.\ssl\ssl_rsa.c,00000279), ref: 1202BC00
BIO_free.LIBEAY32(00000000), ref: 1202BC09

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BBBB, 1202BBF2, 1202BC60, 1202BC94

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: 1e0a44c97358c556c1348ba3b941819b58dca688e7867292b734f1d5daec2401
Instruction ID: 27bbb618c02e777ab8e2f3753108e90ff0d3cd284ed9364e50cd75f39516ba69
Opcode Fuzzy Hash: 1e0a44c97358c556c1348ba3b941819b58dca688e7867292b734f1d5daec2401
Instruction Fuzzy Hash: AE21427B7803007FE552D3589C42FBFB3B88B84711F244636F705AA1C1E961B51572A7

Function 1202B990 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202B9A2
BIO_new.LIBEAY32(00000000), ref: 1202B9A8
ERR_put_error.LIBEAY32(00000014,000000B3,00000007,.\ssl\ssl_rsa.c,0000022A), ref: 1202B9C9
BIO_ctrl.LIBEAY32(00000000,0000006C,00000003,?), ref: 1202B9E1
ERR_put_error.LIBEAY32(00000014,000000B3,00000002,.\ssl\ssl_rsa.c,0000022F), ref: 1202BA00
BIO_free.LIBEAY32(00000000), ref: 1202BA09

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B9BB, 1202B9F2, 1202BA60, 1202BA94

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_newO_s_file
String ID: .\ssl\ssl_rsa.c
API String ID: 3280554936-614043423
Opcode ID: bfc1b00c19f92828a7c1c23ca5f8a569fb9b603fe47186b00fec5631d4b6d811
Instruction ID: e9a0995168a7654430ee7703a5a7287154fcd3daf25d209304bc3cd468c0984b
Opcode Fuzzy Hash: bfc1b00c19f92828a7c1c23ca5f8a569fb9b603fe47186b00fec5631d4b6d811
Instruction Fuzzy Hash: FA2122B7B803007BE552D758DC42F7BB3A8DB94B12F154237F706AA1C1E561B514B1A3

Function 1202A310 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

CRYPTO_mem_ctrl.LIBEAY32(00000003), ref: 1202A33D
CRYPTO_malloc.LIBEAY32(0000000C,.\ssl\ssl_ciph.c,000007D8,00000003), ref: 1202A34E
CRYPTO_mem_ctrl.LIBEAY32(00000002), ref: 1202A35E
ERR_put_error.LIBEAY32(00000014,000000A5,00000041,.\ssl\ssl_ciph.c,000007DB,00000002), ref: 1202A376
sk_find.LIBEAY32(00000000,00000000), ref: 1202A3A0
CRYPTO_free.LIBEAY32(00000000), ref: 1202A3AD
CRYPTO_mem_ctrl.LIBEAY32(00000002,00000000), ref: 1202A3B4
ERR_put_error.LIBEAY32(00000014,000000A5,00000041,.\ssl\ssl_ciph.c,000007EC,00000002,00000000), ref: 1202A3CF
ERR_put_error.LIBEAY32(00000014,000000A5,00000133,.\ssl\ssl_ciph.c,000007D3), ref: 1202A438

Strings

.\ssl\ssl_ciph.c, xrefs: 1202A347, 1202A368, 1202A3BE, 1202A419, 1202A427

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mem_ctrlR_put_error$O_freeO_mallocsk_find
String ID: .\ssl\ssl_ciph.c
API String ID: 3531509969-2955601352
Opcode ID: 81c9e75f5cded2672bff5c1cbbd5f87b0dfcb8bc29b0ae2db7adf14be7efc1ea
Instruction ID: ccaaa1bf1f928bc157a46a9742b29f4fc61750d746bc3ed2585ec539fdb9b227
Opcode Fuzzy Hash: 81c9e75f5cded2672bff5c1cbbd5f87b0dfcb8bc29b0ae2db7adf14be7efc1ea
Instruction Fuzzy Hash: 60210973B803116FF652DB68EC86FAEE3949B88711F404B36FA08A95C0D9A4F1C17162

Function 1202B7A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

X509_get_pubkey.LIBEAY32(?,?,?,1202C3A2,00000000), ref: 1202B7A7
ERR_put_error.LIBEAY32(00000014,000000BF,0000010C,.\ssl\ssl_rsa.c,0000018F,00000000), ref: 1202B7CB
ERR_put_error.LIBEAY32(00000014,000000BF,000000F7,.\ssl\ssl_rsa.c,00000195,?,?,00000000), ref: 1202B7FC
EVP_PKEY_free.LIBEAY32(00000000,00000014,000000BF,000000F7,.\ssl\ssl_rsa.c,00000195,?,?,00000000), ref: 1202B802

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B7BA, 1202B7EB, 1202B896

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_get_pubkeyY_free
String ID: .\ssl\ssl_rsa.c
API String ID: 254201522-614043423
Opcode ID: d8e83e9cf48abc6f7221432dea21da7186a7e60eda97c3a6081560213ee74d9a
Instruction ID: 6bcc17d14215fc2611c7d7c3578202da995c279a328c0675c786d2cbcc3305c5
Opcode Fuzzy Hash: d8e83e9cf48abc6f7221432dea21da7186a7e60eda97c3a6081560213ee74d9a
Instruction Fuzzy Hash: 8921F8BBA403056FE742DBA49C41FBB73B8AB44741F094638FE099A181FA75F114E661

Function 1201C290 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 1200A7C0: CRYPTO_malloc.LIBEAY32(0000042C,.\ssl\s3_lib.c,00000BCD), ref: 1200A7D0

CRYPTO_malloc.LIBEAY32(000002EC,.\ssl\d1_lib.c,00000081), ref: 1201C2B4
_memset.LIBCMT ref: 1201C2CE
pqueue_new.LIBEAY32 ref: 1201C2D6
pqueue_new.LIBEAY32 ref: 1201C2E1
pqueue_new.LIBEAY32 ref: 1201C2EC
pqueue_new.LIBEAY32 ref: 1201C2F7
pqueue_new.LIBEAY32 ref: 1201C302

Strings

.\ssl\d1_lib.c, xrefs: 1201C2AA

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: pqueue_new$O_malloc$_memset
String ID: .\ssl\d1_lib.c
API String ID: 762437611-112416191
Opcode ID: 8a3701204f1159e8c55215d167b7e609951390b778698478a48a23961a7a2f52
Instruction ID: 5e666fe23d671073b2efbf0a5f522cfc458510a57b365f7f43a205dd78721f02
Opcode Fuzzy Hash: 8a3701204f1159e8c55215d167b7e609951390b778698478a48a23961a7a2f52
Instruction Fuzzy Hash: 053173B79007405BE7A2DB75D8887EBB2E4AF05306F04072DD49EDA250E778F091E756

Function 120281F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000005,00000010,.\ssl\ssl_ciph.c,000001DB,1202A2C5,12024501), ref: 120281FE
CRYPTO_lock.LIBEAY32(00000006,00000010,.\ssl\ssl_ciph.c,000001DD,?,?,1202A2C5,12024501), ref: 12028221
CRYPTO_lock.LIBEAY32(00000009,00000010,.\ssl\ssl_ciph.c,000001DE,00000006,00000010,.\ssl\ssl_ciph.c,000001DD,?,?,1202A2C5,12024501), ref: 12028234
CRYPTO_mem_ctrl.LIBEAY32(00000003,?,?,?,?,?,?,?,?,?,?,1202A2C5,12024501), ref: 1202824B
sk_new.LIBEAY32(120281D0,00000003,?,?,?,?,?,?,?,?,?,?,1202A2C5,12024501), ref: 12028255
CRYPTO_malloc.LIBEAY32(0000000C,.\ssl\ssl_ciph.c,000001E7,00000000), ref: 12028273
COMP_zlib.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,1202A2C5), ref: 12028281
CRYPTO_free.LIBEAY32(00000000,?,?,00000000), ref: 12028293
sk_push.LIBEAY32(00000000,00000000,?,?,00000000), ref: 120282B1
sk_sort.LIBEAY32(00000000,?,?,00000000), ref: 120282C0
CRYPTO_mem_ctrl.LIBEAY32(00000002,?,?,?,?,?,?,?,?,?,?,?,?,1202A2C5,12024501), ref: 120282CB
CRYPTO_lock.LIBEAY32(0000000A,00000010,.\ssl\ssl_ciph.c,000001F9,?,?,?,?,?,?,?,?,?,?,1202A2C5,12024501), ref: 120282E1
CRYPTO_lock.LIBEAY32(00000006,00000010,.\ssl\ssl_ciph.c,000001FB,?,?,1202A2C5,12024501), ref: 120282F8

Strings

.\ssl\ssl_ciph.c, xrefs: 120281F5, 12028218, 1202822B, 1202826C, 120282D8, 120282EF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$O_mem_ctrl$O_freeO_mallocP_zlibsk_newsk_pushsk_sort
String ID: .\ssl\ssl_ciph.c
API String ID: 2144066949-2955601352
Opcode ID: 5576c38d9bb3fc2fc4d9122c3bed0b5bbc18cca0ff1d1c401b430878155d9a64
Instruction ID: a542b82034b3a4ccd7344fb710e1523972e759390afc55484f9a7300a581770a
Opcode Fuzzy Hash: 5576c38d9bb3fc2fc4d9122c3bed0b5bbc18cca0ff1d1c401b430878155d9a64
Instruction Fuzzy Hash: 1F21F37BAC07116FF352D7A09C42FEE62A15B08B02F540F35FA08399C1E9A1B594B276

Function 120171C0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

X509_chain_check_suiteb.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120172E0
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,000000FF), ref: 120173D7
sk_value.LIBEAY32(?,00000000), ref: 120173E9
sk_num.LIBEAY32(?), ref: 120173FF

Part of subcall function 12013D50: X509_get_pubkey.LIBEAY32(?,?,?,12017445,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 12013D65

sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120174C1
sk_num.LIBEAY32(?), ref: 1201750F
sk_value.LIBEAY32(?,00000000), ref: 12017522
sk_num.LIBEAY32(?), ref: 1201753A
sk_num.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 12017565
sk_value.LIBEAY32(?,00000000), ref: 12017577
sk_num.LIBEAY32(?), ref: 1201758E
X509_certificate_type.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 120175DD

Strings

@, xrefs: 1201744C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$sk_value$X509_certificate_typeX509_chain_check_suitebX509_get_pubkey
String ID: @
API String ID: 682326728-2766056989
Opcode ID: f3f6b21420459fd0d78ac6e33ce5f2dd04cca8c52bc4dcc50848313b626bac29
Instruction ID: 7f52aa3dc21935c5bed4bc119a883b38bb3f107d6c28c51b0df89be323a76aad
Opcode Fuzzy Hash: f3f6b21420459fd0d78ac6e33ce5f2dd04cca8c52bc4dcc50848313b626bac29
Instruction Fuzzy Hash: 40E185779043428BE71ECE24C4857ABB6E4BB84318F010B2DFD969B2B1D774E944E792

Function 12034ADC Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 396COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 12034AC7
__decode_pointer.LIBCMT ref: 12034C4A
__decode_pointer.LIBCMT ref: 12034C79
__decode_pointer.LIBCMT ref: 12034C9E
__aulldvrm.LIBCMT ref: 12034E05
_write_multi_char.LIBCMT ref: 12034F19
_write_string.LIBCMT ref: 12034F39
_write_multi_char.LIBCMT ref: 12034F5B
__cftof.LIBCMT ref: 12034F9B
_write_string.LIBCMT ref: 12034FBE
_write_multi_char.LIBCMT ref: 12035007

Strings

, xrefs: 12034B3D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: __decode_pointer_write_multi_char$_write_string$__aulldvrm__cftof_strlen
String ID:
API String ID: 629750176-3916222277
Opcode ID: ac7fee6c6844c0e2d59f3325370ddc5637ce7523152783e8d9ca033002b3f646
Instruction ID: bda291a76f77ac59c5112b972cb7bbf674268e2b46307a43ab3fa176fcd88389
Opcode Fuzzy Hash: ac7fee6c6844c0e2d59f3325370ddc5637ce7523152783e8d9ca033002b3f646
Instruction Fuzzy Hash: 81F15B7AC0426D8EDB63CA14DC887EDBBB4EB04316F1207DAC409AA1A1D7755BC5EF50

Function 12034CDF Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 12034AC7
__decode_pointer.LIBCMT ref: 12034C4A
__decode_pointer.LIBCMT ref: 12034C79
__decode_pointer.LIBCMT ref: 12034C9E
__aulldvrm.LIBCMT ref: 12034E05
_write_multi_char.LIBCMT ref: 12034F19
_write_string.LIBCMT ref: 12034F39
_write_multi_char.LIBCMT ref: 12034F5B
__cftof.LIBCMT ref: 12034F9B
_write_string.LIBCMT ref: 12034FBE
_write_multi_char.LIBCMT ref: 12035007

Strings

', xrefs: 12034CF0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: __decode_pointer_write_multi_char$_write_string$__aulldvrm__cftof_strlen
String ID: '
API String ID: 629750176-1997036262
Opcode ID: 6722859111ffc4eb03453040361c757ececfdfbfd16c903b0ccc8c205be5f2a7
Instruction ID: 737d891f28d84a099c42e26a83ac193c5bdf06ad4b8adf271c21b659dbda9e99
Opcode Fuzzy Hash: 6722859111ffc4eb03453040361c757ececfdfbfd16c903b0ccc8c205be5f2a7
Instruction Fuzzy Hash: DAE1597AC0526D8EDB63CA14DC8C7E9BBB4EB0431AF1203D6D409AA1A1C7765BC5EF50

Function 1201A170 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 219COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_enc.c,000004C3), ref: 1201A18F
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_enc.c,000004D1), ref: 1201A1CB
ERR_put_error.LIBEAY32(00000014,0000013A,00000041,.\ssl\t1_enc.c,0000050D), ref: 1201A1EC
CRYPTO_free.LIBEAY32(00000000), ref: 1201A3CB
CRYPTO_free.LIBEAY32(00000000), ref: 1201A3D8

Strings

.\ssl\t1_enc.c, xrefs: 1201A187, 1201A1C5, 1201A1DE, 1201A33F
master secret, xrefs: 1201A2EF
client finished, xrefs: 1201A274
server finished, xrefs: 1201A2B3
key expansion, xrefs: 1201A315

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc$R_put_error
String ID: .\ssl\t1_enc.c$client finished$key expansion$master secret$server finished
API String ID: 3736327811-3288890549
Opcode ID: dbf64acec93f74e77bcf5ed76f92e5896923860aa986152a5589ec417f4fe642
Instruction ID: 8750a29b328b461773807d378a8d54177173f4dfadd8110de57de3e2933baacc
Opcode Fuzzy Hash: dbf64acec93f74e77bcf5ed76f92e5896923860aa986152a5589ec417f4fe642
Instruction Fuzzy Hash: 6A611A73A042845FE306CB648840B9B7BE2AB81314F5A4668FD863F342D626FD86D791

Function 12012CA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 12012CB4

Part of subcall function 12031DBE: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,12026B1E), ref: 12031DC9
Part of subcall function 12031DBE: __aulldiv.LIBCMT ref: 12031DE9

RAND_add.LIBEAY32(?,00000004), ref: 12012CD4
ERR_clear_error.LIBEAY32 ref: 12012CDC
SetLastError.KERNEL32(00000000), ref: 12012CE2
SSL_state.SSLEAY32(?), ref: 12012D0C
SSL_state.SSLEAY32(?), ref: 12012D1C
SSL_clear.SSLEAY32(?), ref: 12012D2C
BUF_MEM_new.LIBEAY32 ref: 12012DD9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 12012DF2
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 12012E59
ERR_put_error.LIBEAY32(00000014,00000075,000000DD,.\ssl\s23_clnt.c,000000B2), ref: 12012EBF
BUF_MEM_free.LIBEAY32(?), ref: 12012ED7

Strings

.\ssl\s23_clnt.c, xrefs: 12012EA0, 12012EB1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_stateTime$D_addErrorFileL_clearLastM_freeM_growM_newO_ctrlR_clear_errorR_put_errorSystem__aulldiv__time64
String ID: .\ssl\s23_clnt.c
API String ID: 1200914411-2564810286
Opcode ID: 5ea3417e84a63d3fa0ea4c166649b6e5491ddfa9ac136109e8f05bbf594dd6ee
Instruction ID: 446944e3a580dd2044d8171aa3fc36507e67f02eda844e5b891af444694d7a41
Opcode Fuzzy Hash: 5ea3417e84a63d3fa0ea4c166649b6e5491ddfa9ac136109e8f05bbf594dd6ee
Instruction Fuzzy Hash: 6F5133F79007545FE762DE60DC41BEB72E4EF40308F400A2AF946AA280E7B5F054A6A6

Function 11075000 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 11075045
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?), ref: 11075050

Part of subcall function 1106F5B0: ENGINE_init.LIBEAY32(?,?,11014053,?,?), ref: 1106F5CE
Part of subcall function 1106F5B0: ERR_put_error.LIBEAY32(00000006,0000006E,00000026,.\crypto\evp\digest.c,00000134), ref: 1106F5EA

EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1107506F

Part of subcall function 1106F420: OpenSSLDie.LIBEAY32(.\crypto\evp\digest.c,00000118,ctx->digest->md_size <= EVP_MAX_MD_SIZE,?), ref: 1106F43D
Part of subcall function 1106F420: EVP_MD_CTX_set_flags.LIBEAY32(?,00000002), ref: 1106F475
Part of subcall function 1106F420: OPENSSL_cleanse.LIBEAY32(?,?,?,?), ref: 1106F487

EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 11075084

Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000002,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4B4
Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000004,?,?,?,?,?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4E0
Part of subcall function 1106F4A0: OPENSSL_cleanse.LIBEAY32(?,?), ref: 1106F4F6
Part of subcall function 1106F4A0: CRYPTO_free.LIBEAY32(?,?,?), ref: 1106F4FF
Part of subcall function 1106F4A0: EVP_PKEY_CTX_free.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F50F
Part of subcall function 1106F4A0: ENGINE_finish.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F51F

EVP_PKEY_size.LIBEAY32(?), ref: 11075099
EVP_PKEY_CTX_new.LIBEAY32(?,00000000,?), ref: 110750A4

Part of subcall function 1107A0C0: ENGINE_init.LIBEAY32(?,00000000,?,00000000,110750A9,?,00000000,?), ref: 1107A0E6
Part of subcall function 1107A0C0: ERR_put_error.LIBEAY32(00000006,0000009D,00000026,.\crypto\evp\pmeth_lib.c,00000094,?), ref: 1107A105

EVP_PKEY_sign_init.LIBEAY32(00000000), ref: 110750B3
EVP_PKEY_CTX_ctrl.LIBEAY32(00000000,000000FF,000000F8,00000001,00000000), ref: 110750CD

Part of subcall function 11079C50: ERR_put_error.LIBEAY32(00000006,00000089,00000095,.\crypto\evp\pmeth_lib.c,00000173,?,1106F3DF,?,000000FF,000000F8,00000007,00000000,?), ref: 11079C9C

EVP_PKEY_sign.LIBEAY32(00000000,?,?,?,?), ref: 110750EE

Part of subcall function 1107A380: ERR_put_error.LIBEAY32(00000006,0000008C,00000097,.\crypto\evp\pmeth_fn.c,00000070), ref: 1107A3BA

EVP_PKEY_CTX_free.LIBEAY32(00000000), ref: 1107510A
ERR_put_error.LIBEAY32(00000006,0000006B,0000006E,.\crypto\evp\p_sign.c,0000007B), ref: 11075151
ERR_put_error.LIBEAY32(00000006,0000006B,00000068,.\crypto\evp\p_sign.c,00000080), ref: 11075185

Strings

.\crypto\evp\p_sign.c, xrefs: 11075146, 1107517A

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$E_initL_cleanseX_freeX_test_flags$DigestE_finishFinal_exO_freeOpenX_cleanupX_copy_exX_ctrlX_initX_newX_set_flagsY_signY_sign_initY_size
String ID: .\crypto\evp\p_sign.c
API String ID: 2722034547-2269383897
Opcode ID: f26b2704d074352a50d2c255138b76de80ff0568400078c1a4daffc7954fdbc5
Instruction ID: 3c6f3c597890636b1aaed6cef204c4ca22567253a8740d09166cc04ed49544a2
Opcode Fuzzy Hash: f26b2704d074352a50d2c255138b76de80ff0568400078c1a4daffc7954fdbc5
Instruction Fuzzy Hash: 2C51D7B6E043025BD610CF64DC51FABB3E9AF98718F44852DF58997280FA35F904C7A6

Function 1201C6B0 Relevance: 22.6, APIs: 15, Instructions: 93COMMON

Download Yara Rule

APIs

pqueue_pop.LIBEAY32(?), ref: 1201C6BB
CRYPTO_free.LIBEAY32(?), ref: 1201C6DB
CRYPTO_free.LIBEAY32(?), ref: 1201C6E7
pqueue_free.LIBEAY32(00000000,?), ref: 1201C6ED
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C6FC
pqueue_pop.LIBEAY32(?), ref: 1201C714
CRYPTO_free.LIBEAY32(?), ref: 1201C72D
CRYPTO_free.LIBEAY32(?), ref: 1201C739
pqueue_free.LIBEAY32(00000000,?), ref: 1201C73F
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C74E
pqueue_pop.LIBEAY32(?), ref: 1201C766
CRYPTO_free.LIBEAY32(?), ref: 1201C77F
CRYPTO_free.LIBEAY32(?), ref: 1201C78B
pqueue_free.LIBEAY32(00000000,?), ref: 1201C791
pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C7A0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freepqueue_pop$pqueue_free
String ID:
API String ID: 2595648820-0
Opcode ID: 245ace8e9a0b73105848739771036a312aedf78d321eac40a9c83474f46c2fc0
Instruction ID: f542ee0d163bb6c6f9fc001e855bdd0cfcd470ec831b24b1d266a53597cdbb72
Opcode Fuzzy Hash: 245ace8e9a0b73105848739771036a312aedf78d321eac40a9c83474f46c2fc0
Instruction Fuzzy Hash: A93152BBA006515BC662D760C884EFBB3E4AF48752B094764EC459F310DB38F991E7D2

Function 1200F9E0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 427COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_pkt.c,0000028A,s->s3->wnum <= INT_MAX), ref: 1200FA16
SSL_state.SSLEAY32(?), ref: 1200FA36
ERR_put_error.LIBEAY32(00000014,0000009E,000000E5,.\ssl\s3_pkt.c,00000293,?,000021D1), ref: 1200FA74
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200FBC8
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,000021D1), ref: 1200FBDB
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1200FCE7
X509_get_issuer_name.LIBEAY32(?,?,000021D1), ref: 1200FD00
ERR_put_error.LIBEAY32(00000014,00000068,0000008D,.\ssl\s3_pkt.c,000003F8,?,000021D1), ref: 1200FD4E
EVP_MD_size.LIBEAY32(00000000,?,?,000021D1), ref: 1200FBE1

Part of subcall function 1200E1A0: SetLastError.KERNEL32(00000000,80000000,?,?,1200FE5E,?,?,?,?,?,?,?,?,?,000021D1), ref: 1200E1F2
Part of subcall function 1200E1A0: BIO_write.LIBEAY32(?,?,?), ref: 1200E217
Part of subcall function 1200E1A0: ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045C,?,?,?,?,?,000021D1), ref: 1200E237

ERR_put_error.LIBEAY32(00000014,0000009E,0000010F,.\ssl\s3_pkt.c,000002A2,?,000021D1), ref: 1200FF04

Strings

.\ssl\s3_pkt.c, xrefs: 1200FA11, 1200FA63, 1200FD40, 1200FEA4, 1200FEF3
s->s3->wnum <= INT_MAX, xrefs: 1200FA07

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_Y_get_object$D_sizeErrorL_stateLastO_writeOpenX509_get_issuer_nameX_flags
String ID: .\ssl\s3_pkt.c$s->s3->wnum <= INT_MAX
API String ID: 663342747-654347666
Opcode ID: 136563b4ad3b2ba8c60bcaf46faf2f861fe2c8365d0db296df2cf5229104bb71
Instruction ID: 11d6b475512efeb229c3e8b17d77f71c771750d08ade3d437bb20b37b8a088d1
Opcode Fuzzy Hash: 136563b4ad3b2ba8c60bcaf46faf2f861fe2c8365d0db296df2cf5229104bb71
Instruction Fuzzy Hash: 9CF112726047819FF301CF24C888B9AB7E5BF84398F04472DE88987391DB75E945EB96

Function 12027B60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

SSL_SESSION_free.SSLEAY32(?), ref: 12027F2B

Part of subcall function 12026C00: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,00000358,?,12026E1B,?,?,?,12021577,?,00000000,?), ref: 12026C22
Part of subcall function 12026C00: CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026C3C
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026C47
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026C52
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026C5D
Part of subcall function 12026C00: X509_free.LIBEAY32(?), ref: 12026C83
Part of subcall function 12026C00: sk_free.LIBEAY32(?), ref: 12026C96
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CA9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CBC
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CD9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CF6
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D09
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D1C
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D2F
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 12026D3D
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12026D43

Strings

.\ssl\ssl_sess.c, xrefs: 12027C49, 12027C7B, 12027C96, 12027D1A, 12027DE9

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$N_freeO_add_lockO_free_ex_dataX509_freesk_free
String ID: .\ssl\ssl_sess.c
API String ID: 597805295-1959455021
Opcode ID: cf993301ace81b2cf7f05325246586d5a4c2c7c55856a5ecc0cf5364bad06f60
Instruction ID: f640ef76db8c25d1990f12093832dd47e93634be783ddf535debc65be44371e1
Opcode Fuzzy Hash: cf993301ace81b2cf7f05325246586d5a4c2c7c55856a5ecc0cf5364bad06f60
Instruction Fuzzy Hash: B3B1C372A083429FD359CF24C840BEBB7E1FF84304F800A6EE9594B291D770E944DB92

Function 12019E40 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019EA8
EVP_MD_size.LIBEAY32(00000000,?), ref: 12019EAE
OpenSSLDie.LIBEAY32(.\ssl\t1_enc.c,00000405,t >= 0), ref: 12019ECB
EVP_MD_CTX_copy.LIBEAY32(?,?), ref: 12019EE8

Part of subcall function 12011180: OpenSSLDie.LIBEAY32(.\ssl\s3_cbc.c,000001C7,data_plus_mac_plus_padding_size < 1024 * 1024,?,?,?,?), ref: 12011215
Part of subcall function 12011180: X509_NAME_ENTRY_get_object.LIBEAY32(?,?,?,?,?), ref: 1201121E
Part of subcall function 12011180: pqueue_peek.LIBEAY32(00000000,?,?,?,?,?), ref: 12011224
Part of subcall function 12011180: SHA_Init.LIBEAY32(?,?,?), ref: 12011253

EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 12019FCA
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1201A02B
EVP_DigestUpdate.LIBEAY32(?,?,0000000D), ref: 1201A051
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1201A066
EVP_DigestSignFinal.LIBEAY32(?,?,?), ref: 1201A07D
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1201A095

Strings

t >= 0, xrefs: 12019EBC
.\ssl\t1_enc.c, xrefs: 12019EC6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$OpenUpdateX509_X_cleanupY_get_object$D_sizeFinalInitSignX_copyX_flagspqueue_peek
String ID: .\ssl\t1_enc.c$t >= 0
API String ID: 4021478592-2679512843
Opcode ID: 2a1dbb91f27a6b7d7bf874b529c262f93fb428ba950839ef8a6e6eab010e135c
Instruction ID: 0f17c439d136195d6e041b6719f43b31aa430eff566e7f2d178398aa94970279
Opcode Fuzzy Hash: 2a1dbb91f27a6b7d7bf874b529c262f93fb428ba950839ef8a6e6eab010e135c
Instruction Fuzzy Hash: F4815AB66083859FC305CB15C880B6BB7F5BF89304F044A2DF9958B352E775E948DBA2

Function 110751E0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 11075212
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?), ref: 1107521D

Part of subcall function 1106F5B0: ENGINE_init.LIBEAY32(?,?,11014053,?,?), ref: 1106F5CE
Part of subcall function 1106F5B0: ERR_put_error.LIBEAY32(00000006,0000006E,00000026,.\crypto\evp\digest.c,00000134), ref: 1106F5EA

EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 1107523C

Part of subcall function 1106F420: OpenSSLDie.LIBEAY32(.\crypto\evp\digest.c,00000118,ctx->digest->md_size <= EVP_MAX_MD_SIZE,?), ref: 1106F43D
Part of subcall function 1106F420: EVP_MD_CTX_set_flags.LIBEAY32(?,00000002), ref: 1106F475
Part of subcall function 1106F420: OPENSSL_cleanse.LIBEAY32(?,?,?,?), ref: 1106F487

EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1107524D

Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000002,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4B4
Part of subcall function 1106F4A0: EVP_MD_CTX_test_flags.LIBEAY32(?,00000004,?,?,?,?,?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F4E0
Part of subcall function 1106F4A0: OPENSSL_cleanse.LIBEAY32(?,?), ref: 1106F4F6
Part of subcall function 1106F4A0: CRYPTO_free.LIBEAY32(?,?,?), ref: 1106F4FF
Part of subcall function 1106F4A0: EVP_PKEY_CTX_free.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F50F
Part of subcall function 1106F4A0: ENGINE_finish.LIBEAY32(?,?,1106F61A,?,?,?,?,11014053,?,?), ref: 1106F51F

EVP_PKEY_CTX_new.LIBEAY32(?,00000000), ref: 11075263

Part of subcall function 1107A0C0: ENGINE_init.LIBEAY32(?,00000000,?,00000000,110750A9,?,00000000,?), ref: 1107A0E6
Part of subcall function 1107A0C0: ERR_put_error.LIBEAY32(00000006,0000009D,00000026,.\crypto\evp\pmeth_lib.c,00000094,?), ref: 1107A105

EVP_PKEY_verify_init.LIBEAY32(00000000), ref: 11075272
EVP_PKEY_CTX_ctrl.LIBEAY32(00000000,00000000,000000F8,00000001,00000000), ref: 1107528C

Part of subcall function 11079C50: ERR_put_error.LIBEAY32(00000006,00000089,00000095,.\crypto\evp\pmeth_lib.c,00000173,?,1106F3DF,?,000000FF,000000F8,00000007,00000000,?), ref: 11079C9C

EVP_PKEY_verify.LIBEAY32(00000000,?,?,?,?), ref: 110752B0

Part of subcall function 1107A4D0: ERR_put_error.LIBEAY32(00000006,0000008E,00000097,.\crypto\evp\pmeth_fn.c,00000092,110752B5,00000000,?,?,?,?), ref: 1107A501

EVP_PKEY_CTX_free.LIBEAY32(00000000), ref: 110752BB
ERR_put_error.LIBEAY32(00000006,0000006C,0000006E,.\crypto\evp\p_verify.c,0000006A), ref: 11075301
ERR_put_error.LIBEAY32(00000006,0000006C,00000069,.\crypto\evp\p_verify.c,0000006E), ref: 11075333

Strings

.\crypto\evp\p_verify.c, xrefs: 110752F6, 11075328

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$E_initL_cleanseX_freeX_test_flags$DigestE_finishFinal_exO_freeOpenX_cleanupX_copy_exX_ctrlX_initX_newX_set_flagsY_verifyY_verify_init
String ID: .\crypto\evp\p_verify.c
API String ID: 3551630253-3863208788
Opcode ID: 98556493162b09ee951c4d5ce1d127e6d237cefe2c8c7bf1271054ce170e2b1e
Instruction ID: 564c567e95c545a9bdb11253c6cd7b60d639a9938f95fadda3b1c304191f7114
Opcode Fuzzy Hash: 98556493162b09ee951c4d5ce1d127e6d237cefe2c8c7bf1271054ce170e2b1e
Instruction Fuzzy Hash: C2410BB6E043415BE610DB64DC41FABB3DAAFD4318F44452DF68587281FA32F905C796

Function 1200BE10 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

EVP_PKEY_size.LIBEAY32(?,?,?,?,12031443,?,0000004F,00000000,?), ref: 1200BE45
RSAPrivateKey_dup.LIBEAY32(?), ref: 1200BE64
ERR_put_error.LIBEAY32(00000014,00000085,00000004,.\ssl\s3_lib.c,00000E98), ref: 1200BE85
RSA_free.LIBEAY32(?), ref: 1200BE9B
DHparams_dup.LIBEAY32(?), ref: 1200BEC2
DH_free.LIBEAY32(?), ref: 1200BEE6
EC_KEY_dup.LIBEAY32(?,00000005,.\ssl\s3_lib.c,00000EB0), ref: 1200BF25
EC_KEY_generate_key.LIBEAY32(00000000), ref: 1200BF51
EC_KEY_free.LIBEAY32(00000000,?,00000EB0), ref: 1200BF5E
ERR_put_error.LIBEAY32(00000014,00000085,0000002B,.\ssl\s3_lib.c,00000ED3,00000000,?,00000EB0), ref: 1200BF76
EC_KEY_free.LIBEAY32(?), ref: 1200BF8C

Strings

.\ssl\s3_lib.c, xrefs: 1200BE77, 1200BEB4, 1200BED5, 1200BEFF, 1200BF18, 1200BF38, 1200BF68, 1200BFA5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorY_free$A_freeH_freeHparams_dupKey_dupPrivateY_dupY_generate_keyY_size
String ID: .\ssl\s3_lib.c
API String ID: 2078450012-3880942756
Opcode ID: 234f2a1a21a857bfa1d43b8e4eab5f8c6651fd55edfa27700c9a141bdfca4c37
Instruction ID: 07e879711dc0baf496c90a3b94549c6955cfce996a827fb8a665994b362a4a6d
Opcode Fuzzy Hash: 234f2a1a21a857bfa1d43b8e4eab5f8c6651fd55edfa27700c9a141bdfca4c37
Instruction Fuzzy Hash: B34158B3788B816BF211CE64CC41B9BB3E89B40B56F004739FB05BA2C1FAA0F4016645

Function 1201CEB0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

pqueue_size.LIBEAY32(?), ref: 1201CEC7
CRYPTO_malloc.LIBEAY32(0000003C,.\ssl\d1_pkt.c,000000FD), ref: 1201CEE6
pitem_new.LIBEAY32(?,00000000,0000003C,.\ssl\d1_pkt.c,000000FD), ref: 1201CEF3
ERR_put_error.LIBEAY32(00000014,000000F7,00000044,.\ssl\d1_pkt.c,0000012A), ref: 1201CFE4
CRYPTO_free.LIBEAY32(?), ref: 1201CFF4
CRYPTO_free.LIBEAY32(00000000), ref: 1201CFFD
pqueue_free.LIBEAY32(?,00000000), ref: 1201D003

Strings

.\ssl\d1_pkt.c, xrefs: 1201CEDF, 1201CFD6, 1201D039

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_mallocR_put_errorpitem_newpqueue_freepqueue_size
String ID: .\ssl\d1_pkt.c
API String ID: 4281507345-285292661
Opcode ID: defadef793c417512f7dac7b0308e268e059645ea7a56c76551f2b694c9b58a9
Instruction ID: c25e0baf38a37e9fac7b0300ea7c2da04dd1155153c88aa0881570c1e1e84e65
Opcode Fuzzy Hash: defadef793c417512f7dac7b0308e268e059645ea7a56c76551f2b694c9b58a9
Instruction Fuzzy Hash: 1B41A0B6A40201AFD709DF18DC40BA6B7E4EF48311F1586BEF90A9F392DA35E410AB51

Function 12012110 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 1201211F

Part of subcall function 12031DBE: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,12026B1E), ref: 12031DC9
Part of subcall function 12031DBE: __aulldiv.LIBCMT ref: 12031DE9

RAND_add.LIBEAY32(?,00000004), ref: 12012141
ERR_clear_error.LIBEAY32 ref: 12012149
SetLastError.KERNEL32(00000000), ref: 1201214F
SSL_state.SSLEAY32(?), ref: 12012179
SSL_state.SSLEAY32(?), ref: 12012189
SSL_clear.SSLEAY32(?), ref: 12012199
BUF_MEM_new.LIBEAY32 ref: 120121F9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201220E
ERR_put_error.LIBEAY32(00000014,00000073,000000FF,.\ssl\s23_srvr.c,000000DB), ref: 120122A1
BUF_MEM_free.LIBEAY32(00000000), ref: 120122AC

Strings

.\ssl\s23_srvr.c, xrefs: 12012293

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_stateTime$D_addErrorFileL_clearLastM_freeM_growM_newR_clear_errorR_put_errorSystem__aulldiv__time64
String ID: .\ssl\s23_srvr.c
API String ID: 2953086484-3589918356
Opcode ID: bfecb6e45e60c7e6c033034b0410a8cd05114cb53dcedd376cbd428d3f7ef359
Instruction ID: 7a4e06e79fd59144d6d3727b58ab5351d26aa8a1de88d650419c7a9a7be6db9f
Opcode Fuzzy Hash: bfecb6e45e60c7e6c033034b0410a8cd05114cb53dcedd376cbd428d3f7ef359
Instruction Fuzzy Hash: 754126F79407106FF762CB61DD84BAB72E5EF50704F000A39EE06AA281E7B5F105E662

Function 120157C0 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,?,12016158,120061B1,120061B1,?,FFFFFFFF,?,120061B1,?,?,?), ref: 120157FE
CRYPTO_free.LIBEAY32(?), ref: 12015942
CRYPTO_malloc.LIBEAY32(120061B1,.\ssl\t1_lib.c,00000AA5), ref: 12015955
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 120159CF
CRYPTO_free.LIBEAY32(?,?,120061B1,?,?,?), ref: 12015AAB
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,00000B11,?,?,120061B1,?,?,?), ref: 12015AC0
BUF_strdup.LIBEAY32(?), ref: 12015CAF
ERR_put_error.LIBEAY32(00000014,00000141,00000152,.\ssl\t1_lib.c,00000B8E), ref: 12015DD0

Strings

.\ssl\t1_lib.c, xrefs: 1201594F, 12015ABA, 12015B6E, 12015DB9

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_malloc$F_strdupL_ctrlR_put_error
String ID: .\ssl\t1_lib.c
API String ID: 1794571826-2047370388
Opcode ID: 63bd470d8dcce1d98b4b70261837ec861adb50bb31743adda7226591f2c8c41d
Instruction ID: d5f45491d240e22f9fc779a472584226fbc95c9b047f0164ed8caef2197d5816
Opcode Fuzzy Hash: 63bd470d8dcce1d98b4b70261837ec861adb50bb31743adda7226591f2c8c41d
Instruction Fuzzy Hash: 76F127726043428FD311DF25D888BE7BBE5EB84318F48066DE89A8F241E736F545EB51

Function 1200C70E Relevance: 19.6, APIs: 13, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1200C731
EVP_sha1.LIBEAY32(00000000), ref: 1200C73F
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200C74A
EVP_DigestUpdate.LIBEAY32(?,?,00000001), ref: 1200C765
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200C78C
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200C7AC
EVP_DigestUpdate.LIBEAY32(?,?,00000020), ref: 1200C7CD
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200C7E9
EVP_md5.LIBEAY32(00000000), ref: 1200C7FB
EVP_DigestInit_ex.LIBEAY32(?,00000000,00000000), ref: 1200C806
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 1200C829
EVP_DigestUpdate.LIBEAY32(?,?,00000014), ref: 1200C845
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200C864
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1200C887
ERR_put_error.LIBEAY32(00000014,000000EE,00000044,.\ssl\s3_enc.c,000000D8), ref: 1200C8B8
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200C8C5
EVP_MD_CTX_cleanup.LIBEAY32(?,?), ref: 1200C8CF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Final_ex$Init_exX_cleanup$P_md5P_sha1R_put_error_memset
String ID:
API String ID: 119789559-0
Opcode ID: 77f30afb4697fcbb8f7228cae8e8b1e40e01ed7fc62036a551237e78f3481997
Instruction ID: 193bee2fbe26c6433a823dc031e996ecc4e1162f2d8c1f05de19ab737b5508dd
Opcode Fuzzy Hash: 77f30afb4697fcbb8f7228cae8e8b1e40e01ed7fc62036a551237e78f3481997
Instruction Fuzzy Hash: 574176BB904300ABF341D7609C80FEBB3A96B88384F054F2DB95697141EB34E508D7BA

Function 1201F940 Relevance: 19.6, APIs: 13, Instructions: 94COMMON

Download Yara Rule

APIs

SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F953
BIO_ctrl.LIBEAY32(00000000), ref: 1201F95C
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F98B
BIO_ctrl.LIBEAY32(00000000), ref: 1201F994
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201F9B9
SSL_get_wbio.SSLEAY32(?,00000028,00000000,00000000), ref: 1201F9D3
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201F9DC
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201F9F4
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201F9FD
SSL_get_wbio.SSLEAY32(?,00000031,00000000,00000000), ref: 1201FA1E
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FA27
SSL_get_wbio.SSLEAY32(?,0000002A,?,00000000), ref: 1201FA4E
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FA57

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_wbioO_ctrl$L_ctrl
String ID:
API String ID: 1073945668-0
Opcode ID: 1e0120126c8e6d60f7730b51dc77038c420c5bb9ecc5251fa6bb29e8d96293a0
Instruction ID: d302c7d9d8e2711bac243c1472f969a5b75f9944db3774e847b31ad4faf39812
Opcode Fuzzy Hash: 1e0120126c8e6d60f7730b51dc77038c420c5bb9ecc5251fa6bb29e8d96293a0
Instruction Fuzzy Hash: 4031FCB9A407002FE715D6288C0AFAA73A89F4474AF544778F605AE3C2F5F9B1414689

Function 120029E0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

SSL_get_client_CA_list.SSLEAY32(?), ref: 12002A99
sk_num.LIBEAY32(00000000), ref: 12002ABA
sk_value.LIBEAY32(00000000,?), ref: 12002AD6
i2d_X509_NAME.LIBEAY32(00000000,00000000,00000000,?), ref: 12002AE0
BUF_MEM_grow_clean.LIBEAY32(?,?,00000000,00000000,00000000,?), ref: 12002B00
i2d_X509_NAME.LIBEAY32(00000000,?), ref: 12002B4C
i2d_X509_NAME.LIBEAY32(00000000,?), ref: 12002B76
sk_num.LIBEAY32(?), ref: 12002BA5
BUF_MEM_grow_clean.LIBEAY32(?,?), ref: 12002C15
ERR_put_error.LIBEAY32(00000014,00000096,00000007,.\ssl\s3_srvr.c,0000085D), ref: 12002C34

Strings

.\ssl\s3_srvr.c, xrefs: 12002C26

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_i2d_$M_grow_cleansk_num$A_listL_get_client_R_put_errorsk_value
String ID: .\ssl\s3_srvr.c
API String ID: 2694735594-3445611115
Opcode ID: 5d0680027afa8531c1ce17ce16fbbbae7c10b64ca7a93219b7f1d8eb041a2ef3
Instruction ID: 9761a8ad94745c7c1d971441a5ac2d7155f55b397086dbdd79c5c7eced3da44e
Opcode Fuzzy Hash: 5d0680027afa8531c1ce17ce16fbbbae7c10b64ca7a93219b7f1d8eb041a2ef3
Instruction Fuzzy Hash: 8C917D766043419FD341CF28C880A5BBBE5FF89318F048A5DE88997342D774F906CB96

Function 1201D690 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000101,00000092,.\ssl\d1_pkt.c,00000262), ref: 1201D8D5

Part of subcall function 1200E3D0: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E41A

Strings

@, xrefs: 1201D76C
mac_size <= EVP_MAX_MD_SIZE, xrefs: 1201D771
.\ssl\d1_pkt.c, xrefs: 1201D6DC, 1201D77B, 1201D854, 1201D885, 1201D8A3, 1201D8BF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorX_remove_session
String ID: .\ssl\d1_pkt.c$@$mac_size <= EVP_MAX_MD_SIZE
API String ID: 456774654-2169613476
Opcode ID: 216b6ca158204055500a260f96001362a300821aaeb4746d0022fc3f30a36055
Instruction ID: 7ff37790b08203b70f28f0d583d239af0fd86467e19cdd28d2b95bd29d37b52b
Opcode Fuzzy Hash: 216b6ca158204055500a260f96001362a300821aaeb4746d0022fc3f30a36055
Instruction Fuzzy Hash: AF61C477A40301AFE310EB74DC81BAAF3E4BF44701F018A39E6599B681EB75E514D792

Function 12027580 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

SSL_SESSION_new.SSLEAY32(?,?,00000008,1200134B,?,00000001), ref: 12027592

Part of subcall function 12026AB0: CRYPTO_malloc.LIBEAY32(000000F4,.\ssl\ssl_sess.c,000000C4), ref: 12026AC1
Part of subcall function 12026AB0: ERR_put_error.LIBEAY32(00000014,000000BD,00000041,.\ssl\ssl_sess.c,000000C6), ref: 12026AE4

SSL_get_default_timeout.SSLEAY32(?,?,?,?,00000008,1200134B,?,00000001), ref: 120275B9
SSL_SESSION_free.SSLEAY32(?,?,?,?,00000008,1200134B,?,00000001), ref: 120275D2
BUF_strdup.LIBEAY32(?), ref: 12027732
ERR_put_error.LIBEAY32(00000014,000000B5,00000044,.\ssl\ssl_sess.c,00000213,?,?,?,00000008,1200134B,?,00000001), ref: 1202778E
SSL_SESSION_free.SSLEAY32(00000000,00000014,000000B5,00000044,.\ssl\ssl_sess.c,00000213,?,?,?,00000008,1200134B,?,00000001), ref: 12027794

Strings

.\ssl\ssl_sess.c, xrefs: 12027667, 12027699, 120276C6, 12027719, 12027750, 12027761, 12027780

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_freeR_put_error$F_strdupL_get_default_timeoutN_newO_malloc
String ID: .\ssl\ssl_sess.c
API String ID: 4023725585-1959455021
Opcode ID: 8b0f9ce4d60ccacd65eaceeb45b1be74d80cb050a123a338b6c48fade7b5e99c
Instruction ID: 60bfedf8d619ddf14a06ef1887983039cb1dbf687fdfa2b172c5ed7bd9ec3238
Opcode Fuzzy Hash: 8b0f9ce4d60ccacd65eaceeb45b1be74d80cb050a123a338b6c48fade7b5e99c
Instruction Fuzzy Hash: 0051B4B7640242AFE329CF24DC94BDAF3E4AB14704FA00B3FE69AC6690D771A540E751

Function 120221C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

sk_zero.LIBEAY32(?), ref: 12022215
CRYPTO_free.LIBEAY32(?), ref: 1202222E
BUF_memdup.LIBEAY32(?,?,?), ref: 1202223D
sk_new_null.LIBEAY32 ref: 1202226A
ERR_put_error.LIBEAY32(00000014,000000A1,00000041,.\ssl\ssl_lib.c,000005F7), ref: 1202228A
sk_push.LIBEAY32(?,00000000,?,?,?,?), ref: 12022332
ERR_put_error.LIBEAY32(00000014,000000A1,00000159,.\ssl\ssl_lib.c,00000610), ref: 1202237B
ERR_put_error.LIBEAY32(00000014,000000A1,00000175,.\ssl\ssl_lib.c,00000627,?,?,?,?,?,?), ref: 120223A5
ERR_put_error.LIBEAY32(00000014,000000A1,00000041,.\ssl\ssl_lib.c,00000635,?,?,?,?,?,?), ref: 120223D5
sk_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 120223EF

Strings

.\ssl\ssl_lib.c, xrefs: 1202227C, 1202236A, 12022394, 120223C7, 12022403

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$F_memdupO_freesk_freesk_new_nullsk_pushsk_zero
String ID: .\ssl\ssl_lib.c
API String ID: 3714662604-3333140318
Opcode ID: c468b63231c099659e0852e26fdfdbb92ab3978da420c0efdf4fcf2068b606b7
Instruction ID: 70dd8e17b85805971430bda64f1dcb231fbd16d2a31a1fa394c1f4ec538f3b09
Opcode Fuzzy Hash: c468b63231c099659e0852e26fdfdbb92ab3978da420c0efdf4fcf2068b606b7
Instruction Fuzzy Hash: DC513977B44342AFFB11CE948C85FDA73D4AB44715F45023AFA085B2C1E6B2E494A762

Function 1201F320 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000494,s->init_off == 0,?,000021D0,?,?,120201FA), ref: 1201F352
CRYPTO_malloc.LIBEAY32(00000034,.\ssl\d1_both.c,000000B5,?,000021D0,?,?,120201FA), ref: 1201F36B
CRYPTO_malloc.LIBEAY32(00000001,.\ssl\d1_both.c,000000BA,?,000021D0,000021D1), ref: 1201F38C
CRYPTO_free.LIBEAY32(00000000,?,?,?,?,000021D0,000021D1), ref: 1201F39B
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,000004A3,s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num,?,?,?,?,000021D0,000021D1), ref: 1201F429
pitem_new.LIBEAY32(?,00000000), ref: 1201F4CA
pqueue_insert.LIBEAY32(?,00000000), ref: 1201F4FF

Strings

s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num, xrefs: 1201F41A
s->d1->w_msg_hdr.msg_len + ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH) == (unsigned int)s->init_num, xrefs: 1201F3FD
s->init_off == 0, xrefs: 1201F343
.\ssl\d1_both.c, xrefs: 1201F34D, 1201F362, 1201F386, 1201F424

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocOpen$O_freepitem_newpqueue_insert
String ID: .\ssl\d1_both.c$s->d1->w_msg_hdr.msg_len + ((s->version==DTLS1_BAD_VER)?3:DTLS1_CCS_HEADER_LENGTH) == (unsigned int)s->init_num$s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num$s->init_off == 0
API String ID: 1684451478-3568217391
Opcode ID: 6f5a83a98ddf24d9c38fbcbf22a6b826669ab2c67a4770ebb5de3ef638e1a4e9
Instruction ID: a5199ece9a460699b71d4142976364cd000377892cd4a80f483d7af2631878e5
Opcode Fuzzy Hash: 6f5a83a98ddf24d9c38fbcbf22a6b826669ab2c67a4770ebb5de3ef638e1a4e9
Instruction Fuzzy Hash: BA518976604702AFD314CF24D885BAAF7E0BF58309F04862DE95A87B41E735F419DB92

Function 12030F80 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SRP_Verify_A_mod_N.LIBEAY32(?,?,?,?), ref: 12030FAC
SRP_Calc_u.LIBEAY32(?,?,?), ref: 12030FD1
SRP_Calc_server_key.LIBEAY32(?,?,?,?,?), ref: 12031006
BN_num_bits.LIBEAY32(00000000), ref: 12031017
CRYPTO_malloc.LIBEAY32(-00000007,.\ssl\tls_srp.c,00000162,00000000), ref: 12031035
BN_bn2bin.LIBEAY32(00000000,00000000), ref: 12031045
OPENSSL_cleanse.LIBEAY32(00000000,-00000007), ref: 12031063
CRYPTO_free.LIBEAY32(00000000,00000000,-00000007), ref: 12031069
BN_clear_free.LIBEAY32(00000000), ref: 12031074
BN_clear_free.LIBEAY32(?,00000000), ref: 1203107E

Strings

.\ssl\tls_srp.c, xrefs: 1203102F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_free$A_mod_Calc_server_keyCalc_uL_cleanseN_bn2binN_num_bitsO_freeO_mallocVerify_
String ID: .\ssl\tls_srp.c
API String ID: 795914763-3972901604
Opcode ID: 56a5cbfed11956cc77554f728adf1712edc015ac9e1798f67372d74a2b4b8d58
Instruction ID: c496f005e981f0f532777714277dfc5cd23cfa2646cc8ccbc853f4bc25994b25
Opcode Fuzzy Hash: 56a5cbfed11956cc77554f728adf1712edc015ac9e1798f67372d74a2b4b8d58
Instruction Fuzzy Hash: B7215EBB6007046FD291DB65CC80EB7B3FDDF89711F04461CF85A97240EA71F84096A1

Function 12024F80 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,00000094,00000000,120242B9), ref: 12024FA2
X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 12024FC1
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,0000009B), ref: 12024FE2
CRYPTO_lock.LIBEAY32(00000005,0000000C,.\ssl\ssl_cert.c,000000A1,120242B9), ref: 12024FFC
CRYPTO_lock.LIBEAY32(00000006,0000000C,.\ssl\ssl_cert.c,000000A4), ref: 1202501C
CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_cert.c,000000A5,00000006,0000000C,.\ssl\ssl_cert.c,000000A4), ref: 1202502F
X509_STORE_CTX_get_ex_new_index.LIBEAY32(00000000,SSL for verify callback,00000000,00000000,00000000), ref: 1202504E
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_cert.c,000000B1), ref: 12025069
CRYPTO_lock.LIBEAY32(00000006,0000000C,.\ssl\ssl_cert.c,000000B3), ref: 12025085

Strings

.\ssl\ssl_cert.c, xrefs: 12024F99, 12024FD9, 12024FF3, 12025013, 12025026, 12025060, 1202507C
SSL for verify callback, xrefs: 12024FBA, 12025047

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$X509_X_get_ex_new_index
String ID: .\ssl\ssl_cert.c$SSL for verify callback
API String ID: 3006592226-852846603
Opcode ID: 02f0d5b5e95440d417575edbfb3d348338ec446133986d2dfd82720446bfe8ec
Instruction ID: 2789d105777a5fd3bed85d9798821d777bfe11120ae89f0d58a98063d9c52782
Opcode Fuzzy Hash: 02f0d5b5e95440d417575edbfb3d348338ec446133986d2dfd82720446bfe8ec
Instruction Fuzzy Hash: F2216F36BC43907BF660E3589D93F92A2A0A740F09F9AC710FB453E5C3E5906851629A

Function 12030E30 Relevance: 18.1, APIs: 12, Instructions: 102COMMON

Download Yara Rule

APIs

BN_copy.LIBEAY32(?,?), ref: 12030E4C
BN_free.LIBEAY32(?), ref: 12030E5F
BN_dup.LIBEAY32(?), ref: 12030E6C
BN_copy.LIBEAY32(?,?), ref: 12030E8E
BN_free.LIBEAY32(?), ref: 12030EA1
BN_dup.LIBEAY32(?), ref: 12030EAE
BN_copy.LIBEAY32(?,?), ref: 12030ED0
BN_free.LIBEAY32(?), ref: 12030EE3
BN_dup.LIBEAY32(?), ref: 12030EF0
BN_copy.LIBEAY32(?,?), ref: 12030F12
BN_free.LIBEAY32(?), ref: 12030F25
BN_dup.LIBEAY32(?), ref: 12030F32

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_copyN_dupN_free
String ID:
API String ID: 1059999148-0
Opcode ID: 0968e7e88ce1994448531cdcccc77235f9fd1cd6434f69d266f81e9b70693004
Instruction ID: 5951d5da045d54e39f6811f3f379cb31fc33b882b4e0fd223459e9bbce62da06
Opcode Fuzzy Hash: 0968e7e88ce1994448531cdcccc77235f9fd1cd6434f69d266f81e9b70693004
Instruction Fuzzy Hash: 1931A5B7716B419FD653CB7888406EBB2E66F88B03F240B1DE4DA86244E731F481E752

Function 12005860 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000083,00000183,.\ssl\s3_clnt.c,000002C9), ref: 12005912
ERR_put_error.LIBEAY32(00000014,00000083,0000010A,.\ssl\s3_clnt.c,000002D0), ref: 12005949
DTLSv1_client_method.SSLEAY32 ref: 12005963
DTLSv1_2_client_method.SSLEAY32 ref: 1200597B
ERR_put_error.LIBEAY32(00000014,00000083,000000B5,.\ssl\s3_clnt.c,00000345), ref: 12005A49
SSL_get_ciphers.SSLEAY32(?,?,00000000), ref: 12005ACD
sk_num.LIBEAY32(?), ref: 12005B22
sk_value.LIBEAY32(?,00000000), ref: 12005B4E

Part of subcall function 12014160: SSL_get_ciphers.SSLEAY32(00000000,00000000,?,?,00000000,12005B9B,?,?,?,?), ref: 12014197
Part of subcall function 12014160: sk_num.LIBEAY32(00000000,00000000,00000000,?,?,00000000,12005B9B,?,?,?,?), ref: 1201419F
Part of subcall function 12014160: sk_value.LIBEAY32(00000000,00000000,?,?), ref: 120141B2
Part of subcall function 12014160: sk_num.LIBEAY32(00000000,?,?,?,?), ref: 120141C8

Part of subcall function 1200E3D0: SSL_CTX_remove_session.SSLEAY32(?,?), ref: 1200E41A

ERR_put_error.LIBEAY32(00000014,00000083,00000044,.\ssl\s3_clnt.c,00000371,?,00000002,?), ref: 12005BC2

Strings

.\ssl\s3_clnt.c, xrefs: 12005901, 12005938, 12005A3B, 12005AE8, 12005B75, 12005BB4

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_num$L_get_cipherssk_value$Sv1_2_client_methodSv1_client_methodX_remove_session
String ID: .\ssl\s3_clnt.c
API String ID: 2006378157-2155475665
Opcode ID: 35740f5b3494b842c72ca43e3227e22fa59c3f88fce7208f7faba89693ba2482
Instruction ID: c45fd84ccba1159636c1115c6c050c7e143905ee75cd7f10569eb94900e800c1
Opcode Fuzzy Hash: 35740f5b3494b842c72ca43e3227e22fa59c3f88fce7208f7faba89693ba2482
Instruction Fuzzy Hash: F3A11E76600244AFF712CF14EC84FEA3BE4BB44354F048268ED495B282E3B5E589D765

Function 1201D940 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,00000623,len <= SSL3_RT_MAX_PLAIN_LENGTH,?,-00000013,1201F8BB,?,00000018,00000000,00000025), ref: 1201D967
OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,00000639,120404E4), ref: 1201D995
X509_NAME_ENTRY_get_object.LIBEAY32(?,?,00000000), ref: 1201D9F7
X509_NAME_ENTRY_get_object.LIBEAY32(?,00000025), ref: 1201DA14
EVP_MD_size.LIBEAY32(00000000,?,00000025), ref: 1201DA1A
EVP_CIPHER_CTX_flags.LIBEAY32(?,?,00000000), ref: 1201DA72
X509_get_issuer_name.LIBEAY32(?,00000025), ref: 1201DA8B
ERR_put_error.LIBEAY32(00000014,000000F5,0000008D,.\ssl\d1_pkt.c,000006AE,00000025), ref: 1201DAF1

Strings

len <= SSL3_RT_MAX_PLAIN_LENGTH, xrefs: 1201D958
.\ssl\d1_pkt.c, xrefs: 1201D962, 1201D990, 1201DAE0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: OpenX509_Y_get_object$D_sizeR_put_errorX509_get_issuer_nameX_flags
String ID: .\ssl\d1_pkt.c$len <= SSL3_RT_MAX_PLAIN_LENGTH
API String ID: 2157370477-491979900
Opcode ID: d338dcc3a4f2d4974d26aaf9a9d31262f8ea445694f2e9f1f77a5c3741b56b50
Instruction ID: dc1ea685346d8397f6555f8402b00fcf5fc1745a7806ed21bc203f296ba47489
Opcode Fuzzy Hash: d338dcc3a4f2d4974d26aaf9a9d31262f8ea445694f2e9f1f77a5c3741b56b50
Instruction Fuzzy Hash: 4A91BAB2604742AFD315DF28C880BE6F7E0FF89314F044729E89A8B281D770E944DBA1

Function 120194D0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000D3,0000008A,.\ssl\t1_enc.c,0000028C), ref: 12019544

Strings

.\ssl\t1_enc.c, xrefs: 12019533, 120195B5, 120195CE, 12019601, 12019620

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\t1_enc.c
API String ID: 1767461275-3943519339
Opcode ID: 095f60d49baacba7104601f58150e9fe3c68df9be390ff114fe7926c33bca467
Instruction ID: 26a9dad40f1f92a2c1c0177b8abbab803e30a6f3ecd8ecd167a1a21686a2b5f5
Opcode Fuzzy Hash: 095f60d49baacba7104601f58150e9fe3c68df9be390ff114fe7926c33bca467
Instruction Fuzzy Hash: E251DE766003449FD311DF59CC84FA7B3E4FB88304F04466DF54AAB252D7B1E6449BA2

Function 1200D120 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 1200D050: EVP_MD_CTX_destroy.LIBEAY32(?,?), ref: 1200D085
Part of subcall function 1200D050: CRYPTO_free.LIBEAY32(00000000,?), ref: 1200D09F

CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D141
ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D171
BIO_ctrl.LIBEAY32(?,00000003,00000000,?,00000000), ref: 1200D1AE
ERR_put_error.LIBEAY32(00000014,00000125,0000014C,.\ssl\s3_enc.c,0000027B), ref: 1200D1D2

Strings

.\ssl\s3_enc.c, xrefs: 1200D13A, 1200D163, 1200D1C1, 1200D283, 1200D303

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_ctrlO_freeO_mallocX_destroy
String ID: .\ssl\s3_enc.c
API String ID: 2031752727-1985432667
Opcode ID: e58a108d2f4cfc0fe4ca4fbf3be2393a6192f2699c6e8eb9b18dbc84cc860f49
Instruction ID: 91f0404c699bcbef5b3f8319f830890b69e13b7c6f72d6e3f3547299da67a2cb
Opcode Fuzzy Hash: e58a108d2f4cfc0fe4ca4fbf3be2393a6192f2699c6e8eb9b18dbc84cc860f49
Instruction Fuzzy Hash: 4351C076644300AFF341CB28DC80BE673E5AF88308F54867CE9099B281EAB1E445DBA1

Function 1202EEF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

SSL_CTX_ctrl.SSLEAY32(?,0000005E,?,00000000), ref: 1202EF8F

Strings

auto, xrefs: 1202EF50
automatic, xrefs: 1202EF23

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X_ctrl
String ID: auto$automatic
API String ID: 3359300933-1510859630
Opcode ID: cb3bd6c0513fb2deedc238bf539759e79983fe48f184c1bc9a80c5739abd1d5f
Instruction ID: 20b208b4d861850928eac58962c22efe6d1f03392ba6a9dc836014b220dfa329
Opcode Fuzzy Hash: cb3bd6c0513fb2deedc238bf539759e79983fe48f184c1bc9a80c5739abd1d5f
Instruction Fuzzy Hash: 39315963B8524616E752D9745C84BE7B7C88F012B5F880367ED54DB1C1F713F811B190

Function 120293A0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 120293AD
_strncmp.LIBCMT ref: 120293DB
ERR_put_error.LIBEAY32(00000014,0000014B,0000017B,.\ssl\ssl_ciph.c,0000059D), ref: 120294A0

Strings

SUITEB192, xrefs: 1202942E
SUITEB128C2, xrefs: 120293D5
SUITEB128ONLY, xrefs: 120293A5
.\ssl\ssl_ciph.c, xrefs: 1202947E, 1202948F
SUITEB128, xrefs: 12029403

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _strncmp$R_put_error
String ID: .\ssl\ssl_ciph.c$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 3709734218-1589776776
Opcode ID: 125bb6f2a15e1212a840ebea662b9cef0e22b556d7cd8b29614e9872bd32df39
Instruction ID: c21f22886fee14d6487193ffce9ccd12082518da719ba7de46588def11eadb4d
Opcode Fuzzy Hash: 125bb6f2a15e1212a840ebea662b9cef0e22b556d7cd8b29614e9872bd32df39
Instruction Fuzzy Hash: D531BC73B402469FEB56CE24ECD1FA937D4AF44351FB2066AFC568B2C6E664D8C0E640

Function 12022AC0 Relevance: 16.8, APIs: 11, Instructions: 313COMMON

Download Yara Rule

APIs

RSA_size.LIBEAY32(?,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022B2D
DH_size.LIBEAY32(?,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022B6D
EVP_PKEY_size.LIBEAY32(?,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022BAF
EVP_PKEY_size.LIBEAY32(?,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022BF2
EVP_PKEY_size.LIBEAY32(?,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022C26
X509_check_purpose.LIBEAY32(?,000000FF,00000000,12001C0D,?,55000021,00000000,120230D4,55000021,?,?,?,12015EDF,?), ref: 12022D65
X509_get_pubkey.LIBEAY32(?), ref: 12022DB5
EVP_PKEY_bits.LIBEAY32(00000000,?,12001C0D,?,?), ref: 12022DC4
EVP_PKEY_free.LIBEAY32(00000000), ref: 12022DDB
OBJ_obj2nid.LIBEAY32(?,?,?,12001C0D,?,?), ref: 12022DF2
OBJ_find_sigid_algs.LIBEAY32(00000000,?,?,?,?,?,12001C0D,?,?), ref: 12022E02

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Y_size$A_sizeH_sizeJ_find_sigid_algsJ_obj2nidX509_check_purposeX509_get_pubkeyY_bitsY_free
String ID:
API String ID: 4117094813-0
Opcode ID: fd526b468954ff087d42a7bcbebc3afeb951f1f12cc99e17fa45f2d7832bb93e
Instruction ID: 872e7d5560036103ba006f6a73ccbe2cb08680b7a272938f250dda50e43c06c8
Opcode Fuzzy Hash: fd526b468954ff087d42a7bcbebc3afeb951f1f12cc99e17fa45f2d7832bb93e
Instruction Fuzzy Hash: 0CC15272904742CFD716CFA4C88579BB7F0FB84308F944A2FE59686250D7B8E588DB82

Function 12034E7C Relevance: 16.8, APIs: 11, Instructions: 288COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 12034F19
_write_string.LIBCMT ref: 12034F39
_write_multi_char.LIBCMT ref: 12034F5B
__cftof.LIBCMT ref: 12034F9B
_write_string.LIBCMT ref: 12034FBE
_write_multi_char.LIBCMT ref: 12035007

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof
String ID:
API String ID: 3900997005-0
Opcode ID: aed12aad0cc5d9adfbb1907728cb8b0bd0fd60be35c85bc55e6cb9896d3747fe
Instruction ID: c9bae218475b0c9e23376397f31fbbb863db0c6c631daefc19a8bacf5d28907f
Opcode Fuzzy Hash: aed12aad0cc5d9adfbb1907728cb8b0bd0fd60be35c85bc55e6cb9896d3747fe
Instruction Fuzzy Hash: EEC1697AC4526D9EDB63CA10DC8C7EDBBB4EB08316F1202D6D408AA1A0D7765BC5EF50

Function 12034E95 Relevance: 16.8, APIs: 11, Instructions: 285COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 12034F19
_write_string.LIBCMT ref: 12034F39
_write_multi_char.LIBCMT ref: 12034F5B
__cftof.LIBCMT ref: 12034F9B
_write_string.LIBCMT ref: 12034FBE
_write_multi_char.LIBCMT ref: 12035007

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _write_multi_char$_write_string$__cftof
String ID:
API String ID: 3900997005-0
Opcode ID: 4302b3bc508dd9cab072593a1343451beba7ec430f26d592f71718506df36b0d
Instruction ID: baf768f540388320f061552325de1119eeff7751bbf13100969536c55310cbda
Opcode Fuzzy Hash: 4302b3bc508dd9cab072593a1343451beba7ec430f26d592f71718506df36b0d
Instruction Fuzzy Hash: 13C16A7AC4526D8EDB63CA10DC8C7EDBBB4EB08316F1102D6D409AA1A0C7765BC5EF50

Function 1202F830 Relevance: 16.6, APIs: 11, Instructions: 143COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBEAY32(?,0000000F), ref: 1202F861
SSL_read.SSLEAY32(?,?,?,?,0000000F), ref: 1202F86D
SSL_get_error.SSLEAY32(?,00000000,?,?,?,?,0000000F), ref: 1202F876

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_errorL_readO_clear_flags
String ID:
API String ID: 138930502-0
Opcode ID: 1cf8b907d5973579756d4b9a9285b713c9b4d10149d8068524225fa30def164c
Instruction ID: 7743a06b5d9bc966bd3b6318e936551f50fcc247b7c21ea61e9be9d2913f11c3
Opcode Fuzzy Hash: 1cf8b907d5973579756d4b9a9285b713c9b4d10149d8068524225fa30def164c
Instruction Fuzzy Hash: 3341B476A043049FD700DF19EC81B9BF7E8EF84765F90863FE84986601D279F4199BA2

Function 1201D1B0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 301COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\d1_pkt.c,00000639,120404E4), ref: 1201D202

Part of subcall function 1200E1A0: SetLastError.KERNEL32(00000000,80000000,?,?,1200FE5E,?,?,?,?,?,?,?,?,?,000021D1), ref: 1200E1F2
Part of subcall function 1200E1A0: BIO_write.LIBEAY32(?,?,?), ref: 1200E217
Part of subcall function 1200E1A0: ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045C,?,?,?,?,?,000021D1), ref: 1200E237

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1201D254
EVP_CIPHER_CTX_flags.LIBEAY32(?), ref: 1201D2CC
X509_get_issuer_name.LIBEAY32(?), ref: 1201D2E9
ERR_put_error.LIBEAY32(00000014,000000F5,0000008D,.\ssl\d1_pkt.c,000006AE), ref: 1201D34F
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201D51C

Strings

.\ssl\d1_pkt.c, xrefs: 1201D1FD, 1201D33E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$ErrorLastO_ctrlO_writeOpenX509_X509_get_issuer_nameX_flagsY_get_object
String ID: .\ssl\d1_pkt.c
API String ID: 690001995-285292661
Opcode ID: ea496a80306f68b980ae282f955088ccb18070f16cd986c0ade6348bce6640f5
Instruction ID: 84438263b98f14333021941d41911a4620111c98fd0b4fe5b76b5328fd19b331
Opcode Fuzzy Hash: ea496a80306f68b980ae282f955088ccb18070f16cd986c0ade6348bce6640f5
Instruction Fuzzy Hash: FCB1CC726007429FD325DF29C880BE6B7E0BF89318F04866DE9998B382D774F545DBA1

Function 1201EDC0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

pqueue_find.LIBEAY32(?,?), ref: 1201EE4F
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000300,((long)msg_hdr->msg_len) > 0), ref: 1201EF94
CRYPTO_free.LIBEAY32(?), ref: 1201EFCE
pitem_new.LIBEAY32(?,?), ref: 1201EFEE

Strings

((long)msg_hdr->msg_len) > 0, xrefs: 1201EF85
item != NULL, xrefs: 1201F091
.\ssl\d1_both.c, xrefs: 1201EF8F, 1201F09B

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeOpenpitem_newpqueue_find
String ID: ((long)msg_hdr->msg_len) > 0$.\ssl\d1_both.c$item != NULL
API String ID: 4078150540-2643215950
Opcode ID: 49773c8a33f04808ea65d5fc3f59526d197f8a6952398e2f93758beacc11f79b
Instruction ID: aad44b8a7d43a0e4486f2753bfa97eed7485d33b5fdbee16e75b8e12504bc09c
Opcode Fuzzy Hash: 49773c8a33f04808ea65d5fc3f59526d197f8a6952398e2f93758beacc11f79b
Instruction Fuzzy Hash: 5091BF726047869BC715CF28C884BAAB7E1BB84318F09876DE8558F782D731E905DB92

Function 120129D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 120131A0: BIO_read.LIBEAY32(?,?,?,00000000,?,?,12011E44,?,ECAE3310), ref: 120131C8
Part of subcall function 120131A0: BIO_read.LIBEAY32(?,?,?), ref: 12013207

SSLv3_client_method.SSLEAY32 ref: 12012A8E
TLSv1_client_method.SSLEAY32 ref: 12012AAC
TLSv1_1_client_method.SSLEAY32 ref: 12012ACA
TLSv1_2_client_method.SSLEAY32 ref: 12012AF0
OpenSSLDie.LIBEAY32(.\ssl\s23_clnt.c,000002E9,s->version <= TLS_MAX_VERSION), ref: 12012B19
SSL_connect.SSLEAY32 ref: 12012C41
ERR_put_error.LIBEAY32(00000014,00000077,000000FC,.\ssl\s23_clnt.c,0000031D), ref: 12012C7F

Strings

.\ssl\s23_clnt.c, xrefs: 12012A2D, 12012B14, 12012BAD, 12012C60, 12012C71
s->version <= TLS_MAX_VERSION, xrefs: 12012B0A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_read$L_connectLv3_client_methodOpenR_put_errorSv1_1_client_methodSv1_2_client_methodSv1_client_method
String ID: .\ssl\s23_clnt.c$s->version <= TLS_MAX_VERSION
API String ID: 2596002077-3156374052
Opcode ID: c70a500a947bbfd904d5ba13f8d52b379382a75d6fa6f548537551c3ed8c4133
Instruction ID: 7dcf0d1b060982727af5ea16bb8dff3cc667dbf065b6d2ab3be098d75830e3f3
Opcode Fuzzy Hash: c70a500a947bbfd904d5ba13f8d52b379382a75d6fa6f548537551c3ed8c4133
Instruction Fuzzy Hash: 8271E1B6A40792AFF322CB21CC49B97B7E5AF44314F408719EAD94B681D374E484E792

Function 12006820 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000926), ref: 12006943
SSL_SESSION_free.SSLEAY32(?), ref: 1200696E

Part of subcall function 12026C00: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000E,.\ssl\ssl_sess.c,00000358,?,12026E1B,?,?,?,12021577,?,00000000,?), ref: 12026C22
Part of subcall function 12026C00: CRYPTO_free_ex_data.LIBEAY32(00000003,?,?), ref: 12026C3C
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000008,00000003,?,?), ref: 12026C47
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000008,00000003,?,?), ref: 12026C52
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,00000020,?,00000030,?,00000008,00000003,?,?), ref: 12026C5D
Part of subcall function 12026C00: X509_free.LIBEAY32(?), ref: 12026C83
Part of subcall function 12026C00: sk_free.LIBEAY32(?), ref: 12026C96
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CA9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CBC
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CD9
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026CF6
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D09
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D1C
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?), ref: 12026D2F
Part of subcall function 12026C00: OPENSSL_cleanse.LIBEAY32(?,000000F4), ref: 12026D3D
Part of subcall function 12026C00: CRYPTO_free.LIBEAY32(?,?,000000F4), ref: 12026D43

CRYPTO_free.LIBEAY32(?), ref: 12006991
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_clnt.c,00000932), ref: 120069B4
ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000934), ref: 120069EB
EVP_sha256.LIBEAY32(00000000), ref: 12006A2E
EVP_Digest.LIBEAY32(?,?,?,?,00000000,00000000), ref: 12006A3E

Strings

.\ssl\s3_clnt.c, xrefs: 12006869, 120068BE, 12006932, 120069AE, 120069DD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$R_put_error$DigestN_freeO_add_lockO_free_ex_dataO_mallocP_sha256X509_freesk_free
String ID: .\ssl\s3_clnt.c
API String ID: 2478572562-2155475665
Opcode ID: 0b48cb0902b57ebcadc32f0ec10c96166884feb4fc305ef19761063268d7471b
Instruction ID: a042136dc73a9953c308abf73998215e7f020c40f093205d207261b3a383c1e1
Opcode Fuzzy Hash: 0b48cb0902b57ebcadc32f0ec10c96166884feb4fc305ef19761063268d7471b
Instruction Fuzzy Hash: F3510372A40301BFF209CB64CC81FA6B7A9BF84355F244329F65A6B6C2D771B410DAA4

Function 120305A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\t1_reneg.c,000000F0,!expected_len || s->s3->previous_client_finished_len), ref: 120305D6
OpenSSLDie.LIBEAY32(.\ssl\t1_reneg.c,000000F1,!expected_len || s->s3->previous_server_finished_len), ref: 120305F9
ERR_put_error.LIBEAY32(00000014,0000012D,00000150,.\ssl\t1_reneg.c,000000F6,?,120061B1,12015BC9,?,?,00000000,?), ref: 12030620
ERR_put_error.LIBEAY32(00000014,0000012D,00000150,.\ssl\t1_reneg.c,00000100,?,?,120061B1,12015BC9,?,?,00000000,?), ref: 1203065D
ERR_put_error.LIBEAY32(00000014,0000012D,00000151,.\ssl\t1_reneg.c,00000110,?,?,120061B1,12015BC9,?,?,00000000,?), ref: 120306E5
ERR_put_error.LIBEAY32(00000014,0000012D,00000151,.\ssl\t1_reneg.c,00000119,?,?,120061B1,12015BC9,?,?,00000000,?), ref: 1203076E

Strings

.\ssl\t1_reneg.c, xrefs: 120305D1, 120305F4, 1203060F, 1203064C, 120306D4, 1203075D
!expected_len || s->s3->previous_client_finished_len, xrefs: 120305C7
!expected_len || s->s3->previous_server_finished_len, xrefs: 120305EA

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$Open
String ID: !expected_len || s->s3->previous_client_finished_len$!expected_len || s->s3->previous_server_finished_len$.\ssl\t1_reneg.c
API String ID: 3578803784-3367045297
Opcode ID: fce692128008190802c00a19b1b537be9e302ebe1fa090f118e41e0add6c52ef
Instruction ID: 327c81b4f63e18479617287d97d132f5a3f6c99273327e828e3b792d5cc11b36
Opcode Fuzzy Hash: fce692128008190802c00a19b1b537be9e302ebe1fa090f118e41e0add6c52ef
Instruction Fuzzy Hash: 445147736851D65FE703CB14CC45BF93BE39B8130AF1946F9E2896F582C5A2E481E790

Function 11001020 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 1100104F
GetModuleHandleA.KERNEL32(00000000), ref: 11001078
GetProcAddress.KERNEL32(00000000,OPENSSL_Applink), ref: 110010ED

Strings

OPENSSL_Uplink(%p,%02X): , xrefs: 11001038
no OPENSSL_Applink, xrefs: 110010F7
no host application, xrefs: 11001082
unimplemented function, xrefs: 11001064
no ApplinkTable, xrefs: 11001149
OPENSSL_Applink, xrefs: 110010E7

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: AddressHandleModuleProc__snprintf
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $no ApplinkTable$no OPENSSL_Applink$no host application$unimplemented function
API String ID: 2798097423-2621752675
Opcode ID: 90884d78454768b49683d0b292f09239f5f7b60cb3d6435a7e671c50837099b8
Instruction ID: cd82098e185b945ab69a52342bdfcc466bd79ade5b327ed4df77ce24384e6324
Opcode Fuzzy Hash: 90884d78454768b49683d0b292f09239f5f7b60cb3d6435a7e671c50837099b8
Instruction Fuzzy Hash: BA516F75A0A761CFE304CF1AE4C0966BBF4FB88B68B1086AEF8548B755D732D401CB90

Function 12016CF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000013B,0000016E,.\ssl\t1_lib.c,00000FEA), ref: 12016D2E
SSL_state.SSLEAY32(?), ref: 12016D3D
CRYPTO_malloc.LIBEAY32(00000025,.\ssl\t1_lib.c,00001004), ref: 12016D67

Strings

.\ssl\t1_lib.c, xrefs: 12016D1D, 12016D60, 12016DB6, 12016E43, 12016E57

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_stateO_mallocR_put_error
String ID: .\ssl\t1_lib.c
API String ID: 3356582901-2047370388
Opcode ID: bf8c96ccb2866307c44eacfba98d0a4d60f29c4f1c356786a1284f901d0c6b50
Instruction ID: df510a3c44487480de65e5f038eed5f2720e5e0980c648cf6dd68d134f78e8f5
Opcode Fuzzy Hash: bf8c96ccb2866307c44eacfba98d0a4d60f29c4f1c356786a1284f901d0c6b50
Instruction Fuzzy Hash: C9314F73BC43467EF211C6149C42FE6B3989B11719F044335FE596E2C2EBE2E550B2A2

Function 12022EC0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

X509_get_pubkey.LIBEAY32(?,?,?,?,12007F3C,?,?), ref: 12022EFF
EVP_PKEY_bits.LIBEAY32(00000000), ref: 12022F12
EVP_PKEY_free.LIBEAY32(00000000,00000000), ref: 12022F1A
X509_check_purpose.LIBEAY32(?,000000FF,00000000,?,?,?,12007F3C,?,?), ref: 12022F37
OBJ_obj2nid.LIBEAY32(?), ref: 12022F4E
OBJ_find_sigid_algs.LIBEAY32(00000000,?,?,?), ref: 12022F5E
ERR_put_error.LIBEAY32(00000014,00000117,0000013E,.\ssl\ssl_lib.c,000009D8), ref: 12022F98

Strings

.\ssl\ssl_lib.c, xrefs: 12022F87, 12022FD7, 12023010, 12023037
@, xrefs: 1202301F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: J_find_sigid_algsJ_obj2nidR_put_errorX509_check_purposeX509_get_pubkeyY_bitsY_free
String ID: .\ssl\ssl_lib.c$@
API String ID: 2685449172-2763832001
Opcode ID: 451c57d69493fd63d0e273c6cd36163256c8bebdd2c11fcfb80defc8400a1fc5
Instruction ID: 8f2d019a57a917b20dde996f6334d112dcc87765ed8f6f16f32ce955e99ca31d
Opcode Fuzzy Hash: 451c57d69493fd63d0e273c6cd36163256c8bebdd2c11fcfb80defc8400a1fc5
Instruction Fuzzy Hash: 20412937A043411FF352C764CC95BAAB3D4AF84724F44433AFD95576D2D378E544A262

Function 12020C60 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000137,00000161,.\ssl\d1_srtp.c,00000195,12015C26,?,?,00000000,?), ref: 12020C7D
ERR_put_error.LIBEAY32(00000014,00000137,00000160,.\ssl\d1_srtp.c,0000019D,00000000,12015C26,?,?,00000000,?), ref: 12020CDD
SSL_get_srtp_profiles.SSLEAY32(00000005,?,120061B1,00000000,12015C26,?,?,00000000,?), ref: 12020CFD
ERR_put_error.LIBEAY32(00000014,00000137,00000167,.\ssl\d1_srtp.c,000001A7), ref: 12020D21

Strings

.\ssl\d1_srtp.c, xrefs: 12020C6C, 12020CCC, 12020D10, 12020D72

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$L_get_srtp_profiles
String ID: .\ssl\d1_srtp.c
API String ID: 51597451-3998674507
Opcode ID: a5fc61262e85b1249861bb39563cb3be88f9e2b9822c6b4d56e3554558e3fdfb
Instruction ID: e5244a57f902dc0a0ae829c7f24770013202f895946c1a523d9959e45967fdc7
Opcode Fuzzy Hash: a5fc61262e85b1249861bb39563cb3be88f9e2b9822c6b4d56e3554558e3fdfb
Instruction Fuzzy Hash: 8F3136B7784340BBEB13CB148C82FE6B7E2DB84751F494276F64A1E1C1C6B6A100E722

Function 1109D050 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(0000000B,00000068,00000043,.\crypto\x509\x509_v3.c,00000098,00000000,?,?,00000000,1109D389,000000E7,?,000000FF,1109A711,00000000,00000000), ref: 1109D06E

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

sk_new_null.LIBEAY32(00000000,?,?,00000000,1109D389,000000E7,?,000000FF,1109A711,00000000,00000000,000000FF,?,00000000), ref: 1109D084
sk_num.LIBEAY32(?,00000000,?,?,00000000,1109D389,000000E7,?,000000FF,1109A711,00000000,00000000,000000FF,?,00000000), ref: 1109D090
X509_EXTENSION_dup.LIBEAY32(?,00000000), ref: 1109D0AB
sk_insert.LIBEAY32(?,00000000,00000000,?,00000000), ref: 1109D0BC
ERR_put_error.LIBEAY32(0000000B,00000068,00000041,.\crypto\x509\x509_v3.c,000000B0,?,?,?,?,00000000), ref: 1109D0D8
X509_EXTENSION_free.LIBEAY32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 1109D0E5
sk_free.LIBEAY32(?,?,00000000), ref: 1109D0F2

Strings

.\crypto\x509\x509_v3.c, xrefs: 1109D063, 1109D0CD

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_errorX509_$N_dupN_freeO_freeR_get_statesk_freesk_insertsk_new_nullsk_num
String ID: .\crypto\x509\x509_v3.c
API String ID: 2974652376-625490086
Opcode ID: cb20e8310db3486cdb30c05d534227b69770cfb41491e0e812e287d5d9a11d8b
Instruction ID: 6b7ebc100d765cb6189f3251962589d35b19fd1d49a795796703300e145504d0
Opcode Fuzzy Hash: cb20e8310db3486cdb30c05d534227b69770cfb41491e0e812e287d5d9a11d8b
Instruction Fuzzy Hash: 2D110BE7F8075E27E311E9A46C51B5F73889F906A9F014071FE0CAB142EB61E91693E2

Function 1202B8C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000B1,00000043,.\ssl\ssl_rsa.c,0000020A), ref: 1202B8DC
ERR_put_error.LIBEAY32(00000014,000000B1,00000041,.\ssl\ssl_rsa.c,0000020E), ref: 1202B913

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B8CE, 1202B905, 1202B931

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: e408936d6803735bfaa1f27e984b277a746c97737fb0686aae7d55795974fa26
Instruction ID: d2228c848742469c56cbb10ed0ef1f707159132aecf512f837bee53d5aac6eff
Opcode Fuzzy Hash: e408936d6803735bfaa1f27e984b277a746c97737fb0686aae7d55795974fa26
Instruction Fuzzy Hash: 601106BBB813003BF652E3785C82FDB62984F44722F994132FA06E9181FA91B5613066

Function 1202C560 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000CC,00000043,.\ssl\ssl_rsa.c,00000096), ref: 1202C57C
ERR_put_error.LIBEAY32(00000014,000000CC,00000041,.\ssl\ssl_rsa.c,0000009A), ref: 1202C5B3

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C56E, 1202C5A5, 1202C5D1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 1d2baa943107e0c9a23a9c5e43ed0f05d99abd007333796b053ab92990c693f5
Instruction ID: d9574756f00872b13736f98094623e1eaead712c79796502bfce10c2d04f508d
Opcode Fuzzy Hash: 1d2baa943107e0c9a23a9c5e43ed0f05d99abd007333796b053ab92990c693f5
Instruction Fuzzy Hash: EF110AB7B813013BF252E3B89C42F9B53484F54762F594232FA0AEA181F691E66030A5

Function 12021240 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_nid.LIBEAY32(?), ref: 12021256
BIO_ctrl.LIBEAY32(?,00000069,00000000,00000000), ref: 1202126D
SSL_set_bio.SSLEAY32(?,?,?), ref: 1202127F

Part of subcall function 12021110: BIO_free_all.LIBEAY32(?), ref: 12021141
Part of subcall function 12021110: BIO_free_all.LIBEAY32(?), ref: 1202115F

BIO_s_socket.LIBEAY32 ref: 1202128F
BIO_new.LIBEAY32(00000000), ref: 12021295
ERR_put_error.LIBEAY32(00000014,000000C4,00000007,.\ssl\ssl_lib.c,000002F8), ref: 120212B6
BIO_int_ctrl.LIBEAY32(00000000,00000068,00000000,?), ref: 120212CB
SSL_set_bio.SSLEAY32(?,00000000,00000000,00000000,00000068,00000000,?), ref: 120212D6

Strings

.\ssl\ssl_lib.c, xrefs: 120212A8

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_set_bioO_free_all$O_ctrlO_int_ctrlO_newO_s_socketR_put_errorX_nid
String ID: .\ssl\ssl_lib.c
API String ID: 508409369-3333140318
Opcode ID: 815bafcfd9aaa1bd1e507ded6d4dd72dedbecdf7e6f55a8d87da00989e7ad549
Instruction ID: c669c5486656aa1350214713175505f1b94b6f386eea3d9453424bd76d340e7a
Opcode Fuzzy Hash: 815bafcfd9aaa1bd1e507ded6d4dd72dedbecdf7e6f55a8d87da00989e7ad549
Instruction Fuzzy Hash: 1A1125AFB402003FE692E6589C41FBBF3ADCB89722F054626F604D6181EA22F41462B1

Function 120212F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_nid.LIBEAY32(?), ref: 12021306
BIO_ctrl.LIBEAY32(?,00000069,00000000,00000000), ref: 1202131D
SSL_set_bio.SSLEAY32(?,?,?), ref: 1202132F

Part of subcall function 12021110: BIO_free_all.LIBEAY32(?), ref: 12021141
Part of subcall function 12021110: BIO_free_all.LIBEAY32(?), ref: 1202115F

BIO_s_socket.LIBEAY32 ref: 1202133F
BIO_new.LIBEAY32(00000000), ref: 12021345
ERR_put_error.LIBEAY32(00000014,000000C2,00000007,.\ssl\ssl_lib.c,0000030E), ref: 12021366
BIO_int_ctrl.LIBEAY32(00000000,00000068,00000000,?), ref: 1202137B
SSL_set_bio.SSLEAY32(?,00000000,00000068,00000000,00000068,00000000,?), ref: 12021386

Strings

.\ssl\ssl_lib.c, xrefs: 12021358

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_set_bioO_free_all$O_ctrlO_int_ctrlO_newO_s_socketR_put_errorX_nid
String ID: .\ssl\ssl_lib.c
API String ID: 508409369-3333140318
Opcode ID: a533aa8d5929b3eddde27bd51e0699053c187446d633971461b1e4bb955e5b05
Instruction ID: c7ee5f4478bcddcd2ed6f347c63fa368db3ee05716bc39800173a6769dff9ab8
Opcode Fuzzy Hash: a533aa8d5929b3eddde27bd51e0699053c187446d633971461b1e4bb955e5b05
Instruction Fuzzy Hash: FF114CABB403043BE562D669DC81FBBF3AEDB85312F440B26F604D7541EA12F5046272

Function 120235B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

BIO_f_buffer.LIBEAY32(00000000,?,120054E2,?,00000001), ref: 120235BD
BIO_new.LIBEAY32(00000000,00000000,?,120054E2,?,00000001), ref: 120235C3
BIO_pop.LIBEAY32(?,00000000,?,120054E2,?,00000001), ref: 120235DE
BIO_ctrl.LIBEAY32(?,00000001,00000000,00000000,00000000,?,120054E2,?,00000001), ref: 120235F0
BIO_int_ctrl.LIBEAY32(?,00000075,00000001,00000000,?,00000001,00000000,00000000,00000000,?,120054E2,?,00000001), ref: 120235FC
ERR_put_error.LIBEAY32(00000014,000000B8,00000007,.\ssl\ssl_lib.c,00000C1E), ref: 1202361B
BIO_push.LIBEAY32(?,?,?,?,?,?,?,?,00000001), ref: 12023638
BIO_pop.LIBEAY32(?,?,?,?,?,?,?,00000001), ref: 12023651

Strings

.\ssl\ssl_lib.c, xrefs: 1202360D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_pop$O_ctrlO_f_bufferO_int_ctrlO_newO_pushR_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 156715244-3333140318
Opcode ID: 08aad3fc512cc9d76a75e1aa8ed8c16affa69238eb209fee6ed4685e0c53c9ca
Instruction ID: 347b8f6b236e2a502273b0a65d2730049925a42c684c97010041f768af54a33c
Opcode Fuzzy Hash: 08aad3fc512cc9d76a75e1aa8ed8c16affa69238eb209fee6ed4685e0c53c9ca
Instruction Fuzzy Hash: D911C877F44B117FE763DB246C05BDAE3B8AF04B11F450722F904AA280E3A4F99192D5

Function 1202F9E0 Relevance: 15.1, APIs: 10, Instructions: 129COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBEAY32(?,0000000F), ref: 1202FA11
SSL_write.SSLEAY32(?,?,?,?,0000000F), ref: 1202FA1D
SSL_get_error.SSLEAY32(?,00000000,?,?,?,?,0000000F), ref: 1202FA26

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_errorL_writeO_clear_flags
String ID:
API String ID: 89475808-0
Opcode ID: 9d9be3b3f39da7fc45cf1979076b337a8c5109249fd62c1977c09c6384be9dc7
Instruction ID: 7d852f3e849830c53acf6ab1ffefccfbd5bb48ba117f82f631b7328384fb38ad
Opcode Fuzzy Hash: 9d9be3b3f39da7fc45cf1979076b337a8c5109249fd62c1977c09c6384be9dc7
Instruction Fuzzy Hash: 9F41D6B6A043059FD710DF19EC81A9BB3E8EF84755F80863FEC4586201D279F5199BA2

Function 1201EC40 Relevance: 15.1, APIs: 10, Instructions: 119COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 1201EC6A
pqueue_pop.LIBEAY32(?), ref: 1201EC92
EVP_CIPHER_CTX_free.LIBEAY32(?), ref: 1201ECA4
EVP_MD_CTX_destroy.LIBEAY32(?,?), ref: 1201ECAD
CRYPTO_free.LIBEAY32(?), ref: 1201ECBD
CRYPTO_free.LIBEAY32(?), ref: 1201ECCD
CRYPTO_free.LIBEAY32(?), ref: 1201ECD6
pqueue_free.LIBEAY32(00000000,?), ref: 1201ECDC
pqueue_pop.LIBEAY32(?), ref: 1201ED11
pqueue_free.LIBEAY32(00000000,?), ref: 1201ED4E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$pqueue_freepqueue_pop$X_destroyX_freepqueue_peek
String ID:
API String ID: 3944116535-0
Opcode ID: b27718a26a71ea36aaf55eba839920876c1a4fe492e15af86df3e8c7aa71c9a6
Instruction ID: 663f2e83ba3056261489a46d1d6d1754720a24bbb05a6b66e03feccff64d7ab0
Opcode Fuzzy Hash: b27718a26a71ea36aaf55eba839920876c1a4fe492e15af86df3e8c7aa71c9a6
Instruction Fuzzy Hash: C641B3776002009FC751DF64DC84BABB3F9EF88315F044A69E8064B641DB35F845D761

Function 120301F0 Relevance: 15.1, APIs: 10, Instructions: 57COMMON

Download Yara Rule

APIs

BIO_s_connect.LIBEAY32 ref: 120301F1
BIO_new.LIBEAY32(00000000), ref: 120301F7
BIO_new.LIBEAY32(1204EB80), ref: 1203020E
SSL_new.SSLEAY32(?), ref: 12030221
BIO_free.LIBEAY32(00000000), ref: 12030230
BIO_free.LIBEAY32(00000000), ref: 12030239

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_new$L_newO_s_connect
String ID:
API String ID: 374462871-0
Opcode ID: bb880446f442151dd2ef21e13f7f4927a1267a24955821f2b61d50c345a89ce4
Instruction ID: 2107e9f1a5413989cd52d9c9a4903af246747f0866b9db053f08cd825d1e722f
Opcode Fuzzy Hash: bb880446f442151dd2ef21e13f7f4927a1267a24955821f2b61d50c345a89ce4
Instruction Fuzzy Hash: 37F0F4EFE012012BE253E2F52C84FFF41AD9F85663F090631F805A2201FA5AE11572B3

Function 1200E980 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

.\ssl\s3_pkt.c, xrefs: 1200EADE, 1200EBF5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ErrorLastO_writeR_put_error
String ID: .\ssl\s3_pkt.c
API String ID: 3573331069-4041216366
Opcode ID: 1d795115d65213b321d95fb2a2a14567107a83f937f8e9693b85e85c48f20193
Instruction ID: 00bc1bb75a3842eb819e91164e7a00e362a16518d1fccbc5b997f4f8b30bf353
Opcode Fuzzy Hash: 1d795115d65213b321d95fb2a2a14567107a83f937f8e9693b85e85c48f20193
Instruction Fuzzy Hash: C2B101366043419BF302CF25C880BEAB3E0FF88364F044729E9999B281D775E945DB96

Function 1200F650 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

Part of subcall function 1200E1A0: SetLastError.KERNEL32(00000000,80000000,?,?,1200FE5E,?,?,?,?,?,?,?,?,?,000021D1), ref: 1200E1F2
Part of subcall function 1200E1A0: BIO_write.LIBEAY32(?,?,?), ref: 1200E217
Part of subcall function 1200E1A0: ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045C,?,?,?,?,?,000021D1), ref: 1200E237

BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200F968

Strings

.\ssl\s3_pkt.c, xrefs: 1200F827

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ErrorLastO_ctrlO_writeR_put_error
String ID: .\ssl\s3_pkt.c
API String ID: 808648714-4041216366
Opcode ID: f2be194a38012f4b297bd90af9085e0e65cd67e7cbe6a1b1ff4a610842d87b22
Instruction ID: d388ff70b160f4dbfc634281fb2c58a4f9b376b3feef646f5803c5fc351302d5
Opcode Fuzzy Hash: f2be194a38012f4b297bd90af9085e0e65cd67e7cbe6a1b1ff4a610842d87b22
Instruction Fuzzy Hash: ACB1DF766007429BF311CF25C888BA6B7E0FF84344F14862DE9898B381DBB5F545EB96

Function 1200ADF0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000,?,?), ref: 1200AE54

Strings

MZP, xrefs: 1200AE09
@, xrefs: 1200AF59

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num
String ID: @$MZP
API String ID: 1660612888-3808193924
Opcode ID: fe55c29db3e7e2c4c956810a57cefb308656560184090574c29fe16f2f256047
Instruction ID: 37def50f2793035b113f4dad058b0cb9985f5aedf9ca9bc23d3cc81e42edb7dd
Opcode Fuzzy Hash: fe55c29db3e7e2c4c956810a57cefb308656560184090574c29fe16f2f256047
Instruction Fuzzy Hash: 6051BFB35043419BE702CE54C8407ABB7E4AF88399F144B2DEE8957240D778E985EBA6

Function 1106F060 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\crypto\evp\encode.c,00000149,n < (int)sizeof(ctx->enc_data)), ref: 1106F153
EVP_DecodeBlock.LIBEAY32(?,?), ref: 1106F16B
EVP_DecodeBlock.LIBEAY32(?,?), ref: 1106F1AE

Strings

n < (int)sizeof(ctx->enc_data), xrefs: 1106F144
@, xrefs: 1106F136
.\crypto\evp\encode.c, xrefs: 1106F14E
@, xrefs: 1106F163
P, xrefs: 1106F13F

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: BlockDecode$Open
String ID: .\crypto\evp\encode.c$@$@$P$n < (int)sizeof(ctx->enc_data)
API String ID: 2044925936-3582595196
Opcode ID: 4f1ecafe78d39380b0eff9cea8ad8ed475f34444bea4d2789bf8752849c57b71
Instruction ID: 238d596afef21fc51be9a37ae60309fa4be9a5481fc006ffb5399da372aedb19
Opcode Fuzzy Hash: 4f1ecafe78d39380b0eff9cea8ad8ed475f34444bea4d2789bf8752849c57b71
Instruction Fuzzy Hash: F341D531D08393DBE311DE28C8A065ABBD8EFC6398F90096EFC858A251D775D946C693

Function 12020A10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000136,00000161,.\ssl\d1_srtp.c,00000125,?,12018241,?,?,?,?), ref: 12020A3A
ERR_put_error.LIBEAY32(00000014,00000136,00000161,.\ssl\d1_srtp.c,00000131,?,00000000,?,12018241,?,?,?,?), ref: 12020A99

Strings

.\ssl\d1_srtp.c, xrefs: 12020A29, 12020A88, 12020AC3, 12020B84

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\d1_srtp.c
API String ID: 1767461275-3998674507
Opcode ID: 25a8db44fa97aad76d2f5a130b79a90de77aaecb1e6be0d3f16e48cca43078bc
Instruction ID: 45bea45e3153d92e7f9657f0a3f73d50c83ecd35df7e6e161a430711f3f2a64e
Opcode Fuzzy Hash: 25a8db44fa97aad76d2f5a130b79a90de77aaecb1e6be0d3f16e48cca43078bc
Instruction Fuzzy Hash: D4418773B403406BDB12CB18DC80BDBF7E2ABD0705F89427AF9881B281D2B29545E7A1

Function 12023DA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A4,000000BC,.\ssl\ssl_lib.c,000000C2), ref: 12023DC3
SSL_SESSION_free.SSLEAY32(?), ref: 12023DE4
ERR_put_error.LIBEAY32(00000014,000000A4,00000044,.\ssl\ssl_lib.c,000000DC), ref: 12023E19

Strings

.\ssl\ssl_lib.c, xrefs: 12023DB2, 12023E0B

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$N_free
String ID: .\ssl\ssl_lib.c
API String ID: 483722116-3333140318
Opcode ID: 009df2bc2c4bd7d0b2ea2099844f1e52a789aa576f8c12c571dc3f2cb1346543
Instruction ID: 3806a7b3b7b95cb693b19aed88dea3b465dc3a68c6550d7d1f2377bea5b3c1a0
Opcode Fuzzy Hash: 009df2bc2c4bd7d0b2ea2099844f1e52a789aa576f8c12c571dc3f2cb1346543
Instruction Fuzzy Hash: 354168B6A00B408FD762CF29E841BD7F3E4BF84304F544A2EE59A87651E770B481DB81

Function 1201DC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 1201DC8A
pqueue_peek.LIBEAY32(?), ref: 1201DCCE
pqueue_pop.LIBEAY32(?), ref: 1201DCEF
pqueue_peek.LIBEAY32(?), ref: 1201DD7D

Part of subcall function 1201CE20: CRYPTO_free.LIBEAY32(?), ref: 1201CE3B

CRYPTO_free.LIBEAY32(?,00000000), ref: 1201DD09
pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201DD0F
ERR_put_error.LIBEAY32(00000014,000001A8,00000044,.\ssl\d1_pkt.c,0000017E), ref: 1201DDCF

Strings

.\ssl\d1_pkt.c, xrefs: 1201DDC1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: pqueue_peek$O_free$R_put_errorpqueue_freepqueue_pop
String ID: .\ssl\d1_pkt.c
API String ID: 824512334-285292661
Opcode ID: 0541b851bc81702caa955406f0d768195dc7c4e538f6b3922b33eae4d24840bf
Instruction ID: 0b5257e1cd5fa34fa0d3f84ed34ae02275fea6c2b59f3d21518b7202e877d0a8
Opcode Fuzzy Hash: 0541b851bc81702caa955406f0d768195dc7c4e538f6b3922b33eae4d24840bf
Instruction Fuzzy Hash: 7631E1BB2007015FD341EB28D844BEBB3E5AF45309F050679E80A8B351EB79F945E3A1

Function 1202F3E0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000014E,00000181,.\ssl\ssl_conf.c,0000020B), ref: 1202F3FD

Strings

.\ssl\ssl_conf.c, xrefs: 1202F3EC, 1202F471, 1202F4D8
, value=, xrefs: 1202F488
cmd=, xrefs: 1202F48E, 1202F4EF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: , value=$.\ssl\ssl_conf.c$cmd=
API String ID: 1767461275-2565206178
Opcode ID: 08d8a912a3bad5a42a30c325f92ab247bdcc6013cccddc10587e185ae71e68ca
Instruction ID: eb13a1f77bb0fbe80327bad72b31fcb33d92647d6c88128ef47e06d587783a73
Opcode Fuzzy Hash: 08d8a912a3bad5a42a30c325f92ab247bdcc6013cccddc10587e185ae71e68ca
Instruction Fuzzy Hash: 73219C333843453BF502C629BD45FD6A3D8FB84775F91473EFA48990C1EBE0A4816261

Function 12019B60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019BB5
pqueue_peek.LIBEAY32(00000000,?), ref: 12019BBB
ERR_put_error.LIBEAY32(00000014,0000011E,00000144,.\ssl\t1_enc.c,000003AA), ref: 12019BF5

Part of subcall function 1200D120: CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D141
Part of subcall function 1200D120: ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D171

Strings

.\ssl\t1_enc.c, xrefs: 12019BE4

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_mallocX509_Y_get_objectpqueue_peek
String ID: .\ssl\t1_enc.c
API String ID: 3575688274-3943519339
Opcode ID: 5f4571a70387c8f7ee21c7490afbb5210fbdb58654e9668e5c551f93c9ea58e4
Instruction ID: 82c1e073001cc276b8689e6e41354fa59e8a0a69c13f0605df0f9991360fc5d2
Opcode Fuzzy Hash: 5f4571a70387c8f7ee21c7490afbb5210fbdb58654e9668e5c551f93c9ea58e4
Instruction Fuzzy Hash: 3621A377604205ABD241DB64CC80FDAB3F9BF88318F844739E9459B201E631E555D7D2

Function 1108D020 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

BIO_new_NDEF.LIBEAY32(?,?,?), ref: 1108D03E

Part of subcall function 1108C5B0: CRYPTO_malloc.LIBEAY32(00000018,.\crypto\asn1\bio_ndef.c,0000006D), ref: 1108C5E0
Part of subcall function 1108C5B0: BIO_f_asn1.LIBEAY32(00000018,.\crypto\asn1\bio_ndef.c,0000006D), ref: 1108C5E7
Part of subcall function 1108C5B0: BIO_new.LIBEAY32(00000000,00000018,.\crypto\asn1\bio_ndef.c,0000006D), ref: 1108C5ED
Part of subcall function 1108C5B0: BIO_push.LIBEAY32(00000000,?,00000000,00000018,.\crypto\asn1\bio_ndef.c,0000006D), ref: 1108C5FA
Part of subcall function 1108C5B0: BIO_asn1_set_prefix.LIBEAY32(00000000,1108C3C0,1108C440), ref: 1108C627
Part of subcall function 1108C5B0: BIO_asn1_set_suffix.LIBEAY32(00000000,1108C4E0,1108C480,00000000,1108C3C0,1108C440), ref: 1108C637
Part of subcall function 1108C5B0: BIO_ctrl.LIBEAY32(00000000,00000099,00000000,00000000), ref: 1108C695

ERR_put_error.LIBEAY32(0000000D,000000D3,00000041,.\crypto\asn1\asn_mime.c,0000007D), ref: 1108D05C

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

SMIME_crlf_copy.LIBEAY32(?,00000000,?), ref: 1108D071
BIO_ctrl.LIBEAY32(00000000,0000000B,00000000,00000000,?,00000000,?), ref: 1108D07D
BIO_pop.LIBEAY32(00000000), ref: 1108D086
BIO_free.LIBEAY32(00000000,00000000), ref: 1108D08E
ASN1_item_i2d_bio.LIBEAY32(?,?,?), ref: 1108D0B4

Strings

.\crypto\asn1\asn_mime.c, xrefs: 1108D04E

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_ctrlO_free$E_crlf_copyN1_item_i2d_bioO_asn1_set_prefixO_asn1_set_suffixO_f_asn1O_mallocO_newO_new_O_popO_pushR_get_stateR_put_error
String ID: .\crypto\asn1\asn_mime.c
API String ID: 2122121044-538127707
Opcode ID: 8bb9f19f55f0959e68b02c26ec216644645f8c1e424c543e5454a48793c4f395
Instruction ID: 1179bbfd4fb0342353c8e9245a8cd2f1dda964e6659d8596ebb4c0a1e764d14e
Opcode Fuzzy Hash: 8bb9f19f55f0959e68b02c26ec216644645f8c1e424c543e5454a48793c4f395
Instruction Fuzzy Hash: A411DFFAF0431227E210DA64EC81F9F73DC9BC4758F040519F944A7381D565FD4686B2

Function 12025680 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CRYPTO_add_lock.LIBEAY32(12026D6D,000000FF,0000000F,.\ssl\ssl_cert.c,00000293,?,12026C75,?), ref: 120256A2
sk_pop_free.LIBEAY32(00000000,Function_000316CE,?,?,?,12026C75,?), ref: 120256BA
X509_free.LIBEAY32(00000000,?,?,?,?,?,12026C75,?), ref: 120256D7
RSA_free.LIBEAY32(E4868B00,?,?,?,12026C75,?), ref: 120256F4
DH_free.LIBEAY32(8B000000,?,?,?,12026C75,?), ref: 12025707
EC_KEY_free.LIBEAY32(8B178B08,?,?,?,12026C75,?), ref: 1202571A
CRYPTO_free.LIBEAY32(12026C75,?,?,?,12026C75,?), ref: 12025723

Strings

.\ssl\ssl_cert.c, xrefs: 12025692

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: A_freeH_freeO_add_lockO_freeX509_freeY_freesk_pop_free
String ID: .\ssl\ssl_cert.c
API String ID: 3784442870-3404700246
Opcode ID: 11222858e5ca04cf1f897334bd2cc060379098a5f58f7793b56e0f4b5d76f3da
Instruction ID: 148b5443abb8d8d6b34df63d6481e6953a6cce24e9dc0e599b686db5fc47450e
Opcode Fuzzy Hash: 11222858e5ca04cf1f897334bd2cc060379098a5f58f7793b56e0f4b5d76f3da
Instruction Fuzzy Hash: 2F11C6A3F4020267E546D664BC44BE7F7ECAB14651F454731EC1AD3140FA22F520A295

Function 110BD020 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

PKCS12_new.LIBEAY32(?,110BC7B4,?), ref: 110BD021

Part of subcall function 110BC0F0: ASN1_item_new.LIBEAY32(11119BF4), ref: 110BC0F5

ERR_put_error.LIBEAY32(00000023,0000006D,00000041,.\crypto\pkcs12\p12_init.c,00000046,?,110BC7B4,?), ref: 110BD039

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ASN1_INTEGER_set.LIBEAY32(00000000,00000003,?,?,110BC7B4,?), ref: 110BD04B
OBJ_nid2obj.LIBEAY32(?,00000000,00000003,?,?,110BC7B4,?), ref: 110BD055
ERR_put_error.LIBEAY32(00000023,0000006D,00000041,.\crypto\pkcs12\p12_init.c,0000004E,?,?,?,?,?), ref: 110BD09A
PKCS12_free.LIBEAY32(00000000), ref: 110BD0A3

Strings

.\crypto\pkcs12\p12_init.c, xrefs: 110BD02E, 110BD06B, 110BD08F

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$J_nid2objN1_item_newO_freeR_get_stateR_setS12_freeS12_new
String ID: .\crypto\pkcs12\p12_init.c
API String ID: 2194782611-3576239267
Opcode ID: 22e5465e42112e083d41cbbcc32cfb07343a7bc89d90e2826e57695583d71292
Instruction ID: df80ccb5cd8e0747dd4b15d9bbc08009d99ef594463a1c13d625cc5772158d8e
Opcode Fuzzy Hash: 22e5465e42112e083d41cbbcc32cfb07343a7bc89d90e2826e57695583d71292
Instruction Fuzzy Hash: 6E01F9B5F443122AE230DA68FC41F4F76955B40B5CF010065F7496F1C1E964F58286DB

Function 120250D0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000180,.\ssl\ssl_cert.c,000000CC,00000000,120243A4), ref: 120250E0
ERR_put_error.LIBEAY32(00000014,000000A2,00000041,.\ssl\ssl_cert.c,000000CE), ref: 12025101
_memset.LIBCMT ref: 12025115
EVP_sha1.LIBEAY32 ref: 1202512C
EVP_sha1.LIBEAY32 ref: 12025134
EVP_sha1.LIBEAY32 ref: 1202513C
EVP_sha1.LIBEAY32 ref: 12025144

Strings

.\ssl\ssl_cert.c, xrefs: 120250D6, 120250F3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1$O_mallocR_put_error_memset
String ID: .\ssl\ssl_cert.c
API String ID: 1522593825-3404700246
Opcode ID: cf458f8c3e70d72049d8cde9462a16773ef1ff76baff834bcc57d959827e5cb7
Instruction ID: c5015a8590056f8c014d4e974ae38019f7de62ed4536812e3d6b2931c2262101
Opcode Fuzzy Hash: cf458f8c3e70d72049d8cde9462a16773ef1ff76baff834bcc57d959827e5cb7
Instruction Fuzzy Hash: 14F0FC76A407506EEBA2DB74AC01BD6B6F05F04B01F054A35E5875A5C0D6B0A040D7D0

Function 11041020 Relevance: 13.8, APIs: 9, Instructions: 285COMMON

Download Yara Rule

APIs

BN_ucmp.LIBEAY32(?,110EE858), ref: 11041046
BN_ucmp.LIBEAY32(110EE7F4,?), ref: 1104105C
BN_set_word.LIBEAY32(?,00000000), ref: 1104106E

Part of subcall function 110368E0: CRYPTO_free.LIBEAY32(00000000), ref: 11036904

BN_copy.LIBEAY32(?,?), ref: 1104108E
BN_nnmod.LIBEAY32(?,?,110EE7F4,?), ref: 110412F5

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N_ucmp$N_copyN_nnmodN_set_wordO_free
String ID:
API String ID: 562641209-0
Opcode ID: b6c808062d9d40508c31fe778522c55c3fad6043fb52f726104f35b2d098a1d0
Instruction ID: 8f73097f5f29802c7f891e62659c2020fff944f03ed7a5fb5400cbae24cf18fe
Opcode Fuzzy Hash: b6c808062d9d40508c31fe778522c55c3fad6043fb52f726104f35b2d098a1d0
Instruction Fuzzy Hash: 3E91A175B107018FC718CF2DDD90A6AB7E1EFC8214F588A3DE98AC7741E635F9098A91

Function 1107B160 Relevance: 13.7, APIs: 9, Instructions: 174COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_dup.LIBEAY32(?), ref: 1107B1B4
EVP_PKEY_CTX_free.LIBEAY32(00000000), ref: 1107B1D4
EVP_MD_CTX_init.LIBEAY32(?), ref: 1107B20C
EVP_MD_CTX_copy_ex.LIBEAY32(?,?,?), ref: 1107B217
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1107B260
EVP_PKEY_sign.LIBEAY32(?,?,?,?,?), ref: 1107B283

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: X_cleanupX_copy_exX_dupX_freeX_initY_sign
String ID:
API String ID: 3176397910-0
Opcode ID: e5a56bb07b4d85116a76ee69f27fe0577369d255adeb45242fd2f046d6771dd7
Instruction ID: b5b308b662c93a9626f941a00fcca6af9e4a2a9e23c17cb8df2378411fff6f3e
Opcode Fuzzy Hash: e5a56bb07b4d85116a76ee69f27fe0577369d255adeb45242fd2f046d6771dd7
Instruction Fuzzy Hash: F94117BAE017025BD214DB65DC40E6FB3DDFFE4218F84056DFA8183240EB26E90587E6

Function 1200A830 Relevance: 13.6, APIs: 9, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 1200CE50: OPENSSL_cleanse.LIBEAY32(00000000,?), ref: 1200CE6F
Part of subcall function 1200CE50: CRYPTO_free.LIBEAY32(00000000,00000000,?), ref: 1200CE7E

CRYPTO_free.LIBEAY32(?), ref: 1200A888
DH_free.LIBEAY32(?), ref: 1200A89E
EC_KEY_free.LIBEAY32(?), ref: 1200A8B4
sk_pop_free.LIBEAY32(?,Function_00031824), ref: 1200A8CF
BIO_free.LIBEAY32(?), ref: 1200A8E5
CRYPTO_free.LIBEAY32(?), ref: 1200A910
SSL_SRP_CTX_free.SSLEAY32(?), ref: 1200A919
OPENSSL_cleanse.LIBEAY32(?,0000042C,?), ref: 1200A927
CRYPTO_free.LIBEAY32(?,?,0000042C,?), ref: 1200A930

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$L_cleanse$H_freeX_freeY_freesk_pop_free
String ID:
API String ID: 981315686-0
Opcode ID: f63e966be329df1a28a13a6714f15b438be353cf54c241ce4af270537ae7b40c
Instruction ID: 20e94addba04ac7d596e4068e2ead11567a8d9e1e57ac1d7a3c79c0d8593f7d2
Opcode Fuzzy Hash: f63e966be329df1a28a13a6714f15b438be353cf54c241ce4af270537ae7b40c
Instruction Fuzzy Hash: E72182B6E007408BF752CB21D844FE773E8AF04349F090738E9468B651EA75F585EB99

Function 110B1190 Relevance: 13.6, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

ASN1_INTEGER_new.LIBEAY32(?,000001A3,110B1263,?,000001A3,?,?,000000FF), ref: 110B119C

Part of subcall function 11088B00: ASN1_item_new.LIBEAY32(1110EDF0,1105752E,?,?,?,?,?,?,?,11057C52,00000000), ref: 11088B05

ASN1_INTEGER_set.LIBEAY32(00000000,000001A3,?,000001A3,110B1263,?,000001A3,?,?,000000FF), ref: 110B11AD

Part of subcall function 1107D570: CRYPTO_free.LIBEAY32(00000000,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D59E
Part of subcall function 1107D570: CRYPTO_malloc.LIBEAY32(00000005,.\crypto\asn1\a_int.c,00000164,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D5B2
Part of subcall function 1107D570: ERR_put_error.LIBEAY32(0000000D,00000076,00000041,.\crypto\asn1\a_int.c,00000168,00000000,11057551,00000000,?), ref: 1107D5DE

X509_ALGOR_new.LIBEAY32(?,000001A3,110B1263,?,000001A3,?,?,000000FF), ref: 110B11B9
ASN1_INTEGER_free.LIBEAY32(00000000,?,000001A3,110B1263,?,000001A3,?,?,000000FF), ref: 110B11C9
OBJ_nid2obj.LIBEAY32(110B1263,-00000001,00000000,?,000001A3,110B1263,?,000001A3,?,?,000000FF), ref: 110B11E5

Part of subcall function 1106DA20: ERR_put_error.LIBEAY32(00000008,00000067,00000065,.\crypto\objects\obj_dat.c,0000014E), ref: 1106DAA1

X509_ALGOR_set0.LIBEAY32(00000000,00000000,?,?,000000FF), ref: 110B11EF
sk_new_null.LIBEAY32(?,?,?,?,?,?,000000FF), ref: 110B1200

Part of subcall function 11068B30: sk_new.LIBEAY32(00000000,11001512), ref: 11068B32

sk_push.LIBEAY32(?,00000000,?,?,?,?,?,?,000000FF), ref: 110B120F
X509_ALGOR_free.LIBEAY32(00000000,?,?,?,?,?,?,?,?,000000FF), ref: 110B1224

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: X509_$R_freeR_newR_put_error$J_nid2objN1_item_newO_freeO_mallocR_setR_set0sk_newsk_new_nullsk_push
String ID:
API String ID: 4179418506-0
Opcode ID: 4789ae2ff79f789aba5b1e66ce8fa11e1c5cf0d20dcaf21e8c8ebdef9da81b68
Instruction ID: 78986b23da9c86d084c3b8bc4b42bb7fb014ba0b7024491182dc8c0da26168d3
Opcode Fuzzy Hash: 4789ae2ff79f789aba5b1e66ce8fa11e1c5cf0d20dcaf21e8c8ebdef9da81b68
Instruction Fuzzy Hash: 5A01C4FED0562317E711EB397C00A5F79E99F81668F060869EC84D6204EA30F952C1E6

Function 12030890 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 120308A8
BN_free.LIBEAY32(?,?), ref: 120308B4
BN_free.LIBEAY32(?,?,?), ref: 120308C0
BN_free.LIBEAY32(?,?,?,?), ref: 120308CC
BN_free.LIBEAY32(?,?,?,?,?), ref: 120308D8
BN_free.LIBEAY32(?,?,?,?,?,?), ref: 120308E4
BN_free.LIBEAY32(?,?,?,?,?,?,?), ref: 120308F0
BN_free.LIBEAY32(?,?,?,?,?,?,?,?), ref: 120308FC
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?), ref: 12030908

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_free$O_free
String ID:
API String ID: 3506937590-0
Opcode ID: b5b6510b69ff97dab40b0e448fc2421e06c9c2735e314478547c64c3d3c87095
Instruction ID: e27aad22dbda08a71e2f033ed9f53fcbeb2b6df39a00d90452de2a6297edc27b
Opcode Fuzzy Hash: b5b6510b69ff97dab40b0e448fc2421e06c9c2735e314478547c64c3d3c87095
Instruction Fuzzy Hash: 162175B6A05B409FD661DF7AD480AD7F7F8BF99301F04490ED1AA87210C775B441DB50

Function 120307A0 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,1202297E,?), ref: 120307B8
BN_free.LIBEAY32(?,?,?,?,1202297E,?), ref: 120307C4
BN_free.LIBEAY32(?,?,?,?,?,1202297E,?), ref: 120307D0
BN_free.LIBEAY32(?,?,?,?,?,?,1202297E,?), ref: 120307DC
BN_free.LIBEAY32(?,?,?,?,?,?,?,1202297E,?), ref: 120307E8
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,1202297E,?), ref: 120307F4
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,1202297E,?), ref: 12030800
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,1202297E,?), ref: 1203080C
BN_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,1202297E,?), ref: 12030818

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_free$O_free
String ID:
API String ID: 3506937590-0
Opcode ID: 608997c93e9717f68a4a881e23168b602aef1752eb020a3ad07d0ff1f2492a44
Instruction ID: 675eb564b68a7af3724fd099cfcbe0e35ebb74ea3536c995cb1cb687dda8da1e
Opcode Fuzzy Hash: 608997c93e9717f68a4a881e23168b602aef1752eb020a3ad07d0ff1f2492a44
Instruction Fuzzy Hash: B22186BA904B409FD661DF7AD480AD7F7F8AF99301F548A0EA1AF87210CA75B442DB50

Function 12009BA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

SSL_use_certificate.SSLEAY32(?,?,?,?,?,?,00000001), ref: 12009C8E
SSL_use_PrivateKey.SSLEAY32(?,?), ref: 12009CA0
X509_free.LIBEAY32(00000001), ref: 12009CD6
EVP_PKEY_free.LIBEAY32(?), ref: 12009CE7

Strings

.\ssl\s3_clnt.c, xrefs: 12009CB5, 12009D7C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_use_L_use_certificatePrivateX509_freeY_free
String ID: .\ssl\s3_clnt.c
API String ID: 2969140140-2155475665
Opcode ID: 20fa23055ed5f9b218d797c8bdcf61d00e83e982a8cd67f3f35d91cbd427f308
Instruction ID: 738f9c845ab62f807d2835ff16e9c02a19808d18831c422ce1b9353948807a6f
Opcode Fuzzy Hash: 20fa23055ed5f9b218d797c8bdcf61d00e83e982a8cd67f3f35d91cbd427f308
Instruction Fuzzy Hash: AC512577A40700ABF751CB24DD89BEB73E4AF40B59F04063DE589862C0E7B4F149DA96

Function 1200D88A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000009D,0000008A,.\ssl\s3_enc.c,000001B6), ref: 1200D8F1

Strings

.\ssl\s3_enc.c, xrefs: 1200D8E0, 1200D973, 1200D98A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_enc.c
API String ID: 1767461275-1985432667
Opcode ID: 938557e5e3b6084f23040ad627dd086dea77b7610611a39fe7936feb0c227961
Instruction ID: 50223654466ea355c68d9e59e63f774665fac100ea16e94004d6f65b3e04b03b
Opcode Fuzzy Hash: 938557e5e3b6084f23040ad627dd086dea77b7610611a39fe7936feb0c227961
Instruction Fuzzy Hash: 90419D766443009BF311CB25D880BEBB3E5BF88718F044A7CE94A9B281E7B1F545DB92

Function 1201F7F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1201F82D
CRYPTO_malloc.LIBEAY32(00000025,.\ssl\d1_both.c,0000061C), ref: 1201F857
RAND_bytes.LIBEAY32(-00000003,00000010), ref: 1201F892
RAND_bytes.LIBEAY32(-00000013,00000010), ref: 1201F8A4
CRYPTO_free.LIBEAY32(00000000), ref: 1201F8F4
ERR_put_error.LIBEAY32(00000014,00000131,0000016D,.\ssl\d1_both.c,000005FC,?,?,1200B782), ref: 1201F929

Strings

.\ssl\d1_both.c, xrefs: 1201F81D, 1201F850, 1201F907, 1201F918

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: D_bytes$L_stateO_freeO_mallocR_put_error
String ID: .\ssl\d1_both.c
API String ID: 1882168250-2895748750
Opcode ID: 2db889ec74e3c648e427b98a5db32d47153c4aa0c35b0dcc2ab05f1d98c8808a
Instruction ID: 98e3ca1143ec2d83347fb9cfef373431b44d2c4be3b1c2215356550981cfb16b
Opcode Fuzzy Hash: 2db889ec74e3c648e427b98a5db32d47153c4aa0c35b0dcc2ab05f1d98c8808a
Instruction Fuzzy Hash: 70312D737843467BF30196145C4AFE7B6985F21718F148368FD482D2C6EBA2E551A3A2

Function 1103F0A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000003,00000070,0000006A,.\crypto\bn\bn_mpi.c,00000061), ref: 1103F0B9

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(00000003,00000070,00000068,.\crypto\bn\bn_mpi.c,00000067), ref: 1103F0FD

Strings

.\crypto\bn\bn_mpi.c, xrefs: 1103F0AE, 1103F0F2

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_state
String ID: .\crypto\bn\bn_mpi.c
API String ID: 4246747085-2645497588
Opcode ID: 04307e13f8c1dd2cb9f915df44c6772ef1a78983f889486e6dc2738ba00bbd2c
Instruction ID: 131d72062a3021f22d0cdeec4dd3ae2433b4b5ff0e5fdc9a0b12a7fbcc5d4ee0
Opcode Fuzzy Hash: 04307e13f8c1dd2cb9f915df44c6772ef1a78983f889486e6dc2738ba00bbd2c
Instruction Fuzzy Hash: DF21CE3BF142262DE321D5B97C80B73F7D9CBC122BF05817BF99CDA181E561D41182A2

Function 120207B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32(?,?,120208B3,?), ref: 120207BE
ERR_put_error.LIBEAY32(00000014,00000135,0000016A,.\ssl\d1_srtp.c,000000B0,?,?,120208B3,?), ref: 120207DF
sk_find.LIBEAY32(00000000,?), ref: 12020833
sk_push.LIBEAY32(00000000,?), ref: 12020841
ERR_put_error.LIBEAY32(00000014,00000135,0000016C,.\ssl\d1_srtp.c,000000C3), ref: 12020887
sk_free.LIBEAY32(00000000,00000014,00000135,0000016C,.\ssl\d1_srtp.c,000000C3), ref: 1202088D

Strings

.\ssl\d1_srtp.c, xrefs: 120207CE, 12020857, 12020876

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_findsk_freesk_new_nullsk_push
String ID: .\ssl\d1_srtp.c
API String ID: 3835093942-3998674507
Opcode ID: a2d80b35cf4d611eafc81ecd2b44201b8d8a4987e098586792b8b2d1af90395c
Instruction ID: 6890e8a2e60a3a12d1fe7ee8be904f2e0855b0649da1f379dd6769701a0403f8
Opcode Fuzzy Hash: a2d80b35cf4d611eafc81ecd2b44201b8d8a4987e098586792b8b2d1af90395c
Instruction Fuzzy Hash: D7217977B413062BE602DB145C40FE7B39B8B55313F550326FD459A580EA92B504A1E0

Function 12026D50 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000C3,000000F0,.\ssl\ssl_sess.c,00000396), ref: 12026DA1
SSL_set_ssl_method.SSLEAY32(?,?), ref: 12026DB5
CRYPTO_add_lock.LIBEAY32(?,00000001,0000000E,.\ssl\ssl_sess.c,000003AE), ref: 12026DD6
SSL_SESSION_free.SSLEAY32(?), ref: 12026DE9
SSL_SESSION_free.SSLEAY32(?,?,?,12021577,?,00000000,?), ref: 12026E16
SSL_set_ssl_method.SSLEAY32(?,?,?,?,12021577,?,00000000,?), ref: 12026E37

Strings

.\ssl\ssl_sess.c, xrefs: 12026D90, 12026DC6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_set_ssl_methodN_free$O_add_lockR_put_error
String ID: .\ssl\ssl_sess.c
API String ID: 926238990-1959455021
Opcode ID: 2a31797ea54faaaba63f30d042a182e2c1f03785b091c0fdceecb6dac516a89a
Instruction ID: 824b55604738f07a7146774259972ea67d40d09e822a8767702d101e1d5d769e
Opcode Fuzzy Hash: 2a31797ea54faaaba63f30d042a182e2c1f03785b091c0fdceecb6dac516a89a
Instruction Fuzzy Hash: FA21B0B67407019FEA11CB65EC41FE7B3E8AF94300F418A2AE956DB240E771F941E691

Function 1109D1A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

X509_EXTENSION_new.LIBEAY32 ref: 1109D1B0
ERR_put_error.LIBEAY32(0000000B,0000006D,00000041,.\crypto\x509\x509_v3.c,000000D4), ref: 1109D1CB
ASN1_OBJECT_free.LIBEAY32(00000000), ref: 1109D1E4
OBJ_dup.LIBEAY32(?,00000000), ref: 1109D1EA
ASN1_STRING_set.LIBEAY32(?,?,?,?,00000000), ref: 1109D212
X509_EXTENSION_free.LIBEAY32(00000000), ref: 1109D227

Strings

.\crypto\x509\x509_v3.c, xrefs: 1109D1C0

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: X509_$G_setJ_dupN_freeN_newR_put_errorT_free
String ID: .\crypto\x509\x509_v3.c
API String ID: 3488589962-625490086
Opcode ID: 20f9aebf3c04ec24a810795f1f64de8ae49ccef5b4606084ee8a58618b8745df
Instruction ID: 271e0590e2888d964b2937919a1e7bcfceb6379d8257487bfae078a73484969a
Opcode Fuzzy Hash: 20f9aebf3c04ec24a810795f1f64de8ae49ccef5b4606084ee8a58618b8745df
Instruction Fuzzy Hash: C511EFB6F446165FE710DE28E840B5BB3E9AF94B24F1205ADED8CA7244DB30E8408791

Function 1201EA70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000034,.\ssl\d1_both.c,000000B5), ref: 1201EA86
CRYPTO_malloc.LIBEAY32(?,.\ssl\d1_both.c,000000BA), ref: 1201EAA3
CRYPTO_malloc.LIBEAY32(?,.\ssl\d1_both.c,000000C7), ref: 1201EACB
CRYPTO_free.LIBEAY32(00000000), ref: 1201EADE
CRYPTO_free.LIBEAY32(00000000), ref: 1201EAE7
_memset.LIBCMT ref: 1201EAFA

Strings

.\ssl\d1_both.c, xrefs: 1201EA79, 1201EA9D, 1201EAC5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_malloc$O_free$_memset
String ID: .\ssl\d1_both.c
API String ID: 205442388-2895748750
Opcode ID: e861f675ec611fefca3eea5b4cee53c4f92e10547a6ffb674c3d920081daf5f4
Instruction ID: abc9f5c0c138509805a6a5337a60b5b4426b38f05ff1e86fa46e37532752e122
Opcode Fuzzy Hash: e861f675ec611fefca3eea5b4cee53c4f92e10547a6ffb674c3d920081daf5f4
Instruction Fuzzy Hash: 610128A7F8531437D222DB616C41FEFB2D89B85B16F420339FD05692C0FAA6E805A1D1

Function 11085120 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 11085121
BIO_new.LIBEAY32(00000000), ref: 11085127

Part of subcall function 11061620: CRYPTO_malloc.LIBEAY32(00000040,.\crypto\bio\bio_lib.c,00000046,?,11003852,00000000,0000000A,00000014,.\crypto\mem_dbg.c,00000112), ref: 1106162A
Part of subcall function 11061620: ERR_put_error.LIBEAY32(00000020,0000006C,00000041,.\crypto\bio\bio_lib.c,00000048,00000014,.\crypto\mem_dbg.c,00000112), ref: 11061645

ERR_put_error.LIBEAY32(0000000B,00000076,00000007,.\crypto\asn1\t_x509.c,0000005A), ref: 11085142

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

BIO_ctrl.LIBEAY32(00000000,0000006A,00000000,?), ref: 11085159
X509_print_ex.LIBEAY32(00000000,?,?,?,00000000,0000006A,00000000,?), ref: 1108516E
BIO_free.LIBEAY32(00000000,00000000,?,?,?,00000000,0000006A,00000000,?), ref: 11085176

Strings

.\crypto\asn1\t_x509.c, xrefs: 11085137

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeR_put_error$O_ctrlO_mallocO_newO_s_fileR_get_stateX509_print_ex
String ID: .\crypto\asn1\t_x509.c
API String ID: 1101855416-1279484286
Opcode ID: 6a82844613a283beefd5c4db7f7f15dc4f2fcc956cf5922684c16b11e68d98dd
Instruction ID: 20e53a3631e853d4221abd7e5c4703c70ae2e8c24efa7e60c33e1a8af2a464d9
Opcode Fuzzy Hash: 6a82844613a283beefd5c4db7f7f15dc4f2fcc956cf5922684c16b11e68d98dd
Instruction Fuzzy Hash: FFF0E9B9F4822137E120E265AC01F6F32DD9FC4758F050114F605F7280E564FD4185E6

Function 110A7010 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

ASN1_STRING_type_new.LIBEAY32(00000002), ref: 110A7013

Part of subcall function 1108F9F0: CRYPTO_malloc.LIBEAY32(00000010,.\crypto\asn1\asn1_lib.c,0000019C,11087121,?,?,?,?,?,11087C40,?,?,?,?,?,?), ref: 1108F9FC
Part of subcall function 1108F9F0: ERR_put_error.LIBEAY32(0000000D,00000082,00000041,.\crypto\asn1\asn1_lib.c,0000019E,?,?,?,?,00000000,11081619,00000000,?,00000000,1110DA10,110446BA), ref: 1108FA1D

ASN1_INTEGER_set.LIBEAY32(00000000,?), ref: 110A7027

Part of subcall function 1107D570: CRYPTO_free.LIBEAY32(00000000,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D59E
Part of subcall function 1107D570: CRYPTO_malloc.LIBEAY32(00000005,.\crypto\asn1\a_int.c,00000164,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D5B2
Part of subcall function 1107D570: ERR_put_error.LIBEAY32(0000000D,00000076,00000041,.\crypto\asn1\a_int.c,00000168,00000000,11057551,00000000,?), ref: 1107D5DE

SXNET_get_id_INTEGER.LIBEAY32(?,00000000), ref: 110A703A

Part of subcall function 110A6DC0: sk_num.LIBEAY32(?), ref: 110A6DCE
Part of subcall function 110A6DC0: sk_value.LIBEAY32(?,00000000), ref: 110A6DE5
Part of subcall function 110A6DC0: ASN1_STRING_cmp.LIBEAY32(?,?,?,00000000), ref: 110A6DF0
Part of subcall function 110A6DC0: sk_num.LIBEAY32(?), ref: 110A6E01

ASN1_STRING_free.LIBEAY32(00000000,?,00000000), ref: 110A7042

Part of subcall function 1108FA40: CRYPTO_free.LIBEAY32(?,?,110871CA,?,0000000D,000000CC,00000041,.\crypto\asn1\tasn_dec.c,000003C3,?,?,?,?,00000000,11081619,00000000), ref: 1108FA57
Part of subcall function 1108FA40: CRYPTO_free.LIBEAY32(?,?,110871CA,?,0000000D,000000CC,00000041,.\crypto\asn1\tasn_dec.c,000003C3,?,?,?,?,00000000,11081619,00000000), ref: 1108FA60

ERR_put_error.LIBEAY32(00000022,00000081,00000041,.\crypto\x509v3\v3_sxnet.c,000000FA), ref: 110A7062
ASN1_STRING_free.LIBEAY32(00000000,00000022,00000081,00000041,.\crypto\x509v3\v3_sxnet.c,000000FA), ref: 110A7068

Strings

.\crypto\x509v3\v3_sxnet.c, xrefs: 110A7054

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeR_put_error$G_freeO_mallocsk_num$G_cmpG_type_newR_setT_get_id_sk_value
String ID: .\crypto\x509v3\v3_sxnet.c
API String ID: 1707628157-1855245706
Opcode ID: 77dee39e59855b9374a6c3b383d7ff42123d311e6c0a0ade6a195b05c9b7bf71
Instruction ID: adcd4e463f5ee2f634ab62daf4605c296cd37758f6d1571e3f34d2d6d91da73d
Opcode Fuzzy Hash: 77dee39e59855b9374a6c3b383d7ff42123d311e6c0a0ade6a195b05c9b7bf71
Instruction Fuzzy Hash: F0F0A7AEF4522232E510F1B57C01FEF769C4F91668F044168FB499A182EDA5A98182E7

Function 1202EA90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

BIO_s_file.LIBEAY32 ref: 1202EA91
BIO_new.LIBEAY32(00000000), ref: 1202EA97
ERR_put_error.LIBEAY32(00000014,000000BE,00000007,.\ssl\ssl_txt.c,00000060), ref: 1202EAB5
BIO_ctrl.LIBEAY32(00000000,0000006A,00000000,?), ref: 1202EACC
SSL_SESSION_print.SSLEAY32(00000000,?,00000000,0000006A,00000000,?), ref: 1202EAD7
BIO_free.LIBEAY32(00000000,00000000,?,00000000,0000006A,00000000,?), ref: 1202EADF

Strings

.\ssl\ssl_txt.c, xrefs: 1202EAA7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_printO_ctrlO_freeO_newO_s_fileR_put_error
String ID: .\ssl\ssl_txt.c
API String ID: 1795729836-1714789413
Opcode ID: b2f56ec0e86dd3d02f74aedb390556a3f1fcbed0f30480a57586347a251e050c
Instruction ID: 732b7d76cd9c9b70ccf921b43e94cd922c45fdbd318b3d79eadc2f350f4319c4
Opcode Fuzzy Hash: b2f56ec0e86dd3d02f74aedb390556a3f1fcbed0f30480a57586347a251e050c
Instruction Fuzzy Hash: 22F0EC7BBC42503BE592F3746C05FEF61985F85711F090735F605BB280E954B90111B6

Function 1200A950 Relevance: 12.1, APIs: 8, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 1200CE50: OPENSSL_cleanse.LIBEAY32(00000000,?), ref: 1200CE6F
Part of subcall function 1200CE50: CRYPTO_free.LIBEAY32(00000000,00000000,?), ref: 1200CE7E

sk_pop_free.LIBEAY32(?,Function_00031824), ref: 1200A97E
CRYPTO_free.LIBEAY32(?), ref: 1200A994
DH_free.LIBEAY32(?), ref: 1200A9B3
EC_KEY_free.LIBEAY32(?), ref: 1200A9D2
BIO_free.LIBEAY32(?), ref: 1200AA26
CRYPTO_free.LIBEAY32(?), ref: 1200AA59
_memset.LIBCMT ref: 1200AA74
CRYPTO_free.LIBEAY32(?), ref: 1200AAF5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$H_freeL_cleanseY_free_memsetsk_pop_free
String ID:
API String ID: 2042099955-0
Opcode ID: c8c4d45951b93ac4cae0aacebc81783731baf0245b25510c92940edd9b5a5b24
Instruction ID: 765c990481d1a3f4c226db1b483972679210c2fae1f8c5d1fd02f9eee897c9ab
Opcode Fuzzy Hash: c8c4d45951b93ac4cae0aacebc81783731baf0245b25510c92940edd9b5a5b24
Instruction Fuzzy Hash: 6E515BB6A007808FD311CF5AC484AA6F3E4BF48308F594A7DE58A8B712D771F885CB95

Function 11045160 Relevance: 12.1, APIs: 8, Instructions: 122COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?,?,?,?), ref: 110451A4
EVP_MD_size.LIBEAY32(?,?,?,?,?), ref: 110451AA

Part of subcall function 11077AD0: ERR_put_error.LIBEAY32(00000006,000000A2,0000009F,.\crypto\evp\evp_lib.c,00000139,1104474C,00000000), ref: 11077AEE

EVP_DigestInit_ex.LIBEAY32(?,?,00000000), ref: 110451FE

Part of subcall function 1106F260: EVP_MD_CTX_clear_flags.LIBEAY32(?,00000002,?,?,?,11013FE2,?,?,?), ref: 1106F26A
Part of subcall function 1106F260: ENGINE_finish.LIBEAY32(?), ref: 1106F2A2
Part of subcall function 1106F260: ENGINE_init.LIBEAY32(?), ref: 1106F2B3
Part of subcall function 1106F260: ERR_put_error.LIBEAY32(00000006,00000080,00000041,.\crypto\evp\digest.c,000000E0), ref: 1106F2D5

EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 11045220
EVP_DigestUpdate.LIBEAY32(?,?,00000004), ref: 1104523C
EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 11045261

Part of subcall function 1106F420: OpenSSLDie.LIBEAY32(.\crypto\evp\digest.c,00000118,ctx->digest->md_size <= EVP_MAX_MD_SIZE,?), ref: 1106F43D
Part of subcall function 1106F420: EVP_MD_CTX_set_flags.LIBEAY32(?,00000002), ref: 1106F475
Part of subcall function 1106F420: OPENSSL_cleanse.LIBEAY32(?,?,?,?), ref: 1106F487

EVP_DigestFinal_ex.LIBEAY32(?,?,00000000), ref: 1104527B
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 110452BA

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: Digest$Final_exR_put_errorUpdate$D_sizeE_finishE_initInit_exL_cleanseOpenX_cleanupX_clear_flagsX_initX_set_flags
String ID:
API String ID: 3491752608-0
Opcode ID: a0a2095c82ab787331afdf8d21fc456070f6402dc91363eb9a88554a6a344c16
Instruction ID: 6c76f313de3d231730577939621d604b8656741abb1eb6fdf9c957483318f67d
Opcode Fuzzy Hash: a0a2095c82ab787331afdf8d21fc456070f6402dc91363eb9a88554a6a344c16
Instruction Fuzzy Hash: 1F419476D083429BD310CF68D990B6FB7E8AFD4608F54492DF99587641EA31F608CBA3

Function 12024660 Relevance: 12.1, APIs: 8, Instructions: 117COMMON

Download Yara Rule

APIs

ERR_peek_error.LIBEAY32 ref: 1202466D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_peek_error
String ID:
API String ID: 3623038435-0
Opcode ID: 84e697540434b5e704078e75686ea9fb663f5fa0c44cbc5209a396fb181a8609
Instruction ID: 9dd77d4ae5b6e66bacae915e28c7e7266529cea283e09aaf693520f0c53bf7e5
Opcode Fuzzy Hash: 84e697540434b5e704078e75686ea9fb663f5fa0c44cbc5209a396fb181a8609
Instruction Fuzzy Hash: E031353771024506EB22D56CAC46BFB73FCCB8532AF42023BE958C5581EB65E045B2E2

Function 1202F1F0 Relevance: 12.1, APIs: 8, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b31163145e7a2881fa1b57106ce11263aeb09ecc36ed9bbc1ce0b3985a93992
Instruction ID: 3c99203370fc94a423ef77dbd040c2adf306412b6cd159be51a909e5b1af0e2c
Opcode Fuzzy Hash: 1b31163145e7a2881fa1b57106ce11263aeb09ecc36ed9bbc1ce0b3985a93992
Instruction Fuzzy Hash: 7111387BB003063BE352D5A95C49FA7B2EC9F057A0F44072AF908AA282F7A5F51452E1

Function 12028FB0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 120290C7
_strncmp.LIBCMT ref: 12029142
ERR_put_error.LIBEAY32(00000014,000000E6,00000118,.\ssl\ssl_ciph.c,000004C6,?,00000000,00000001,00000000), ref: 120292C9

Strings

STRENGTH, xrefs: 1202913C
.\ssl\ssl_ciph.c, xrefs: 120292B8, 120292E2

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _strncmp$R_put_error
String ID: .\ssl\ssl_ciph.c$STRENGTH
API String ID: 3709734218-4120156686
Opcode ID: 1c1368b506f88f0feabe4f90341f975f5b5787e90487ea866c90c8919ffdfffa
Instruction ID: d2ca03ca27487845ad395d607d8276ef0aa27b69b328e726b00182226964b63d
Opcode Fuzzy Hash: 1c1368b506f88f0feabe4f90341f975f5b5787e90487ea866c90c8919ffdfffa
Instruction Fuzzy Hash: D8B1D27290834E9FD712CE19C4847EAB7E1AB85388FA0471FF9C587294C371D446EB96

Function 1201F0C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

pqueue_find.LIBEAY32(?,?), ref: 1201F12A
pitem_new.LIBEAY32(?,00000000), ref: 1201F21C
pqueue_insert.LIBEAY32(?,00000000), ref: 1201F233
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,00000376,item != NULL), ref: 1201F24E

Strings

item != NULL, xrefs: 1201F23F
.\ssl\d1_both.c, xrefs: 1201F249

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Openpitem_newpqueue_findpqueue_insert
String ID: .\ssl\d1_both.c$item != NULL
API String ID: 3897113090-143540491
Opcode ID: db965216d5484188dd87d8da9260dc8c0b6d15ec8e8d1a0a0d935af787dcde21
Instruction ID: b8fab01895ee6d26fd87aa99730e15ab96cd7a2a4d30f914901e06adc7fad897
Opcode Fuzzy Hash: db965216d5484188dd87d8da9260dc8c0b6d15ec8e8d1a0a0d935af787dcde21
Instruction Fuzzy Hash: E551E6B76043425BD715DF64C884BABB3E4AB98314F004B2DF9998B280EB75E904A7D2

Function 12019C60 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?), ref: 12019CD7
EVP_MD_size.LIBEAY32(?), ref: 12019D0C
EVP_MD_CTX_copy_ex.LIBEAY32(?,00000000), ref: 12019D3D
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 12019D54

Part of subcall function 1200D120: CRYPTO_malloc.LIBEAY32(00000018,.\ssl\s3_enc.c,00000273,?,00000000,12001BF2,?), ref: 1200D141
Part of subcall function 1200D120: ERR_put_error.LIBEAY32(00000014,00000125,00000041,.\ssl\s3_enc.c,00000275), ref: 1200D171

EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12019DFB
OPENSSL_cleanse.LIBEAY32(?,?,?), ref: 12019E06
OPENSSL_cleanse.LIBEAY32(?,0000000C,?,?,?), ref: 12019E12

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_cleanse$D_sizeDigestFinal_exO_mallocR_put_errorX_cleanupX_copy_exX_init
String ID:
API String ID: 3704286172-0
Opcode ID: 84d5eba5983a7ff53d06f141bab62d5c416ac9cc2f54b56ee3f8d3dd9c4e07e3
Instruction ID: 8752e79143b55bc3e0b040318b45c14392257997e324330b8ff9cee3565493e4
Opcode Fuzzy Hash: 84d5eba5983a7ff53d06f141bab62d5c416ac9cc2f54b56ee3f8d3dd9c4e07e3
Instruction Fuzzy Hash: C85150B75043059FE315CB65D880FABB3E8AF88748F444B2DF95986140EB31F605DBA2

Function 12011767 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?,?,?,?,?,?,?,?,?,?), ref: 1201189D
EVP_DigestInit_ex.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 120118B3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: DigestInit_exX_init
String ID:
API String ID: 3987009937-0
Opcode ID: b1d8d3cf86ce456efb84a72c52c405cc38408d236e760c4b724dba7b72fdaecf
Instruction ID: 3918462578aa28b1f5cb1a4cb820e4faa63eb929a4fd02549be5944b8deff933
Opcode Fuzzy Hash: b1d8d3cf86ce456efb84a72c52c405cc38408d236e760c4b724dba7b72fdaecf
Instruction Fuzzy Hash: 9951B07B6083809FD356DB648890AEFF7E8AF8A340F445E1DE5D68B201D630E50ADB52

Function 12011769 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?,?,?,?,?,?,?,?,?,?), ref: 1201189D
EVP_DigestInit_ex.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 120118B3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: DigestInit_exX_init
String ID:
API String ID: 3987009937-0
Opcode ID: 2af84f82991053fa3793e5b3915fee6e2e34a4b7f1defa5dab4f8756a93c49d2
Instruction ID: 9b75b71b5a4310cd8e91ade946bb8b16f9c1281f0be53f31a72c4db9c74ddd3c
Opcode Fuzzy Hash: 2af84f82991053fa3793e5b3915fee6e2e34a4b7f1defa5dab4f8756a93c49d2
Instruction Fuzzy Hash: 6151907B6083809FD356DB648890BEFF7E4AB8A340F445E1DE5D587201D630E509DB52

Function 1200CEC6 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 1200CEED
X509_TRUST_get_flags.LIBEAY32 ref: 1200CF47
_memset.LIBCMT ref: 1200CF72
EVP_Cipher.LIBEAY32(?,?,?,?), ref: 1200CFB3
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200CFD6
X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 1200CFE9
EVP_MD_size.LIBEAY32(00000000,?), ref: 1200CFEF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$Y_get_object$CipherD_sizeT_get_flags_memsetpqueue_peek
String ID:
API String ID: 1960641104-0
Opcode ID: ebc4bb7d9d8149a60ef51597e016104f80184b2934049f900d841f92920b5694
Instruction ID: c5caa091cb1345cd10511ba484b304d10c38513532a2c4f5d819988c7407d793
Opcode Fuzzy Hash: ebc4bb7d9d8149a60ef51597e016104f80184b2934049f900d841f92920b5694
Instruction Fuzzy Hash: C141B2B76043018FF711CA64AC80BBBB3E5EB84254F444A3DE94983641D736F90AE766

Function 1201FBA8 Relevance: 10.6, APIs: 7, Instructions: 122COMMON

Download Yara Rule

APIs

SSL_get_wbio.SSLEAY32(?,0000000D,00000000,00000000), ref: 1201FBEB
BIO_ctrl.LIBEAY32(00000000), ref: 1201FBF4
SSL_get_wbio.SSLEAY32(?,0000000B,00000000,00000000), ref: 1201FC21
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FC2A
SSL_get_wbio.SSLEAY32(?,0000002B,00000000,00000000), ref: 1201FCCC
BIO_ctrl.LIBEAY32(00000000), ref: 1201FCD5
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201FCEC
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,000001A3,len == (unsigned int)ret), ref: 1201FD2C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_wbioO_ctrl$L_ctrlOpen
String ID:
API String ID: 1492757431-0
Opcode ID: 7b734023d8175b5eab54d30a3a4bd2f9995978e6ccf8afbf9f3801389ef225b2
Instruction ID: 0dfb812d674f09b886d164f5a9e2317e417c3c2bdfbcef9e0ca1f225cf2d59fe
Opcode Fuzzy Hash: 7b734023d8175b5eab54d30a3a4bd2f9995978e6ccf8afbf9f3801389ef225b2
Instruction Fuzzy Hash: 3A414B7BA043019FD321DA28CD8CB9AB3F5AF54718F144B2CEA199F282F371F1419685

Function 1201FBA6 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

SSL_get_wbio.SSLEAY32(?,0000000D,00000000,00000000), ref: 1201FBEB
BIO_ctrl.LIBEAY32(00000000), ref: 1201FBF4
SSL_get_wbio.SSLEAY32(?,0000000B,00000000,00000000), ref: 1201FC21
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201FC2A
SSL_get_wbio.SSLEAY32(?,0000002B,00000000,00000000), ref: 1201FCCC
BIO_ctrl.LIBEAY32(00000000), ref: 1201FCD5
SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201FCEC
OpenSSLDie.LIBEAY32(.\ssl\d1_both.c,000001A3,len == (unsigned int)ret), ref: 1201FD2C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_wbioO_ctrl$L_ctrlOpen
String ID:
API String ID: 1492757431-0
Opcode ID: be790879e67bb41f2ea5c0375f175cc5a7aec9face4289818ce90bf654921e52
Instruction ID: a1f5f8d42cbd9b8ad52a7afd64d243be53b64f87fd71e5155672cffb156f9306
Opcode Fuzzy Hash: be790879e67bb41f2ea5c0375f175cc5a7aec9face4289818ce90bf654921e52
Instruction Fuzzy Hash: CA412B7BA047019BD311DA18CD8CB9AB3F5AF54718F144B2CEA199F282F771F1419685

Function 12010130 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000008C,00000095,.\ssl\s3_both.c,00000111), ref: 120101E3
OpenSSLDie.LIBEAY32(.\ssl\s3_both.c,00000119,i <= EVP_MAX_MD_SIZE), ref: 1201021A
OpenSSLDie.LIBEAY32(.\ssl\s3_both.c,0000011D,i <= EVP_MAX_MD_SIZE), ref: 12010261

Strings

i <= EVP_MAX_MD_SIZE, xrefs: 1201020B, 12010252
.\ssl\s3_both.c, xrefs: 12010172, 120101A4, 120101CD, 12010215, 1201025C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Open$R_put_error
String ID: .\ssl\s3_both.c$i <= EVP_MAX_MD_SIZE
API String ID: 2951821155-225423700
Opcode ID: 91f1ae477e7c16436e426ce37ff4fb6cb4422e3b16df316c4e39bab3092d9be8
Instruction ID: 30beb513a87dd5d3c8ceeb2c9de150a40a146411791d2012c6014ba3b21af4aa
Opcode Fuzzy Hash: 91f1ae477e7c16436e426ce37ff4fb6cb4422e3b16df316c4e39bab3092d9be8
Instruction Fuzzy Hash: D73135737403017BF35AC204EC85FE7B39AAB84314F148738FA486B291DAB5E985D3A1

Function 1108D1A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

BIO_pop.LIBEAY32(?,?,?,?,?,?,?,?,?,?,1110F544,1110F544), ref: 1108D245
BIO_free.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,1110F544,1110F544), ref: 1108D251
SMIME_crlf_copy.LIBEAY32(?,?,?,?), ref: 1108D216

Part of subcall function 1108CBD0: BIO_f_buffer.LIBEAY32 ref: 1108CBF9
Part of subcall function 1108CBD0: BIO_new.LIBEAY32(00000000), ref: 1108CBFF

ERR_put_error.LIBEAY32(0000000D,000000D6,000000CA,.\crypto\asn1\asn_mime.c,0000017E,?,1110F544,?,1108D6C5,?,?,?,?,------%s%s,?,1110F544), ref: 1108D282
SMIME_crlf_copy.LIBEAY32(?,?,?,?,1110F544,?,1108D6C5,?,?,?,?,------%s%s,?,1110F544,?), ref: 1108D29A

Strings

.\crypto\asn1\asn_mime.c, xrefs: 1108D271

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: E_crlf_copy$O_f_bufferO_freeO_newO_popR_put_error
String ID: .\crypto\asn1\asn_mime.c
API String ID: 2202174462-538127707
Opcode ID: 8140a6fa3e42d6c5ed714602320f4c4a452d2d8cb79a97470b8717f364ca27ef
Instruction ID: 60f3f546a51e0c769f9d03608691e87d1bfd3f3419b2e8f0055b1d03c5853e94
Opcode Fuzzy Hash: 8140a6fa3e42d6c5ed714602320f4c4a452d2d8cb79a97470b8717f364ca27ef
Instruction Fuzzy Hash: 5821D976E083055BE300EF69DC40BAF77E8EBD4764F440A6DF944D7240E674E90887A2

Function 1200FFB0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 96COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\s3_both.c,000000B5,i <= EVP_MAX_MD_SIZE), ref: 12010036

Strings

@, xrefs: 12010022
i <= EVP_MAX_MD_SIZE, xrefs: 12010027, 12010064
@, xrefs: 1201005F
.\ssl\s3_both.c, xrefs: 12010031, 1201006E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Open
String ID: .\ssl\s3_both.c$@$@$i <= EVP_MAX_MD_SIZE
API String ID: 71445658-1993513779
Opcode ID: 369deb462f0d8d74fdd4673c3b27f209206a24bd55141b71ec2a617a0a84bbb0
Instruction ID: 4bddfdc76f99bb03e20a3e1b9fc5193cf0684694d7be69c80caa0ebc7ae8fc64
Opcode Fuzzy Hash: 369deb462f0d8d74fdd4673c3b27f209206a24bd55141b71ec2a617a0a84bbb0
Instruction Fuzzy Hash: C331F3B62007419FD305EB04CD84EA7B3E9EF88318F04466CEA899B711D678F945DBA1

Function 12011866 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

EVP_MD_CTX_init.LIBEAY32(?,?,?,?,?,?,?,?,?,?), ref: 1201189D
EVP_DigestInit_ex.LIBEAY32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 120118B3
_memset.LIBCMT ref: 120118E0
EVP_DigestUpdate.LIBEAY32(?,?,?,?,0000005C,?), ref: 120118FA
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12011917
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 12011938
EVP_MD_CTX_cleanup.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201194D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$Init_exX_cleanupX_init_memset
String ID:
API String ID: 392347561-0
Opcode ID: 1efb62e28bc0e76ebf9c7755dbdb9c0e4b52e794364a40cc97f4337e48187e6d
Instruction ID: 2a8aaabe1e5c0241c72932869d62696409725b6f5d18eed35dd3948f26e7b5fa
Opcode Fuzzy Hash: 1efb62e28bc0e76ebf9c7755dbdb9c0e4b52e794364a40cc97f4337e48187e6d
Instruction Fuzzy Hash: 2C2181775083409FD366DBA0D880BEBF3ECAB88341F144E2DE59AC7150EA31E509CB92

Function 120019B9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

sk_value.LIBEAY32(?,00000000), ref: 120019CE
sk_free.LIBEAY32(?), ref: 12001A47
ERR_put_error.LIBEAY32(00000014,0000008A,000000E2,.\ssl\s3_srvr.c,0000057D), ref: 12001AA5
ERR_put_error.LIBEAY32(00000014,0000008A), ref: 12001C51
sk_free.LIBEAY32(?), ref: 12001C7D

Strings

P, xrefs: 12001A6F
.\ssl\s3_srvr.c, xrefs: 12001A6A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_free$sk_value
String ID: .\ssl\s3_srvr.c$P
API String ID: 46945472-995485268
Opcode ID: 70faa825f18056db5927ba18aa957c8b03dfc808f5ce62bbd3013e61bb613afc
Instruction ID: ae1ea67b3835c72d3e4493272a4087e6f27754f4787ef7d7a5e7e3951d18ef4c
Opcode Fuzzy Hash: 70faa825f18056db5927ba18aa957c8b03dfc808f5ce62bbd3013e61bb613afc
Instruction Fuzzy Hash: 44219176A443519FF752CF14CC84BAAB3E1BB88741F104A2DE9899B240D731E905DBA6

Function 120231F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SSL_CTX_add_session.SSLEAY32(?,?,?,00000000,?,00000001,120055DC,?,00000002), ref: 12023233

Part of subcall function 12027980: CRYPTO_add_lock.LIBEAY32(?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279A1
Part of subcall function 12027980: CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_sess.c,000002F1,?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279B4
Part of subcall function 12027980: lh_insert.LIBEAY32(?,?,00000009,0000000C,.\ssl\ssl_sess.c,000002F1,?,00000001,0000000E,.\ssl\ssl_sess.c,000002EC), ref: 120279C2
Part of subcall function 12027980: SSL_SESSION_free.SSLEAY32(00000000,00000000), ref: 120279DF
Part of subcall function 12027980: SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000), ref: 12027A12
Part of subcall function 12027980: SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000), ref: 12027A29
Part of subcall function 12027980: SSL_CTX_ctrl.SSLEAY32(?,00000014,00000000,00000000,?,0000002B,00000000,00000000), ref: 12027A37
Part of subcall function 12027980: lh_retrieve.LIBEAY32(?,?), ref: 12027A55
Part of subcall function 12027980: lh_delete.LIBEAY32(?,?), ref: 12027A66
Part of subcall function 12027980: SSL_SESSION_free.SSLEAY32(00000000), ref: 12027A8B
Part of subcall function 12027980: SSL_CTX_ctrl.SSLEAY32(?,0000002B,00000000,00000000,00000000), ref: 12027A9A

CRYPTO_add_lock.LIBEAY32(?,00000001,0000000E,.\ssl\ssl_lib.c,00000A58,?,00000000,?,00000001,120055DC,?,00000002), ref: 12023266
SSL_SESSION_free.SSLEAY32(?), ref: 1202328C
__time64.LIBCMT ref: 120232BE
SSL_CTX_flush_sessions.SSLEAY32(?,00000000,00000000,?,00000000,?,00000001,120055DC,?,00000002), ref: 120232CF

Strings

.\ssl\ssl_lib.c, xrefs: 12023256

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X_ctrl$N_free$O_add_lock$O_lockX_add_sessionX_flush_sessions__time64lh_deletelh_insertlh_retrieve
String ID: .\ssl\ssl_lib.c
API String ID: 1103081452-3333140318
Opcode ID: 4a7e4844d5ac59c1f3c82954a30a5b58eb3f6ef3b2f93d09d049159b1ce39fb4
Instruction ID: 5ed72ec34fdd7646efa2cf40901684c9a8f32a574a8824123c7dd4058bac972c
Opcode Fuzzy Hash: 4a7e4844d5ac59c1f3c82954a30a5b58eb3f6ef3b2f93d09d049159b1ce39fb4
Instruction Fuzzy Hash: D7219077700780DBE311CB68C884FE6B3E5BF48309F800719E98A57241D635F809E751

Function 120277E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_sess.c,0000033C,?,?,12027B48,00000001,?), ref: 1202780B
lh_retrieve.LIBEAY32(00000001,?,?,?,?,12027B48,00000001,?), ref: 12027819
lh_delete.LIBEAY32(00000001,?,00000001,?), ref: 12027831
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_sess.c,00000344), ref: 12027856
SSL_SESSION_free.SSLEAY32(00000000), ref: 1202787B

Strings

.\ssl\ssl_sess.c, xrefs: 12027802, 1202784D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$N_freelh_deletelh_retrieve
String ID: .\ssl\ssl_sess.c
API String ID: 614341428-1959455021
Opcode ID: a86dc49ab179518402df4abd6714f45080cdf8b01adfbc7731112e58214c94c1
Instruction ID: 389a9fa2746fd17d1c82213cd49850d0ce507b9e0698ccabc1220cb260f4bf4a
Opcode Fuzzy Hash: a86dc49ab179518402df4abd6714f45080cdf8b01adfbc7731112e58214c94c1
Instruction Fuzzy Hash: DF012B37BC03096BE32ADAE4AC41FB7B39C9B10719F440B3AF90C56981E7F59501E1A2

Function 120216C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A3,00000043,.\ssl\ssl_lib.c,000003CE), ref: 120216DB
ERR_put_error.LIBEAY32(00000014,000000A3,000000B1,.\ssl\ssl_lib.c,000003D2), ref: 12021706

Strings

.\ssl\ssl_lib.c, xrefs: 120216CD, 120216F5, 1202171D, 12021744

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 1767461275-3333140318
Opcode ID: cc971ea4c4b81b828ef8fb31f0070cc65acb4fc732c021c0a035ba55777339b8
Instruction ID: 4bc255cea6be6b60c1315d2b2c157675331c079b9c4e1cec2ed2da182517faf3
Opcode Fuzzy Hash: cc971ea4c4b81b828ef8fb31f0070cc65acb4fc732c021c0a035ba55777339b8
Instruction Fuzzy Hash: 4901B97A7C13017FFA52E720DC96F4672A05B45F06F4542B4B609BF1D3FAE0A650B112

Function 12026AB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(000000F4,.\ssl\ssl_sess.c,000000C4), ref: 12026AC1
ERR_put_error.LIBEAY32(00000014,000000BD,00000041,.\ssl\ssl_sess.c,000000C6), ref: 12026AE4
_memset.LIBCMT ref: 12026AF8
__time64.LIBCMT ref: 12026B19
CRYPTO_new_ex_data.LIBEAY32(00000003,00000000,000000C0), ref: 12026B5E

Strings

.\ssl\ssl_sess.c, xrefs: 12026AB7, 12026AD6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocO_new_ex_dataR_put_error__time64_memset
String ID: .\ssl\ssl_sess.c
API String ID: 2599803518-1959455021
Opcode ID: 245eca4cfa52361e2f70d522c4b658ccdbdd38dcc17e1e64cfef45d0f9876e66
Instruction ID: 8d840d432c7be8266541732587be4cff77ce28672ad3a5c9e7c557bf16410c98
Opcode Fuzzy Hash: 245eca4cfa52361e2f70d522c4b658ccdbdd38dcc17e1e64cfef45d0f9876e66
Instruction Fuzzy Hash: 69112472A41701AEE371DF6A9C01FD7FAE8AF91741F01462FE5AE97250D7B024409B61

Function 110A3060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

BIO_printf.LIBEAY32(?,%*s<Parse Error>,?,110F1DCF,110A3191), ref: 110A3090

Part of subcall function 110655A0: BIO_vprintf.LIBEAY32(?,?,?,11003678,?,%ld bytes leaked in %d chunks,?,?), ref: 110655AF

BIO_printf.LIBEAY32(?,%*s<Not Supported>,?,110F1DCF,110A3191), ref: 110A30A4
ASN1_parse_dump.LIBEAY32(?,?,?,?,000000FF,110A3191,?,00000001), ref: 110A30C3
BIO_dump_indent.LIBEAY32(?,?,?,?,110A3191,?,00000001), ref: 110A30E5

Strings

%*s<Not Supported>, xrefs: 110A309E
%*s<Parse Error>, xrefs: 110A308A

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_printf$N1_parse_dumpO_dump_indentO_vprintf
String ID: %*s<Not Supported>$%*s<Parse Error>
API String ID: 3537796854-2906783721
Opcode ID: 96c5ea0dca6718ef328e125da59cdd8bc9822ff6fe8f4a5763ffca51da205794
Instruction ID: 24be8d1afd6d69400017a19639ec61e6cc6c4a991b35d67c82be123c7ed9054c
Opcode Fuzzy Hash: 96c5ea0dca6718ef328e125da59cdd8bc9822ff6fe8f4a5763ffca51da205794
Instruction Fuzzy Hash: D401DFB8E182016FE704D768DC90F6773E8D784300FC44AE8F409CA265E169E880D221

Function 12025890 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32 ref: 12025893
sk_num.LIBEAY32(?), ref: 120258A1
sk_value.LIBEAY32(?,00000000), ref: 120258B2
X509_NAME_dup.LIBEAY32(00000000,?,00000000), ref: 120258B8
sk_push.LIBEAY32(00000000,00000000), ref: 120258C6
sk_num.LIBEAY32(?), ref: 120258D4
sk_pop_free.LIBEAY32(00000000,Function_00031824), ref: 120258EC

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$E_dupX509_sk_new_nullsk_pop_freesk_pushsk_value
String ID:
API String ID: 1341318936-0
Opcode ID: 5e3f7e0630535a8628c646de6ac5db0835a6bafcee4822078b7f9fa52895c244
Instruction ID: fc322f15f3e020f4c590b440cbc25d95d19415dad372316298a0810d7f4e05d3
Opcode Fuzzy Hash: 5e3f7e0630535a8628c646de6ac5db0835a6bafcee4822078b7f9fa52895c244
Instruction Fuzzy Hash: E5F059D7A001102BAA53D6B53C41AFFD2BC8A982A7B49073AFC03D1101F616E90672F2

Function 110B5080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(0000000E,0000006D,0000006A,.\crypto\conf\conf_lib.c,00000141,00000000,?,?), ref: 110B50B2

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(0000000E,0000006D,0000006C,.\crypto\conf\conf_lib.c,00000144,00000000,?,?), ref: 110B50D0
ERR_add_error_data.LIBEAY32(00000004,group=,00000000, name=,?,0000000E,0000006D,0000006C,.\crypto\conf\conf_lib.c,00000144,00000000,?,?), ref: 110B50E3

Strings

name=, xrefs: 110B50D6
.\crypto\conf\conf_lib.c, xrefs: 110B50A7, 110B50C5
group=, xrefs: 110B50DC

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_add_error_dataR_get_state
String ID: name=$.\crypto\conf\conf_lib.c$group=
API String ID: 3368339639-4159775504
Opcode ID: 9b0e2a6ff818b78f86b92d914ab8643aced4acd8d5a09454140cc1242d6dc030
Instruction ID: f58622ab7e734bdc916a17fb0bcc8824157fd7030b3dde5da2c9336ee2b969f6
Opcode Fuzzy Hash: 9b0e2a6ff818b78f86b92d914ab8643aced4acd8d5a09454140cc1242d6dc030
Instruction Fuzzy Hash: 5EF0B46BF8135137F110D1666C42F8B935C9B94B69F004466FF08BE0C2E1B2941082B1

Function 110AF1C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 110AF1C6
OBJ_obj2nid.LIBEAY32(00000000,?), ref: 110AF1CC
ERR_put_error.LIBEAY32(0000002E,0000006D,0000008F,.\crypto\cms\cms_smime.c,00000091), ref: 110AF1EC

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

CMS_dataInit.LIBEAY32(?,00000000), ref: 110AF1FC

Strings

.\crypto\cms\cms_smime.c, xrefs: 110AF1DE

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: InitJ_obj2nidO_freeR_get_stateR_put_errorS_datapqueue_peek
String ID: .\crypto\cms\cms_smime.c
API String ID: 3675999548-2159935803
Opcode ID: 4feecb0a41779880ee08722b1978349738b7580f6d3074917d930cf82c75cca8
Instruction ID: 100217807857128e300e0f6ddc2f8d5f5bfdb1ec61b522be63ef90fcba52e888
Opcode Fuzzy Hash: 4feecb0a41779880ee08722b1978349738b7580f6d3074917d930cf82c75cca8
Instruction Fuzzy Hash: 21F0B43BF8421222D410E1B87C41F8FB29C5B95569F450466F644E7285E9A0B841C2F2

Function 120271D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

ENGINE_init.LIBEAY32(?), ref: 120271D6
ERR_put_error.LIBEAY32(00000014,00000122,00000026,.\ssl\ssl_sess.c,000004E9), ref: 120271F5
TS_RESP_CTX_get_tst_info.LIBEAY32(?), ref: 12027202
ERR_put_error.LIBEAY32(00000014,00000122,0000014B,.\ssl\ssl_sess.c,000004EE), ref: 12027224
ENGINE_finish.LIBEAY32(?,00000014,00000122,0000014B,.\ssl\ssl_sess.c,000004EE), ref: 1202722A

Strings

.\ssl\ssl_sess.c, xrefs: 120271E7, 12027213

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$E_finishE_initX_get_tst_info
String ID: .\ssl\ssl_sess.c
API String ID: 2432500166-1959455021
Opcode ID: 3e491420cc3b1d4df9c5c1c2e9b91696d00d76d4c1cc408c0b1c751029fa0774
Instruction ID: 85d2b0a3e6194ce1d142a27a22298e61a95e3edc76cabd17257b1d36e6205494
Opcode Fuzzy Hash: 3e491420cc3b1d4df9c5c1c2e9b91696d00d76d4c1cc408c0b1c751029fa0774
Instruction Fuzzy Hash: C3F02E77BC52517EF693E7287C02FCE61944F18712F0181B1FA05AA1D1F664D51121E2

Function 120211E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBEAY32 ref: 120211E4
BIO_new.LIBEAY32(00000000), ref: 120211EA
ERR_put_error.LIBEAY32(00000014,000000C0,00000007,.\ssl\ssl_lib.c,000002E4), ref: 1202120B
BIO_int_ctrl.LIBEAY32(00000000,00000068,00000000,?), ref: 12021222
SSL_set_bio.SSLEAY32(?,00000000,00000000,00000000,00000068,00000000,?), ref: 1202122E

Strings

.\ssl\ssl_lib.c, xrefs: 120211FD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_set_bioO_int_ctrlO_newO_s_socketR_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 932530507-3333140318
Opcode ID: a8d515a9b8eaceb384038e98f318a96b395f571631e221388fc90a499ed5683c
Instruction ID: 954d072f34fb27257f0d66dde4830eea104fcf77655bee2f005971cd79d269d1
Opcode Fuzzy Hash: a8d515a9b8eaceb384038e98f318a96b395f571631e221388fc90a499ed5683c
Instruction Fuzzy Hash: 3CF0EC7BBC531037E6B2E3156C01FEF95588FC1722F050725F608AB1C1D555A81591F1

Function 110A70C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

ASN1_STRING_type_new.LIBEAY32(00000002), ref: 110A70C3

Part of subcall function 1108F9F0: CRYPTO_malloc.LIBEAY32(00000010,.\crypto\asn1\asn1_lib.c,0000019C,11087121,?,?,?,?,?,11087C40,?,?,?,?,?,?), ref: 1108F9FC
Part of subcall function 1108F9F0: ERR_put_error.LIBEAY32(0000000D,00000082,00000041,.\crypto\asn1\asn1_lib.c,0000019E,?,?,?,?,00000000,11081619,00000000,?,00000000,1110DA10,110446BA), ref: 1108FA1D

ASN1_INTEGER_set.LIBEAY32(00000000,?), ref: 110A70D7

Part of subcall function 1107D570: CRYPTO_free.LIBEAY32(00000000,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D59E
Part of subcall function 1107D570: CRYPTO_malloc.LIBEAY32(00000005,.\crypto\asn1\a_int.c,00000164,00000000,11057551,00000000,?,?,?,?,?,?,?,?,11057C52,00000000), ref: 1107D5B2
Part of subcall function 1107D570: ERR_put_error.LIBEAY32(0000000D,00000076,00000041,.\crypto\asn1\a_int.c,00000168,00000000,11057551,00000000,?), ref: 1107D5DE

SXNET_add_id_INTEGER.LIBEAY32(?,00000000,?,?), ref: 110A70F3

Part of subcall function 110A6E20: ERR_put_error.LIBEAY32(00000022,0000007E,00000084,.\crypto\x509v3\v3_sxnet.c,000000C4), ref: 110A6E76

ERR_put_error.LIBEAY32(00000022,0000007F,00000041,.\crypto\x509v3\v3_sxnet.c,000000AA), ref: 110A710D
ASN1_STRING_free.LIBEAY32(00000000,00000022,0000007F,00000041,.\crypto\x509v3\v3_sxnet.c,000000AA), ref: 110A7113

Strings

.\crypto\x509v3\v3_sxnet.c, xrefs: 110A7102

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_malloc$G_freeG_type_newO_freeR_setT_add_id_
String ID: .\crypto\x509v3\v3_sxnet.c
API String ID: 661017014-1855245706
Opcode ID: 78eee5fdfb7c0f0a60913a7f27f7a87a77d95f773c2c4f1ed308844177788f67
Instruction ID: 432e128031f5027c65a5323fc592158218c180dc414a92448de1ab0ddbc6bfeb
Opcode Fuzzy Hash: 78eee5fdfb7c0f0a60913a7f27f7a87a77d95f773c2c4f1ed308844177788f67
Instruction Fuzzy Hash: 40F0A7A9E4832237E510E2B8FC02FEB769C8F91B14F004558FE595A2C6E665A941C2F7

Function 120166C0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

EVP_md5.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 120166F4
EVP_sha1.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 120166FB
EVP_sha224.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 12016702
EVP_sha256.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 12016709
EVP_sha384.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 12016710
EVP_sha512.LIBEAY32(?,00000000,?,?,1201687D,00000000,?,?), ref: 12016717

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_md5P_sha1P_sha224P_sha256P_sha384P_sha512
String ID:
API String ID: 840344691-0
Opcode ID: c51c4a20835f35bbbeacb8b974d9017f39553c827757c868054468246688c00e
Instruction ID: e43b94a24add930f3a8caec06bcd24f6324406dd6babb39c35c82a75bc322922
Opcode Fuzzy Hash: c51c4a20835f35bbbeacb8b974d9017f39553c827757c868054468246688c00e
Instruction Fuzzy Hash: E621E73B90C3578EC706DF38AC580AAFBF5EF56215B09876BD4968A201D516E405FB12

Function 12013B70 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

X509_TRUST_get_flags.LIBEAY32(?,00000000,?,12013DA9,?,?,?,?), ref: 12013B7F
pqueue_peek.LIBEAY32(00000000,?), ref: 12013B8E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: T_get_flagsX509_pqueue_peek
String ID:
API String ID: 2476680759-0
Opcode ID: 37c5cd877345b6a6d91b305cf57bcf5bf22023f24f14351293b9c8df7fd61f5c
Instruction ID: 582b4c00c50f6553624d4c81c002b67afd198a14f0ac217934f5206666e1bd08
Opcode Fuzzy Hash: 37c5cd877345b6a6d91b305cf57bcf5bf22023f24f14351293b9c8df7fd61f5c
Instruction Fuzzy Hash: 981159779043554AE723A77C38417DB77ED4F91235F08077AEC4DCE282F655E090A2A2

Function 110991F0 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

X509v3_get_ext_by_NID.LIBEAY32(?,?,000000FF,?,?,110840A5,?), ref: 1109921B

Part of subcall function 1109D8E0: OBJ_nid2obj.LIBEAY32(?,11099220,?,?,000000FF,?,?,110840A5,?), ref: 1109D8E5

X509v3_get_ext.LIBEAY32(?,00000000), ref: 1109923C
sk_num.LIBEAY32(?), ref: 11099255
sk_value.LIBEAY32(?,00000000), ref: 11099267
X509_EXTENSIONS_it.LIBEAY32 ref: 11099284
ASN1_item_d2i.LIBEAY32(00000000,?,00000000,00000000), ref: 11099297

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: J_nid2objN1_item_d2iS_itX509_X509v3_get_extX509v3_get_ext_by_sk_numsk_value
String ID:
API String ID: 3818806928-0
Opcode ID: 0000b26f7b3901593dfcd6577dc90d4af1c5c3409f962ff2bd0eb1313374aaf8
Instruction ID: abdba14503e06a325d8396a7aba5f39940c5372049fc06fdf5a85aa7dd47caca
Opcode Fuzzy Hash: 0000b26f7b3901593dfcd6577dc90d4af1c5c3409f962ff2bd0eb1313374aaf8
Instruction Fuzzy Hash: D7219376D002079FD320CE64E851B5BB3E4AF44724F154999E8AD97391F734F881DBA1

Function 12030D80 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

SRP_get_default_gN.LIBEAY32(?), ref: 12030D86
BN_dup.LIBEAY32(?), ref: 12030D9F
BN_dup.LIBEAY32(?,?), ref: 12030DB2
BN_clear_free.LIBEAY32(00000000), ref: 12030DCD
BN_clear_free.LIBEAY32(?), ref: 12030DEC
SRP_create_verifier_BN.LIBEAY32(?,?,?,?,?,?), ref: 12030E0E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_clear_freeN_dup$P_create_verifier_P_get_default_g
String ID:
API String ID: 1988882276-0
Opcode ID: 32d26cade50512f15c42b0af459e53e1a1bd1b1133aff8cc6bc66c5ff083c176
Instruction ID: fa8b9b273e030285dfd44678f901f11b5338675af188de7893c086ebaa90ab2e
Opcode Fuzzy Hash: 32d26cade50512f15c42b0af459e53e1a1bd1b1133aff8cc6bc66c5ff083c176
Instruction Fuzzy Hash: D2117CF69046026FD742CB68DC84BA7B7E8AF99311F040B18F85983240EB35F800D7A2

Function 120300F0 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

BIO_new.LIBEAY32(1204EB80), ref: 120300F6
SSL_new.SSLEAY32(?), ref: 1203010C
BIO_free.LIBEAY32(00000000), ref: 1203011B

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_newO_freeO_new
String ID:
API String ID: 734362856-0
Opcode ID: 7579559ab48bde2c8d6e17fd34ac340e0ad260fdf10ef7828621eb40fcae770f
Instruction ID: 9fb50ff7374095eca92f78fdac9dc1b6d57b43106ebef92c004bf1aa439abfb6
Opcode Fuzzy Hash: 7579559ab48bde2c8d6e17fd34ac340e0ad260fdf10ef7828621eb40fcae770f
Instruction Fuzzy Hash: 59F0277FE451502BE263D1A87C04BEF21F98BC2372F490776F84496200E554A085A1E3

Function 12023440 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cleanup.LIBEAY32(?,00000000,?,12023E79,?), ref: 12023453
CRYPTO_free.LIBEAY32(?,?,00000000,?,12023E79,?), ref: 1202345F
EVP_CIPHER_CTX_cleanup.LIBEAY32(?,00000000,?,12023E79,?), ref: 12023478
CRYPTO_free.LIBEAY32(?,?,00000000,?,12023E79,?), ref: 12023484
COMP_CTX_free.LIBEAY32(?,00000000,?,12023E79,?), ref: 1202349D
COMP_CTX_free.LIBEAY32(?,00000000,?,12023E79,?), ref: 120234B6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeX_cleanupX_free
String ID:
API String ID: 3039540735-0
Opcode ID: 128ad2ee08554fff0d5d08ed8db3458fbe38066493a861c8a6124f12910a7834
Instruction ID: c1fcce53d5db6aa96d85c3b7a26a990f0b84f606d3ef06ec8b5aa912f43bf31e
Opcode Fuzzy Hash: 128ad2ee08554fff0d5d08ed8db3458fbe38066493a861c8a6124f12910a7834
Instruction Fuzzy Hash: 720136B7A007009BD652DB799C40B97F3F9BF85201F548E1AE4DED3200DA35F4555720

Function 12030280 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_f_buffer.LIBEAY32 ref: 12030281
BIO_new.LIBEAY32(00000000), ref: 12030287
BIO_new_ssl_connect.SSLEAY32(?), ref: 1203029D
BIO_push.LIBEAY32(00000000,00000000), ref: 120302AD
BIO_free.LIBEAY32(00000000), ref: 120302BA
BIO_free.LIBEAY32(00000000), ref: 120302C7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$O_f_bufferO_newO_new_ssl_connectO_push
String ID:
API String ID: 1386671907-0
Opcode ID: 9385872424cf31bf3e0a11a246b1fc11031a5aace8355a37a2d3386fc0bab6f2
Instruction ID: ca8236f23b7c96f7ec5a44487d6d90d37ca3ed6548ac94bd1a19f4a1f73cf0fd
Opcode Fuzzy Hash: 9385872424cf31bf3e0a11a246b1fc11031a5aace8355a37a2d3386fc0bab6f2
Instruction Fuzzy Hash: B1E065ABD025111AD593D2747C046FF55E95C85AA3F090734EC08A3604F618E55572E3

Function 1201C7C0 Relevance: 9.0, APIs: 6, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 1200A830: CRYPTO_free.LIBEAY32(?), ref: 1200A888
Part of subcall function 1200A830: DH_free.LIBEAY32(?), ref: 1200A89E
Part of subcall function 1200A830: EC_KEY_free.LIBEAY32(?), ref: 1200A8B4
Part of subcall function 1200A830: sk_pop_free.LIBEAY32(?,Function_00031824), ref: 1200A8CF
Part of subcall function 1200A830: BIO_free.LIBEAY32(?), ref: 1200A8E5
Part of subcall function 1200A830: CRYPTO_free.LIBEAY32(?), ref: 1200A910
Part of subcall function 1200A830: SSL_SRP_CTX_free.SSLEAY32(?), ref: 1200A919
Part of subcall function 1200A830: OPENSSL_cleanse.LIBEAY32(?,0000042C,?), ref: 1200A927
Part of subcall function 1200A830: CRYPTO_free.LIBEAY32(?,?,0000042C,?), ref: 1200A930

Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?), ref: 1201C6BB
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C6DB
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C6E7
Part of subcall function 1201C6B0: pqueue_free.LIBEAY32(00000000,?), ref: 1201C6ED
Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C6FC
Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?), ref: 1201C714
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C72D
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C739
Part of subcall function 1201C6B0: pqueue_free.LIBEAY32(00000000,?), ref: 1201C73F
Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C74E
Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?), ref: 1201C766
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C77F
Part of subcall function 1201C6B0: CRYPTO_free.LIBEAY32(?), ref: 1201C78B
Part of subcall function 1201C6B0: pqueue_free.LIBEAY32(00000000,?), ref: 1201C791
Part of subcall function 1201C6B0: pqueue_pop.LIBEAY32(?,00000000,?), ref: 1201C7A0

pqueue_free.LIBEAY32(?,?), ref: 1201C7DA
pqueue_free.LIBEAY32(?,?,?), ref: 1201C7E9
pqueue_free.LIBEAY32(?,?,?,?), ref: 1201C7F8
pqueue_free.LIBEAY32(?,?,?,?,?), ref: 1201C807
pqueue_free.LIBEAY32(?,?,?,?,?,?), ref: 1201C816
CRYPTO_free.LIBEAY32(?,?,?,?,?,?,?), ref: 1201C81F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$pqueue_free$pqueue_pop$H_freeL_cleanseX_freeY_freesk_pop_free
String ID:
API String ID: 1174799547-0
Opcode ID: 7fea8edd81a9ebe9906e84419a445e313289bd788d268d2f63777b0fa0d6c220
Instruction ID: 330727595836c5f357c90b7cd160d052723eb0877e6f69db4d5702738bb47a15
Opcode Fuzzy Hash: 7fea8edd81a9ebe9906e84419a445e313289bd788d268d2f63777b0fa0d6c220
Instruction Fuzzy Hash: 6EF0FF7B200645BFC245DB68C484EAEF375BF8C305F04475AA5548F700CB38F8929B90

Function 1200DE90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

.\ssl\s3_pkt.c, xrefs: 1200DFDC, 1200E086

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_pkt.c
API String ID: 1767461275-4041216366
Opcode ID: 99b49342c91dc40c4b9818170bdb9d5cff946639ef5a61edc81a1346a7a74d8c
Instruction ID: dacb147d0e346c0839a43b68682e552cfbf1d6dc022a00af5e68da5a32773893
Opcode Fuzzy Hash: 99b49342c91dc40c4b9818170bdb9d5cff946639ef5a61edc81a1346a7a74d8c
Instruction Fuzzy Hash: 5481B572A043459FE701CF29D884BAEB7E0FF447A9F048729F8889B240D374E954DB95

Function 12016E70 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

OBJ_sn2nid.LIBEAY32(00000001), ref: 12016F8F
OBJ_ln2nid.LIBEAY32(00000001), ref: 12016F9C

Strings

DSA, xrefs: 12016F1F
ECDSA, xrefs: 12016F56
RSA, xrefs: 12016EE3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: J_ln2nidJ_sn2nid
String ID: DSA$ECDSA$RSA
API String ID: 1214796006-3559535724
Opcode ID: 4eeba2f5c1f617efddc5913e240b47ae8e4a36acf972ff3d787a104cdee9ea5d
Instruction ID: ac587e24bca9059a6dbb13d46f74b9285d385406f1f1e62849d1d9c0e04d10bf
Opcode Fuzzy Hash: 4eeba2f5c1f617efddc5913e240b47ae8e4a36acf972ff3d787a104cdee9ea5d
Instruction Fuzzy Hash: DA51F6736082824FC702CF34CC957EABBE6AF46254F894BADD8858F251E722D50DD792

Function 1201F670 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000013,.\ssl\d1_both.c,000005C5,?,00000000,?,?,1201E7BE,?), ref: 1201F716
RAND_bytes.LIBEAY32(-00000001,00000010,-00000001,?,00000000), ref: 1201F749
CRYPTO_free.LIBEAY32(00000000), ref: 1201F756
CRYPTO_free.LIBEAY32(00000000), ref: 1201F799

Strings

.\ssl\d1_both.c, xrefs: 1201F710

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$D_bytesO_malloc
String ID: .\ssl\d1_both.c
API String ID: 3362793431-2895748750
Opcode ID: 0bb8b6fce83826bd9d2292bd6984754073ca1c17272ba881f76008b4d5973311
Instruction ID: 68d4fc7de3511ed3aba3f7b0cf972d3c4b3fde74009bc2d4324090261cb0b7d8
Opcode Fuzzy Hash: 0bb8b6fce83826bd9d2292bd6984754073ca1c17272ba881f76008b4d5973311
Instruction Fuzzy Hash: DE4178737003452FE311CA299C84FEBB7E8EFD5321F14466EF9568B242EB65E145A3A0

Function 12016B80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000013,.\ssl\t1_lib.c,00000FAC,00000001,00000000,?,?,1200F0EB,?), ref: 12016C14
RAND_bytes.LIBEAY32(-00000001,00000010,-00000001,?,00000000), ref: 12016C47
CRYPTO_free.LIBEAY32(00000000), ref: 12016C54

Strings

.\ssl\t1_lib.c, xrefs: 12016C0A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: D_bytesO_freeO_malloc
String ID: .\ssl\t1_lib.c
API String ID: 693915670-2047370388
Opcode ID: d9cdb674cdf56630bb81b835c08721b5a24dd1d71dad62f2be2f8d1376e2d156
Instruction ID: 50b69d7b2c92cd59383d2f144f07b1a8a65f56f8a35b0731ead8028eb8af52f7
Opcode Fuzzy Hash: d9cdb674cdf56630bb81b835c08721b5a24dd1d71dad62f2be2f8d1376e2d156
Instruction Fuzzy Hash: 554167737403412FE311CE6A8C80FF7B7E9EB85321F14467DE89687282EA65F541A7A0

Function 12023700 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 120251E0: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000D,.\ssl\ssl_cert.c,000001CC,?,120215E6,?), ref: 12025202
Part of subcall function 120251E0: RSA_free.LIBEAY32(?), ref: 1202521A
Part of subcall function 120251E0: DH_free.LIBEAY32(?), ref: 1202522A
Part of subcall function 120251E0: EC_KEY_free.LIBEAY32(?), ref: 1202523A
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 12025256
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 12025269
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 1202527C
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 1202528F
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 120252A2
Part of subcall function 120251E0: X509_STORE_free.LIBEAY32(?), ref: 120252B5
Part of subcall function 120251E0: X509_STORE_free.LIBEAY32(?), ref: 120252C8
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 120252DB
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 12025309
Part of subcall function 120251E0: CRYPTO_free.LIBEAY32(?), ref: 12025312

OpenSSLDie.LIBEAY32(.\ssl\ssl_lib.c,00000C88,ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)), ref: 12023824
CRYPTO_add_lock.LIBEAY32(?,00000001,0000000C,.\ssl\ssl_lib.c,00000C97), ref: 120238C4
SSL_CTX_free.SSLEAY32(?), ref: 120238D7

Strings

.\ssl\ssl_lib.c, xrefs: 1202381F, 120238B7
ssl->sid_ctx_length <= sizeof(ssl->sid_ctx), xrefs: 12023815

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$E_freeO_add_lockX509_$A_freeH_freeOpenX_freeY_free
String ID: .\ssl\ssl_lib.c$ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)
API String ID: 1178812457-169164205
Opcode ID: 204fb72dded218867fefd460425b1c620f38db1327bacf30a5d33abc60c27cc7
Instruction ID: 037bb8bb6608b3fe6754601c15a3605637b883e99c1ef1793b8a78ee7cc9b36c
Opcode Fuzzy Hash: 204fb72dded218867fefd460425b1c620f38db1327bacf30a5d33abc60c27cc7
Instruction Fuzzy Hash: BF516E76A007418BD715CF24C884BE6B7E2AB88314F9846BADD8E8F706DB31B445DB50

Function 12028E40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_ciph.c,00000463,?,?,?,?,12029A61,?,?), ref: 12028E8A
ERR_put_error.LIBEAY32(00000014,000000E7,00000041,.\ssl\ssl_ciph.c,00000465,12029A61,?,?), ref: 12028EAF
_memset.LIBCMT ref: 12028EC5
CRYPTO_free.LIBEAY32(00000000,?,?,?,12029A61,?,?), ref: 12028F98

Strings

.\ssl\ssl_ciph.c, xrefs: 12028E84, 12028EA1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_mallocR_put_error_memset
String ID: .\ssl\ssl_ciph.c
API String ID: 1240099157-2955601352
Opcode ID: bffbc454a1a0c6a979f74da89b6834266ce6e5bfff98e1d27cf4cb815a735cdb
Instruction ID: 94c1774ef3e576c27e5c8aea8de42ec3c30e76490b5383d1ac745ab67fc2900b
Opcode Fuzzy Hash: bffbc454a1a0c6a979f74da89b6834266ce6e5bfff98e1d27cf4cb815a735cdb
Instruction Fuzzy Hash: 7C41BE7A6003068FDB41CF05C880B96B3E1FF84714F85466EF9059B352E774EA44DBA1

Function 12017000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,00001077,?,?,12018818,?,?,?,?), ref: 1201701A

Strings

.\ssl\t1_lib.c, xrefs: 12017014

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_malloc
String ID: .\ssl\t1_lib.c
API String ID: 1457121658-2047370388
Opcode ID: b48f38b41f5693ddb7503d6670f5d46b46c979f27540ecfa476b16b46000907b
Instruction ID: e515bd0576c17757fa2dab8ba26ac215cf4ec14c0a57e6f7105970f953c590a7
Opcode Fuzzy Hash: b48f38b41f5693ddb7503d6670f5d46b46c979f27540ecfa476b16b46000907b
Instruction Fuzzy Hash: 3D310573A45304CBD326DA7998807D7B3E4EB44335F214B6DE4AA8B2A0E732F855A641

Function 12030390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000012C,00000150,.\ssl\t1_reneg.c,0000009A,12017F5D,?,?,?,?), ref: 120303AF
ERR_put_error.LIBEAY32(00000014,0000012C,00000150,.\ssl\t1_reneg.c,000000A4,?,12017F5D,?,?,?,?), ref: 120303E9

Strings

.\ssl\t1_reneg.c, xrefs: 1203039E, 120303D8, 12030417, 12030493

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\t1_reneg.c
API String ID: 1767461275-257427055
Opcode ID: 6123bd6ade6f85395bbf3f65b031b9878f7e9720cff5d7d51cfc70fe828144c8
Instruction ID: 9c2e68dd759e825e02742857326cba45a725995c737dab2df7dc65b61433582d
Opcode Fuzzy Hash: 6123bd6ade6f85395bbf3f65b031b9878f7e9720cff5d7d51cfc70fe828144c8
Instruction Fuzzy Hash: B6312C723442816FE703CB24CC41BE9B7D39B41719F1946B8E2866F1D2C2B2E5429291

Function 12020920 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000,00000000,?,00000010,12014B12,00000000,00000000,?,00000000), ref: 12020950
ERR_put_error.LIBEAY32(00000014,00000133,00000162,.\ssl\d1_srtp.c,000000FE,00000000), ref: 12020980
ERR_put_error.LIBEAY32(00000014,00000133,0000016B,.\ssl\d1_srtp.c,00000104,00000000), ref: 120209B1
sk_value.LIBEAY32(00000000,00000000,?,00000000), ref: 120209DA

Strings

.\ssl\d1_srtp.c, xrefs: 1202096F, 120209A0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$sk_numsk_value
String ID: .\ssl\d1_srtp.c
API String ID: 2202921107-3998674507
Opcode ID: 36f9d7f7bde02044b2a620d494357e162e8becca0655b84975073367496d487b
Instruction ID: 545b5d237abca2fd541e5163196efe81b075513140ccaf2afab0e8cddb78e386
Opcode Fuzzy Hash: 36f9d7f7bde02044b2a620d494357e162e8becca0655b84975073367496d487b
Instruction Fuzzy Hash: 702166B32453479FE712CF5888C0FE6B7D68F31704F4A41BAE98AAB242E651E5049361

Function 1200E1A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,80000000,?,?,1200FE5E,?,?,?,?,?,?,?,?,?,000021D1), ref: 1200E1F2
BIO_write.LIBEAY32(?,?,?), ref: 1200E217
ERR_put_error.LIBEAY32(00000014,0000009F,00000080,.\ssl\s3_pkt.c,0000045C,?,?,?,?,?,000021D1), ref: 1200E237
ERR_put_error.LIBEAY32(00000014,0000009F,0000007F,.\ssl\s3_pkt.c,00000450,?,?,1200FE5E,?,?,?,?), ref: 1200E2B1

Strings

.\ssl\s3_pkt.c, xrefs: 1200E226, 1200E2A3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$ErrorLastO_write
String ID: .\ssl\s3_pkt.c
API String ID: 3621644563-4041216366
Opcode ID: df6b7d06844b665a44307542f409ce5ac7d041462ec624a9352ef2864dbaf1f6
Instruction ID: b944f24630123a6378ceec5d2140882260de2b2ea93ab25e43353bf5893e55fb
Opcode Fuzzy Hash: df6b7d06844b665a44307542f409ce5ac7d041462ec624a9352ef2864dbaf1f6
Instruction Fuzzy Hash: BA31D2722047029BF351CB24D881BE6B7E1BF54715F118B2CEAAA572C2D7B0BC84D794

Function 12020F50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 12020FD1
CRYPTO_lock.LIBEAY32(00000005,0000000C,.\ssl\ssl_lib.c,000001FF), ref: 12020FEF
lh_retrieve.LIBEAY32(?,?,00000005,0000000C,.\ssl\ssl_lib.c,000001FF), ref: 12021003
CRYPTO_lock.LIBEAY32(00000006,0000000C,.\ssl\ssl_lib.c,00000201,?,?,00000005,0000000C,.\ssl\ssl_lib.c,000001FF), ref: 12021018

Strings

.\ssl\ssl_lib.c, xrefs: 12020FE6, 1202100D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$_memsetlh_retrieve
String ID: .\ssl\ssl_lib.c
API String ID: 1481356268-3333140318
Opcode ID: c4a01c5996e0a1652ad06119533a30143d3d52029d7e5d5447e3b03ea9757537
Instruction ID: a933285ce7ef1ba3d62a5312eafe32416f5ff42ef6a15fbf99bdaee5c460927f
Opcode Fuzzy Hash: c4a01c5996e0a1652ad06119533a30143d3d52029d7e5d5447e3b03ea9757537
Instruction Fuzzy Hash: 6921F6776443416FD374DB64CC41FEFB7E1AF88701F404A2EE5559B580EAB0A840A782

Function 12021560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

SSL_get_session.SSLEAY32(?), ref: 12021567
SSL_set_session.SSLEAY32(?,00000000,?), ref: 12021572

Part of subcall function 12026D50: ERR_put_error.LIBEAY32(00000014,000000C3,000000F0,.\ssl\ssl_sess.c,00000396), ref: 12026DA1

CRYPTO_add_lock.LIBEAY32(?,00000001,0000000D,.\ssl\ssl_lib.c,000003AF), ref: 120215BC
ERR_put_error.LIBEAY32(00000014,000000DA,00000111,.\ssl\ssl_lib.c,000001C8), ref: 1202160B

Strings

.\ssl\ssl_lib.c, xrefs: 120215AD, 120215FA

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$L_get_sessionL_set_sessionO_add_lock
String ID: .\ssl\ssl_lib.c
API String ID: 2263800678-3333140318
Opcode ID: 8df3c9fd67fac26a625f6cdeb09877e26e3eccb345d89ead37b9d3fb1270e8d7
Instruction ID: fe04222500fed6830a28c9f554b229048cd592721ec27bf7c48ab5afed1a376c
Opcode Fuzzy Hash: 8df3c9fd67fac26a625f6cdeb09877e26e3eccb345d89ead37b9d3fb1270e8d7
Instruction Fuzzy Hash: 2D11217BB00200AFE241CB65DC81FDBF3E8AF45300F45852AE61E9B242DB20B44097A1

Function 12025EE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

i2d_X509.LIBEAY32(00000000,00000000,?,00000000,12026123,?,?,00000000,?,?,00000000), ref: 12025EF3
BUF_MEM_grow_clean.LIBEAY32(12026123,00000003,?,00000000,?,?,00000000), ref: 12025F09
i2d_X509.LIBEAY32(00000000), ref: 12025F43
ERR_put_error.LIBEAY32(00000014,0000013F,00000007,.\ssl\ssl_cert.c,00000426,?,00000000,?,?,00000000), ref: 12025F77

Strings

.\ssl\ssl_cert.c, xrefs: 12025F69

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509i2d_$M_grow_cleanR_put_error
String ID: .\ssl\ssl_cert.c
API String ID: 1887697227-3404700246
Opcode ID: b0bd9676ada2f854bece22dd39292466a3a952a2ef85e06f475e2ff3c975da79
Instruction ID: 98acc91ce1a0bdf44b607257f451c64f62ba45cbd46775d5ac4964ddf33ac0b9
Opcode Fuzzy Hash: b0bd9676ada2f854bece22dd39292466a3a952a2ef85e06f475e2ff3c975da79
Instruction Fuzzy Hash: 18112973648301AFE741CF58DC81B66F7E4DF54306F58862DF9898B281E661F804D722

Function 12011978 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

EVP_DigestUpdate.LIBEAY32(?,?,00000080), ref: 1201199E
EVP_DigestUpdate.LIBEAY32(?,?,?), ref: 120119BF
EVP_DigestFinal.LIBEAY32(?,?,?), ref: 120119E1
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 120119FC

Strings

j, xrefs: 12011980

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Digest$Update$FinalX_cleanup
String ID: j
API String ID: 720808286-2137352139
Opcode ID: f23b8dd6454efa5d743eb282281d38fba9fd7c48253507ff5d0ed689a2202ddb
Instruction ID: c550d3b8687353c4049f2b2270fd68911430fbdfe214ee4a2e23c72f07b331ba
Opcode Fuzzy Hash: f23b8dd6454efa5d743eb282281d38fba9fd7c48253507ff5d0ed689a2202ddb
Instruction Fuzzy Hash: B211A5B72083409BD36AD764D880BFFF3A9ABC5341F044E1DE9A68A104EA31E10CDB52

Function 1107D070 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OPENSSL_gmtime.LIBEAY32(?,?), ref: 1107D093

Part of subcall function 11004540: __localtime64.LIBCMT ref: 11004545

ERR_put_error.LIBEAY32(0000000D,000000D9,000000AD,.\crypto\asn1\a_time.c,00000073), ref: 1107D0B2

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ASN1_UTCTIME_adj.LIBEAY32(?,?,?,00000000,00000000), ref: 1107D0E1

Strings

.\crypto\asn1\a_time.c, xrefs: 1107D0A1

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: E_adjL_gmtimeO_freeR_get_stateR_put_error__localtime64
String ID: .\crypto\asn1\a_time.c
API String ID: 2349651826-2935536683
Opcode ID: 466e28441e836fbd0344c27a4f1476b59cdac1dbb4339798105b5d473e7d7660
Instruction ID: 84ba299bbc3008fa3d90253e39f0ad7523aa423f646fefe4700a48f80800d72f
Opcode Fuzzy Hash: 466e28441e836fbd0344c27a4f1476b59cdac1dbb4339798105b5d473e7d7660
Instruction Fuzzy Hash: 8B0180B9E443017BE214EA64CD82F2F73E4ABD4B08F84481DF68997381E575FA0187A7

Function 120018C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

sk_value.LIBEAY32(?,00000000), ref: 120018DE
sk_num.LIBEAY32(?), ref: 120018FC
ERR_put_error.LIBEAY32(00000014,0000008A), ref: 12001C51
sk_free.LIBEAY32(?), ref: 12001C7D

Strings

.\ssl\s3_srvr.c, xrefs: 12001928

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_freesk_numsk_value
String ID: .\ssl\s3_srvr.c
API String ID: 1914634297-3445611115
Opcode ID: acc70a6d6adecf11dbf4d4c553a842a439d4ea0e0c11733ed72dbac3aa170bd8
Instruction ID: a41e702e4f90ecf944ff80dad8906eb92cde7e941003ffef5e3b9f7b08b588ff
Opcode Fuzzy Hash: acc70a6d6adecf11dbf4d4c553a842a439d4ea0e0c11733ed72dbac3aa170bd8
Instruction Fuzzy Hash: 1F0104B7B40240AFFB51CB50DC45F9AB3A4AB49342F004335F94A6B240E631A905ABA6

Function 12013030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 12013033
SSL_state.SSLEAY32(?), ref: 1201303E
ERR_put_error.LIBEAY32(00000014,000000ED,000000E5,.\ssl\s23_lib.c,0000009D), ref: 12013078
SSL_peek.SSLEAY32(?,?,?), ref: 12013090

Strings

.\ssl\s23_lib.c, xrefs: 12013067

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ErrorL_peekL_stateLastR_put_error
String ID: .\ssl\s23_lib.c
API String ID: 4055279446-4127323251
Opcode ID: 1d877f49d759e1fa7692abb398a2ecd325113660760aa86a95f2d2db2c951e78
Instruction ID: 6681ca76a9173f0fb8b1fc53aa352e733400f552076ffdde87f93dd9c04674f4
Opcode Fuzzy Hash: 1d877f49d759e1fa7692abb398a2ecd325113660760aa86a95f2d2db2c951e78
Instruction Fuzzy Hash: 81F0C2ABD447106BE552D364BC0AFDB33949F80334F004B29F91A192D1E6A4E68696A2

Function 120130B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 120130B3
SSL_state.SSLEAY32(?), ref: 120130BE
ERR_put_error.LIBEAY32(00000014,00000079,000000E5,.\ssl\s23_lib.c,000000B1), ref: 120130F5
SSL_write.SSLEAY32(?,?,?), ref: 1201310D

Strings

.\ssl\s23_lib.c, xrefs: 120130E7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ErrorL_stateL_writeLastR_put_error
String ID: .\ssl\s23_lib.c
API String ID: 2635317049-4127323251
Opcode ID: 4bc5f7022ca4203160e2d2ee764fee90b751e2934d46bf8e5f8806fe4273c3c2
Instruction ID: e7379608ec758d59066c149ead6ac3a2b6679f6698f74d1bb597723bbf6a5bef
Opcode Fuzzy Hash: 4bc5f7022ca4203160e2d2ee764fee90b751e2934d46bf8e5f8806fe4273c3c2
Instruction Fuzzy Hash: C9F0C2BBD446106BE251D324BC06FDB33945F80330F044725FA1A192D1E7A4EA8695E3

Function 12012FB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 12012FB3
SSL_state.SSLEAY32(?), ref: 12012FBE
ERR_put_error.LIBEAY32(00000014,00000078,000000E5,.\ssl\s23_lib.c,00000089), ref: 12012FF5
SSL_read.SSLEAY32(?,?,?), ref: 1201300D

Strings

.\ssl\s23_lib.c, xrefs: 12012FE7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: ErrorL_readL_stateLastR_put_error
String ID: .\ssl\s23_lib.c
API String ID: 4227508718-4127323251
Opcode ID: dc42dedf5cf9667b6f1000fa904fb27f5184588a9343ea1ebd40e4126321a54b
Instruction ID: 69426d0fea31b3ec83b2ce730c2541f8860a4aa38e279b857aafb87ef2a31d03
Opcode Fuzzy Hash: dc42dedf5cf9667b6f1000fa904fb27f5184588a9343ea1ebd40e4126321a54b
Instruction Fuzzy Hash: CAF0F6ABD846106BE152D324FC0AFEB33985F80331F048724F91A592D1EB64EA45A6E3

Function 1201C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SSL_ctrl.SSLEAY32(?,00000020,00000000,00000000), ref: 1201C521
SSL_get_wbio.SSLEAY32(?,0000002F,00000000,00000000), ref: 1201C537
BIO_ctrl.LIBEAY32(00000000,00000000), ref: 1201C540
ERR_put_error.LIBEAY32(00000014,0000013C,00000138,.\ssl\d1_lib.c,000001EF), ref: 1201C57C

Strings

.\ssl\d1_lib.c, xrefs: 1201C56B

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_ctrlL_get_wbioO_ctrlR_put_error
String ID: .\ssl\d1_lib.c
API String ID: 3671905667-112416191
Opcode ID: 01ba8abd67bd1bcd0f0d40b35eb25240f6f619ae8805724b053249a0546ad4b0
Instruction ID: d0b28bc87660f507d57e50e6def9406bb5b587105c7897da2b8d1d3b6974b2f9
Opcode Fuzzy Hash: 01ba8abd67bd1bcd0f0d40b35eb25240f6f619ae8805724b053249a0546ad4b0
Instruction Fuzzy Hash: 4E01D676A81700AFE312D7188C4AFDE73F0AB04716F6406B4F6096E2C2E7B5F5429785

Function 1202B730 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

d2i_PrivateKey.LIBEAY32(?,00000000,?,?), ref: 1202B74A
ERR_put_error.LIBEAY32(00000014,000000CA,0000000D,.\ssl\ssl_rsa.c,00000172), ref: 1202B76B
SSL_use_PrivateKey.SSLEAY32(?,00000000), ref: 1202B77E
EVP_PKEY_free.LIBEAY32(00000000,?,00000000), ref: 1202B786

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B75D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Private$L_use_R_put_errorY_freed2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 4174641380-614043423
Opcode ID: b14aa7cc920d6d266fbf512bfe08bd34cb7e563c2ebf32684a19a7124fd93cc8
Instruction ID: 470868ff550eda05c9711d92a4d73644a1e5f5a5f9924e5bc30bc6c64ed4fe3b
Opcode Fuzzy Hash: b14aa7cc920d6d266fbf512bfe08bd34cb7e563c2ebf32684a19a7124fd93cc8
Instruction Fuzzy Hash: 79F0E9777483107BD251D768AC01F9B73E89FC4710F054A29F64597280E570E80592B2

Function 1202BCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

d2i_PrivateKey.LIBEAY32(?,00000000,?,?), ref: 1202BCDA
ERR_put_error.LIBEAY32(00000014,000000AF,0000000D,.\ssl\ssl_rsa.c,0000029E), ref: 1202BCFB
SSL_CTX_use_PrivateKey.SSLEAY32(?,00000000), ref: 1202BD0E
EVP_PKEY_free.LIBEAY32(00000000,?,00000000), ref: 1202BD16

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BCED

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Private$R_put_errorX_use_Y_freed2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 327388707-614043423
Opcode ID: 9bcede0e4a68b0f46ce644373e83713b5c4aed4342925a3184e39d750252b321
Instruction ID: 597aeb559a53d15bcdcfecea91e1765d56e17e72414ef21864e08fa5f90534a8
Opcode Fuzzy Hash: 9bcede0e4a68b0f46ce644373e83713b5c4aed4342925a3184e39d750252b321
Instruction Fuzzy Hash: 1DF0E9777443113BD251D7A8AC05F9B77E4DFC8710F054929F64597280E570E80492B2

Function 12020DC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000), ref: 12020DF9
ERR_put_error.LIBEAY32(00000014,000000AA,000000E6,.\ssl\ssl_lib.c,00000120), ref: 12020E21

Strings

SSLv2, xrefs: 12020DCD
.\ssl\ssl_lib.c, xrefs: 12020E10
ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2, xrefs: 12020DD4, 12020DE1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_num
String ID: .\ssl\ssl_lib.c$ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2$SSLv2
API String ID: 3777708388-1426024572
Opcode ID: aef43ee109025466ba9d34edd0482466d577e63728a69b79e230f2be12282008
Instruction ID: 09a2188dc9f3d32132fadee49b819f7afd18aa254735ffd41bb30b377f25d163
Opcode Fuzzy Hash: aef43ee109025466ba9d34edd0482466d577e63728a69b79e230f2be12282008
Instruction Fuzzy Hash: EAF02BB77003006BDA12D310CC01FD7759AAB44705F458274B4026B251F561E801E261

Function 11091130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

X509_ALGOR_new.LIBEAY32 ref: 11091131

Part of subcall function 11080CF0: ASN1_item_new.LIBEAY32(1110D890), ref: 11080CF5

ERR_put_error.LIBEAY32(0000000D,000000CA,00000041,.\crypto\asn1\p5_pbe.c,00000086), ref: 1109114F

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

PKCS5_pbe_set0_algor.LIBEAY32(00000000,?,?,?,?), ref: 11091170

Strings

.\crypto\asn1\p5_pbe.c, xrefs: 11091141

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N1_item_newO_freeR_get_stateR_newR_put_errorS5_pbe_set0_algorX509_
String ID: .\crypto\asn1\p5_pbe.c
API String ID: 3622647935-1775734373
Opcode ID: 08cde53cb4e950d50642d99c8a75b769303ef1aacc9eefef3c383d61195e078c
Instruction ID: dadd41510cb7ce19cdff53070b57abbf8f77de552d04c8f1ed3fe1d4467360e6
Opcode Fuzzy Hash: 08cde53cb4e950d50642d99c8a75b769303ef1aacc9eefef3c383d61195e078c
Instruction Fuzzy Hash: E7F0A7EAF487223BE311E668BC11F9F73D85F84A54F014464F908D7245EA60ED4142F3

Function 1202BAC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

d2i_RSAPrivateKey.LIBEAY32(00000000,?,?), ref: 1202BAD5
ERR_put_error.LIBEAY32(00000014,000000B2,0000000D,.\ssl\ssl_rsa.c,00000254), ref: 1202BAF6
SSL_CTX_use_RSAPrivateKey.SSLEAY32(?,00000000), ref: 1202BB09
RSA_free.LIBEAY32(00000000,?,00000000), ref: 1202BB11

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BAE8

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Private$A_freeR_put_errorX_use_d2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 1059613463-614043423
Opcode ID: b3fd817e777d612d9f0b8f26ea9ff9ae1baad868b708609e445dc3c38c467480
Instruction ID: c01539d9002d676a05c34cc331cc56a77ffdf395d49ac9cc0e1281679778609b
Opcode Fuzzy Hash: b3fd817e777d612d9f0b8f26ea9ff9ae1baad868b708609e445dc3c38c467480
Instruction Fuzzy Hash: C9F02777B443103BD252E764AC05FDB77E49FC4750F05893AFA449B280E570D84492E1

Function 1202C770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

d2i_RSAPrivateKey.LIBEAY32(00000000,?,?), ref: 1202C785
ERR_put_error.LIBEAY32(00000014,000000CD,0000000D,.\ssl\ssl_rsa.c,00000124), ref: 1202C7A6
SSL_use_RSAPrivateKey.SSLEAY32(?,00000000), ref: 1202C7B9
RSA_free.LIBEAY32(00000000,?,00000000), ref: 1202C7C1

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C798

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Private$A_freeL_use_R_put_errord2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 692539868-614043423
Opcode ID: dafeaa7f29c1f3816c4d09aec8621a169db90c2df44b56f40725c92e6c8eae25
Instruction ID: 23e2cf5def68dbff7211974abbc406cee50705c0bc1e15cdba4a7f7d13f0934b
Opcode Fuzzy Hash: dafeaa7f29c1f3816c4d09aec8621a169db90c2df44b56f40725c92e6c8eae25
Instruction Fuzzy Hash: C6F0277BB453103BD251D7A4AC01FDB77D8DFC4750F054A3AFA449B280E570D84492E1

Function 1202C990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

d2i_X509.LIBEAY32(00000000,?,?), ref: 1202C99D
ERR_put_error.LIBEAY32(00000014,000000AC,0000000D,.\ssl\ssl_rsa.c,000001FA), ref: 1202C9BE
SSL_CTX_use_certificate.SSLEAY32(?,00000000), ref: 1202C9D1
X509_free.LIBEAY32(00000000,?,00000000), ref: 1202C9D9

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C9B0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorX509X509_freeX_use_certificated2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 4116365395-614043423
Opcode ID: 9bb8e3435494dadb2b70c78613f5da6736d2a264579e79587681f73d62c0ce90
Instruction ID: be7b4cc80f060974c3dee19e9920f79a8ce525eaa86e8d18f5efc41cd6f1ee6c
Opcode Fuzzy Hash: 9bb8e3435494dadb2b70c78613f5da6736d2a264579e79587681f73d62c0ce90
Instruction Fuzzy Hash: 30E02B7B7C42113BD151D3E4BC06FDB37948FC4761F0A0236F64AAA180E860E80162F2

Function 12006C30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

X509_get_pubkey.LIBEAY32(?), ref: 12006C49
EVP_PKEY_get1_DH.LIBEAY32(00000000), ref: 12006C58
EVP_PKEY_free.LIBEAY32(00000000,00000000), ref: 12006C60
ERR_put_error.LIBEAY32(00000014,00000154,00000044,.\ssl\s3_clnt.c,000009C0), ref: 12006C7F

Strings

.\ssl\s3_clnt.c, xrefs: 12006C71

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorX509_get_pubkeyY_freeY_get1_
String ID: .\ssl\s3_clnt.c
API String ID: 2745149261-2155475665
Opcode ID: 699b22144ecba0e7af37df44b210a64493daa9034b99c9d9f2a62b3f9c78fbe0
Instruction ID: f9f3185906b2382b6a97ca6c3de0485d23f3546a325843ba42c37029ddec0ad0
Opcode Fuzzy Hash: 699b22144ecba0e7af37df44b210a64493daa9034b99c9d9f2a62b3f9c78fbe0
Instruction Fuzzy Hash: 72F05C77B401102FF243C3B89C00F9A22958BC4755F1A0334FA44DB240F975E41651B4

Function 1202C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

d2i_X509.LIBEAY32(00000000,?,?), ref: 1202C50D
ERR_put_error.LIBEAY32(00000014,000000C7,0000000D,.\ssl\ssl_rsa.c,00000086), ref: 1202C52E
SSL_use_certificate.SSLEAY32(?,00000000), ref: 1202C541
X509_free.LIBEAY32(00000000,?,00000000), ref: 1202C549

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C520

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_use_certificateR_put_errorX509X509_freed2i_
String ID: .\ssl\ssl_rsa.c
API String ID: 4116471823-614043423
Opcode ID: ea98e8224e37f728b57c49674fd1a740c8c2a98dd01b25a78b642841901751f7
Instruction ID: 8fb6ac177165eea14ecd88592c056514c0b80117858bb6eaf3bf9b1eb7eb6341
Opcode Fuzzy Hash: ea98e8224e37f728b57c49674fd1a740c8c2a98dd01b25a78b642841901751f7
Instruction Fuzzy Hash: 7FE02B3BB892103BD161D3E9BC06FDB37989BC4761F0A4735F6499B180E860E80152F1

Function 110170B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 14COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBEAY32(11144580,00000020,des(%s,%s,%s,%s),idx,cisc,110E888C,long), ref: 110170D9

Strings

long, xrefs: 110170B9
idx, xrefs: 110170C8
des(%s,%s,%s,%s), xrefs: 110170CD
cisc, xrefs: 110170C3

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_snprintf
String ID: cisc$des(%s,%s,%s,%s)$idx$long
API String ID: 3142812517-1869087540
Opcode ID: 9dd54170a7c223a99de8fd9bf742aba361cab75ac2a92b171a16df6dad50ab42
Instruction ID: 82b59f1a80e3fcf5b27ac3e679e34bfe71e0363cc8449314c378fbb02bd91d72
Opcode Fuzzy Hash: 9dd54170a7c223a99de8fd9bf742aba361cab75ac2a92b171a16df6dad50ab42
Instruction Fuzzy Hash: 76D0C9B5D423006FEA08D6137F1CFCA78855314B0CFC80176F8447998AEB66121092A8

Function 12013D50 Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

X509_get_pubkey.LIBEAY32(?,?,?,12017445,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 12013D65
EVP_PKEY_free.LIBEAY32(00000000), ref: 12013D82

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_get_pubkeyY_free
String ID:
API String ID: 3968206449-0
Opcode ID: 5e1385c2752e083fac7ee03b697f34902bb89777d04efc4c78e9f9159ad42a3e
Instruction ID: 1995e448c2b4aeedc0f8380c8de4bc81a45863d7d9c89808bec8d8486a3fc70b
Opcode Fuzzy Hash: 5e1385c2752e083fac7ee03b697f34902bb89777d04efc4c78e9f9159ad42a3e
Instruction Fuzzy Hash: E131C837B003024BD752CF68E8847EA73E5EB84715F540A3AE9499B240E735F94DA7A2

Function 1200BB5B Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBEAY32 ref: 1200BB93
EVP_PKEY_set1_RSA.LIBEAY32(00000000,?), ref: 1200BBAE
EVP_PKEY_set1_DH.LIBEAY32(00000000,?), ref: 1200BBC1
EVP_PKEY_set1_EC_KEY.LIBEAY32(00000000,?), ref: 1200BBD4
EVP_PKEY_free.LIBEAY32(00000000), ref: 1200BBF1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Y_set1_$Y_freeY_new
String ID:
API String ID: 4207563837-0
Opcode ID: f0082f45f06ecd03535224f5f502ce275a090a53d77193b9b2fe962aeaec5819
Instruction ID: d13cba0563cabac933d7fbcb45ab1233e7edc36dc55dbeaec1b15d5cdaecd457
Opcode Fuzzy Hash: f0082f45f06ecd03535224f5f502ce275a090a53d77193b9b2fe962aeaec5819
Instruction Fuzzy Hash: 6111E5376009438BFB22EEA598C0BFFB3F5DB80252F120B3ED655A3500F7256845B659

Function 12036B44 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 12036B50

Part of subcall function 120361E4: __getptd_noexit.LIBCMT ref: 120361E7
Part of subcall function 120361E4: __amsg_exit.LIBCMT ref: 120361F4

__amsg_exit.LIBCMT ref: 12036B70
__lock.LIBCMT ref: 12036B80
InterlockedDecrement.KERNEL32(?), ref: 12036B9D
InterlockedIncrement.KERNEL32(051A1658), ref: 12036BC8

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 40761867e9aeebfefb89a66d20635f730082fbc7c5d65dd045e4bd8ff681b909
Instruction ID: da8dc016d0b132ced3a816061374355b9d9b7e1d8ae2a27b2314cc4960462510
Opcode Fuzzy Hash: 40761867e9aeebfefb89a66d20635f730082fbc7c5d65dd045e4bd8ff681b909
Instruction Fuzzy Hash: 93015337D41A219FCB53DB689888BAD7AB0BF08756F004349E80067290CB24A991EFD9

Function 1203579B Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 120357B9

Part of subcall function 12035EEA: __mtinitlocknum.LIBCMT ref: 12035F00
Part of subcall function 12035EEA: __amsg_exit.LIBCMT ref: 12035F0C
Part of subcall function 12035EEA: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,12038B27,00000004,12048E48,0000000C,12035717,12032C9C,00000000,00000000,00000000,00000000,?,12036196,00000001), ref: 12035F14

___sbh_find_block.LIBCMT ref: 120357C4
___sbh_free_block.LIBCMT ref: 120357D3
HeapFree.KERNEL32(00000000,12032C9C,12048C70,0000000C,12035ECB,00000000,12048CF8,0000000C,12035F05,12032C9C,-0000000F,?,12038B27,00000004,12048E48,0000000C), ref: 12035803
GetLastError.KERNEL32(?,12038B27,00000004,12048E48,0000000C,12035717,12032C9C,00000000,00000000,00000000,00000000,?,12036196,00000001,00000214), ref: 12035814

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: fd06fe8a0cc3ee7d2bccc7cfd01885e9e9c43570566a68c1a17b80b0b898b266
Instruction ID: 32d3226d8615d40377b5befd8be035bd89cf06a6d10481844d413fb07822742f
Opcode Fuzzy Hash: fd06fe8a0cc3ee7d2bccc7cfd01885e9e9c43570566a68c1a17b80b0b898b266
Instruction Fuzzy Hash: B9016777841212EFDB23DBB1BC58B9E3FA4AF04727F114B59E444A64A0CF35A640EA54

Function 12017170 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

X509_get_issuer_name.LIBEAY32(?,?,?,120174EF,?), ref: 12017177
sk_num.LIBEAY32(?,?,?,?,120174EF,?), ref: 12017181
sk_value.LIBEAY32(?,00000000,120174EF,?), ref: 12017192
X509_NAME_cmp.LIBEAY32(00000000,00000000,?,00000000,120174EF,?), ref: 12017199
sk_num.LIBEAY32(?,?,?,?,?,120174EF,?), ref: 120171A7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$E_cmpX509_X509_get_issuer_namesk_value
String ID:
API String ID: 3873463148-0
Opcode ID: 80b6d65b2a85c6528a759f35d9e29a67bb83f09df808a71f27820ab53c0a3be9
Instruction ID: 36a15d4c3a957ff6a9b61291542e47af09c3823037e7e12300fe33785f5b07e9
Opcode Fuzzy Hash: 80b6d65b2a85c6528a759f35d9e29a67bb83f09df808a71f27820ab53c0a3be9
Instruction Fuzzy Hash: B7E092A79001107B9B53E2B81D80ABB92BC8B59756B050229FC0AC6111F715E91172F2

Function 120259E0 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32(?,12025A44), ref: 120259EC
X509_get_subject_name.LIBEAY32(?,?,12025A44), ref: 120259F8
X509_NAME_dup.LIBEAY32(00000000,?,?,12025A44), ref: 120259FE
sk_push.LIBEAY32(00000000,00000000), ref: 12025A10
X509_NAME_free.LIBEAY32(00000000), ref: 12025A1D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_$E_dupE_freeX509_get_subject_namesk_new_nullsk_push
String ID:
API String ID: 4294511217-0
Opcode ID: 84995eb9a70bdff2803aed2a65272580297c8a7a960297fede0e3c23885d11ab
Instruction ID: 1cb5ed578c6f8b4793df73707dc88847c74a0ed71af9532c7fb07d006824ab0d
Opcode Fuzzy Hash: 84995eb9a70bdff2803aed2a65272580297c8a7a960297fede0e3c23885d11ab
Instruction Fuzzy Hash: 0DE0ED37D115230BDB53D2B87C467DBA6E89F0C222F050322EC01DA200FB26EC96A2E5

Function 1201C600 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

SSL_clear.SSLEAY32(?), ref: 1201C606

Part of subcall function 12023DA0: ERR_put_error.LIBEAY32(00000014,000000A4,000000BC,.\ssl\ssl_lib.c,000000C2), ref: 12023DC3

SSL_ctrl.SSLEAY32(?,00000020,00002000,00000000,?), ref: 1201C615
SSL_accept.SSLEAY32 ref: 1201C628

Part of subcall function 12024C60: SSL_set_accept_state.SSLEAY32(?), ref: 12024C6C

SSL_get_rbio.SSLEAY32(?,0000002E,00000000,?), ref: 1201C63E
BIO_ctrl.LIBEAY32(00000000,?), ref: 1201C647

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_acceptL_clearL_ctrlL_get_rbioL_set_accept_stateO_ctrlR_put_error
String ID:
API String ID: 3099295746-0
Opcode ID: 7addb55d113c94e5e621583dcf87c9ea3d106e09c02a7cb5467f0cb2b030c78a
Instruction ID: 6987f25a447c3732c8605f69e075816b4378bbd109b1a6544934ca3b9db5ecce
Opcode Fuzzy Hash: 7addb55d113c94e5e621583dcf87c9ea3d106e09c02a7cb5467f0cb2b030c78a
Instruction Fuzzy Hash: C2E0927B6413203AF251E358AC4AFEF62988F48304F454655F508AB2C2D6F5B54053EA

Function 1201EB10 Relevance: 7.5, APIs: 5, Instructions: 28COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBEAY32(F6850CC4,00000000,1201C459,?,00000000,?), ref: 1201EB1F
EVP_MD_CTX_destroy.LIBEAY32(5E5FD975,F6850CC4,00000000,1201C459,?,00000000,?), ref: 1201EB28
CRYPTO_free.LIBEAY32(FEE296E8,00000000,1201C459,?,00000000,?), ref: 1201EB38
CRYPTO_free.LIBEAY32(04C483FF,00000000,1201C459,?,00000000,?), ref: 1201EB48
CRYPTO_free.LIBEAY32(1201C459,00000000,1201C459,?,00000000,?), ref: 1201EB51

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_free$X_destroyX_free
String ID:
API String ID: 3808974946-0
Opcode ID: cd33200d45ef6a11a4eabb724fa073649f098396b0d228a800fdf4825be8493d
Instruction ID: e0ee701d5af1a4922939a839512f7de44b5f8af0187dbce241037da650ee6549
Opcode Fuzzy Hash: cd33200d45ef6a11a4eabb724fa073649f098396b0d228a800fdf4825be8493d
Instruction Fuzzy Hash: A7E065B3E116009BD6A2DB31AC41A9BB3F86F08305B040F28E44797640EA34F955D7A2

Function 12010380 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000008E,00000098,.\ssl\s3_both.c,000001A1), ref: 120104E6
BUF_MEM_grow_clean.LIBEAY32(?,?), ref: 12010514
ERR_put_error.LIBEAY32(00000014,0000008E,00000007,.\ssl\s3_both.c,000001AB), ref: 12010533

Strings

.\ssl\s3_both.c, xrefs: 120103B3, 12010492, 120104D0, 12010525

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$M_grow_clean
String ID: .\ssl\s3_both.c
API String ID: 1147295381-639481419
Opcode ID: 0661423cbecef69b7ed36887154820696ba4b55be027a64277674819fddc6fbf
Instruction ID: b0c0449e9088951d74bea652f913687a85ce46efda2068b7009853615d1b2fe2
Opcode Fuzzy Hash: 0661423cbecef69b7ed36887154820696ba4b55be027a64277674819fddc6fbf
Instruction Fuzzy Hash: 8581BEB27417419FD321CF18C981AA7B7E6BF89314F048A2DEAC65BA81D372F841DB51

Function 12018C30 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000011C,00000044,.\ssl\t1_enc.c,00000109), ref: 12018C9F
_memset.LIBCMT ref: 12018CD3
ERR_put_error.LIBEAY32(00000014,0000011C,00000146,.\ssl\t1_enc.c,00000114,?,?,?,00000000,?), ref: 12018DD2

Strings

.\ssl\t1_enc.c, xrefs: 12018C91, 12018DC1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$_memset
String ID: .\ssl\t1_enc.c
API String ID: 2965969813-3943519339
Opcode ID: da131ab598f9dd0977c390abf4135a1fdaff0267e8aa6e9c82a8ccdab19bd560
Instruction ID: 0762683c6cbd5d6697362dd5530ef5e3f994d5ee3287c657c8d4190c60416558
Opcode Fuzzy Hash: da131ab598f9dd0977c390abf4135a1fdaff0267e8aa6e9c82a8ccdab19bd560
Instruction Fuzzy Hash: EC41B2776083016BE305CB58DC41FABB7E9EFC9704F054A1CFA8587241E671EA08D7A2

Function 120204F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 12020560
ERR_put_error.LIBEAY32(00000014,000000FC,000000F4,.\ssl\d1_both.c,00000215), ref: 120205E9
_memset.LIBCMT ref: 12020697

Strings

.\ssl\d1_both.c, xrefs: 120205D8

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: _memset$R_put_error
String ID: .\ssl\d1_both.c
API String ID: 403094551-2895748750
Opcode ID: c71bdfd4b1ebe97ffd3941f060b8c18122b1657d2b4a4acdae36ba63dca59db8
Instruction ID: 6f4d0f9bf3942c776345bc75eee12c35684f52b69e63ab97acad465ed5e22646
Opcode Fuzzy Hash: c71bdfd4b1ebe97ffd3941f060b8c18122b1657d2b4a4acdae36ba63dca59db8
Instruction Fuzzy Hash: 56511432604751AFE311CB14CC80FA6BBE6FF95318F04466AE9895B792D371F850D7A1

Function 12001C90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000F2,00000113,.\ssl\s3_srvr.c,00000620), ref: 12001D33
SSL_CONF_CTX_finish.SSLEAY32(?), ref: 12001D92
ERR_put_error.LIBEAY32(00000014,000000F2,00000044,.\ssl\s3_srvr.c,00000628,?,00000002,?), ref: 12001DEF

Strings

.\ssl\s3_srvr.c, xrefs: 12001D25, 12001DA3, 12001DE1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X_finish
String ID: .\ssl\s3_srvr.c
API String ID: 3015385562-3445611115
Opcode ID: 667207f23ab9ba9bf60b1265d32a27af6a98a8b04a5eadd7ab7ec27639d17d2e
Instruction ID: dc50b0ba892f5698efa38afcf07205221acde4c805fdc20e89019a42c482a72a
Opcode Fuzzy Hash: 667207f23ab9ba9bf60b1265d32a27af6a98a8b04a5eadd7ab7ec27639d17d2e
Instruction Fuzzy Hash: 0241E27A240340AFE701DF18DC80BA67BE9EB89314F4482A9ED494F383E675E905D765

Function 12015F70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000118,0000009D,.\ssl\t1_lib.c,00000CB5), ref: 12015FFC
CRYPTO_free.LIBEAY32(?,?), ref: 12016050

Strings

p, xrefs: 12015F86
.\ssl\t1_lib.c, xrefs: 12015FEB

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeR_put_error
String ID: .\ssl\t1_lib.c$p
API String ID: 3735976985-3217429042
Opcode ID: 279f338be89a46b788f1674242872ec8bbf6ee7ada293098192e4bf44f9d7ae5
Instruction ID: ad6c6a14d6a7c48abb004726b1e2f09893482aa840604ced90cb3d02e3887e70
Opcode Fuzzy Hash: 279f338be89a46b788f1674242872ec8bbf6ee7ada293098192e4bf44f9d7ae5
Instruction Fuzzy Hash: 8E41AC726007028FE317CB25CC48BE777E1AB80369F148BADE55A8F2D1DB72E445AB40

Function 1202BF20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000150,00000043,.\ssl\ssl_rsa.c,00000396), ref: 1202BF6F

Part of subcall function 1202BE50: SSL_CTX_add_server_custom_ext.SSLEAY32(?,?,1202BDD0,00000000,00000000,1202BDB0,00000000,?,?,?,?,1202BF52,00000000), ref: 1202BEC5

CRYPTO_realloc.LIBEAY32(?,?,.\ssl\ssl_rsa.c,000003A6), ref: 1202BFC5
ERR_put_error.LIBEAY32(00000014,00000150,00000184,.\ssl\ssl_rsa.c,000003B4), ref: 1202C023

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BF5E, 1202BF96, 1202BFAB, 1202BFBE, 1202BFD6, 1202C012, 1202C041

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_reallocX_add_server_custom_ext
String ID: .\ssl\ssl_rsa.c
API String ID: 2635170945-614043423
Opcode ID: 5b04037ac0fbe978fb92494b1711198795844c3efaa57793bfa5a863ec9da9fa
Instruction ID: 1aed7424939842ef4d108fbf1a9af893090a3204d95b8a26a7763d8ad4fbc579
Opcode Fuzzy Hash: 5b04037ac0fbe978fb92494b1711198795844c3efaa57793bfa5a863ec9da9fa
Instruction Fuzzy Hash: A5315877384345ABE201CB48CC82F96B3889B44B40F960267F705AF2C1EBA1F640B395

Function 120167B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,?,?,1201697C,?,00000000,?,1201852E,?,?,00000000,12001A88,?), ref: 120167DE
CRYPTO_malloc.LIBEAY32(00000000,.\ssl\t1_lib.c,00000EF5), ref: 12016892

Strings

MZP, xrefs: 12016837
.\ssl\t1_lib.c, xrefs: 1201688C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\t1_lib.c$MZP
API String ID: 2609694610-1486625513
Opcode ID: 06afc3ea38a7baf93af4da6e064cc5a181aa5b7770d5b7e2dfbb859bbcfca24b
Instruction ID: 8f8932c78f0edd87c186da934f83176065be5c62ab628448cbbdcd617aa39233
Opcode Fuzzy Hash: 06afc3ea38a7baf93af4da6e064cc5a181aa5b7770d5b7e2dfbb859bbcfca24b
Instruction Fuzzy Hash: 6F317A73A047018FD311CE66DC80BDBB3E8AB98314F100A2DE99A9B601EB31F905DB91

Function 12018430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,00000000,12001A88,?), ref: 12018449
ERR_put_error.LIBEAY32(00000014,0000014F,00000041,.\ssl\t1_lib.c,00000C4F), ref: 12018548
ERR_put_error.LIBEAY32(00000014,0000014F,00000178,.\ssl\t1_lib.c,00000C56), ref: 12018578

Part of subcall function 120250A0: EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250A1
Part of subcall function 120250A0: EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250AD
Part of subcall function 120250A0: EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250B5
Part of subcall function 120250A0: EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250BD

Strings

.\ssl\t1_lib.c, xrefs: 1201853A, 12018567

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1$R_put_error$O_free
String ID: .\ssl\t1_lib.c
API String ID: 665669313-2047370388
Opcode ID: 26f0faa8d6637f7787bd597bf49ff71e509645bcae66bf2a9613c29f9ee41b88
Instruction ID: de109b0af9db109f8e4ae312d8ea1ef8de4f64c736f27cc1b5f82d1b45073cd8
Opcode Fuzzy Hash: 26f0faa8d6637f7787bd597bf49ff71e509645bcae66bf2a9613c29f9ee41b88
Instruction Fuzzy Hash: A4411875A407009FE294CF29C880BD2F7E5BF95318F14867ED55E9B362CBB2A585CB80

Function 12004B60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000132,00000163,.\ssl\s3_srvr.c,00000E32), ref: 12004B87
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_srvr.c,00000E50), ref: 12004C1F
ERR_put_error.LIBEAY32(00000014,00000132,00000041,.\ssl\s3_srvr.c,00000E52), ref: 12004C44

Strings

.\ssl\s3_srvr.c, xrefs: 12004B76, 12004BD9, 12004C19, 12004C36

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_malloc
String ID: .\ssl\s3_srvr.c
API String ID: 1108683871-3445611115
Opcode ID: b4271fe9cef45613eead568bdcf2bbdf136400508312bd755f229eedbd1d904b
Instruction ID: 22e27ad3696fac59db5abe03cd0de727aeabbed8eee91d52d59886421fbb436e
Opcode Fuzzy Hash: b4271fe9cef45613eead568bdcf2bbdf136400508312bd755f229eedbd1d904b
Instruction Fuzzy Hash: 8F215776684741AFF351C724EC89FC3B7E0EB80B15F024A2DF245AE1C2D3B0A981D614

Function 12013980 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000000,.\ssl\t1_lib.c,00000286,?,?,12013B5F,?,?,?), ref: 120139A4
CRYPTO_free.LIBEAY32(?,?,?,?,?), ref: 12013A06

Strings

.\ssl\t1_lib.c, xrefs: 12013998

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\t1_lib.c
API String ID: 2609694610-2047370388
Opcode ID: de932f9e40a8156d91eff2ec7aea60c965c888c022319644cc0151b1f997cc9b
Instruction ID: d60e4977ae3950fc96c7591c01540907b392c1b12cadb20245549496f62b30cf
Opcode Fuzzy Hash: de932f9e40a8156d91eff2ec7aea60c965c888c022319644cc0151b1f997cc9b
Instruction Fuzzy Hash: 3611D2B3A093024BD310CFAAE88099BF7D5EF94255F10463DE886DB640EA75E8159792

Function 12023BD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

.\ssl\ssl_lib.c, xrefs: 12023C15

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID:
String ID: .\ssl\ssl_lib.c
API String ID: 0-3333140318
Opcode ID: 36bcf8bdc4d168d2b50a40d33898bfc825b7f9652142996bed2e1c80711e4f49
Instruction ID: f33e50b22b0be89206750717dbace346daa280d7a4d2a039a722a5dcdbe243dd
Opcode Fuzzy Hash: 36bcf8bdc4d168d2b50a40d33898bfc825b7f9652142996bed2e1c80711e4f49
Instruction Fuzzy Hash: D911B2737092119BE642CF2CFC84BC6F3E4BB84715F558376E949CB245D671E481ABA0

Function 1201EB60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000120,00000098,.\ssl\d1_both.c,00000263), ref: 1201EB86
BUF_MEM_grow_clean.LIBEAY32(?,?), ref: 1201EBB6
ERR_put_error.LIBEAY32(00000014,00000120,00000007,.\ssl\d1_both.c,00000255), ref: 1201EBD5

Strings

.\ssl\d1_both.c, xrefs: 1201EB75, 1201EBC7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$M_grow_clean
String ID: .\ssl\d1_both.c
API String ID: 1147295381-2895748750
Opcode ID: f8178e1385d3ebc8c61506f223281e0d96fc05c25fedbd257e79b92c24183e77
Instruction ID: 96d0c116376e5acb587fb8d8b4a3710667409875010ff116767e60cfece33737
Opcode Fuzzy Hash: f8178e1385d3ebc8c61506f223281e0d96fc05c25fedbd257e79b92c24183e77
Instruction Fuzzy Hash: 9321CD76644341AFD746CF08C8C5F9AB3E0AB88300F0486B9EA4A9F396D230E881DB50

Function 12026FA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 12026FBC
CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_sess.c,0000042E), ref: 12026FE1
ERR_put_error.LIBEAY32(00000014,00000126,00000041,.\ssl\ssl_sess.c,00000430), ref: 12027006

Strings

.\ssl\ssl_sess.c, xrefs: 12026FDB, 12026FF8

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_mallocR_put_error
String ID: .\ssl\ssl_sess.c
API String ID: 2160744234-1959455021
Opcode ID: 56135eeb373892e35af17a654e3783e5895005f614eef13f7756be0ebc8c4460
Instruction ID: 5a490e0170d015f939951fc56c94d863a8a93501dd46eb83b1ff7c1094fa0814
Opcode Fuzzy Hash: 56135eeb373892e35af17a654e3783e5895005f614eef13f7756be0ebc8c4460
Instruction Fuzzy Hash: 7D116D72640B01DFD755CF6AEC44BC2F3E4AF98301F06856AF10ACB2A0E674E8409A91

Function 120097C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000087,00000092,.\ssl\s3_clnt.c,00000878,?,00000002,00000032), ref: 12009837
X509_NAME_free.LIBEAY32(?), ref: 12009AB3
sk_pop_free.LIBEAY32(?,Function_00031824), ref: 12009AC9

Strings

.\ssl\s3_clnt.c, xrefs: 12009826

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: E_freeR_put_errorX509_sk_pop_free
String ID: .\ssl\s3_clnt.c
API String ID: 2381510960-2155475665
Opcode ID: b91d991cd95fd5405a9c23d2530dca8f8658ffb259e28ddb753a662131145747
Instruction ID: f8787c3d48638c24c3b265cdf24916b7c2b8196309b56d9a9dbf65a3c1b03d85
Opcode Fuzzy Hash: b91d991cd95fd5405a9c23d2530dca8f8658ffb259e28ddb753a662131145747
Instruction Fuzzy Hash: 201176327483425FF322CB249CC2FAABBE1AF84709F04476CE5CA5B682D675E504D7A1

Function 110B5020 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(0000000E,0000006C,00000069,.\crypto\conf\conf_lib.c,00000128,110B6FE0,?,00000000,?,00000000,?,?), ref: 110B5038

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(0000000E,0000006C,0000006B,.\crypto\conf\conf_lib.c,0000012D,110B6FE0,?,00000000,?,00000000,?,?), ref: 110B505B

Strings

.\crypto\conf\conf_lib.c, xrefs: 110B502D, 110B5050

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_state
String ID: .\crypto\conf\conf_lib.c
API String ID: 4246747085-4105481173
Opcode ID: d4227c4315436bdcd46e1e7e627d6bda9ece5166134cdfc9bc434c2a6804b2e1
Instruction ID: 0b771c62d2d9cfa765a219695d894a24d3be62043e9f87865e58f699f1281077
Opcode Fuzzy Hash: d4227c4315436bdcd46e1e7e627d6bda9ece5166134cdfc9bc434c2a6804b2e1
Instruction Fuzzy Hash: E4015E78F54302ABE710DF24EC42F2B77E56B40B45F4448ACB949EB281FA76D550C692

Function 1201E9D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1201E9D6
ERR_put_error.LIBEAY32(00000014,0000010C,000000E5,.\ssl\d1_pkt.c,000005EC), ref: 1201EA10
ERR_put_error.LIBEAY32(00000014,0000010C,0000014E,.\ssl\d1_pkt.c,000005F2), ref: 1201EA3E

Strings

.\ssl\d1_pkt.c, xrefs: 1201E9FF, 1201EA2D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$L_state
String ID: .\ssl\d1_pkt.c
API String ID: 1261909419-285292661
Opcode ID: 4738e479111917e033adba0a6c82ea6a2ad975b14dbc71de34738c1fa300bd75
Instruction ID: 28eecd1b10a4c484facbb564ddeb4c81ae3969e9a32e05b76d1849ea37de00e2
Opcode Fuzzy Hash: 4738e479111917e033adba0a6c82ea6a2ad975b14dbc71de34738c1fa300bd75
Instruction Fuzzy Hash: 8A012B73A802013BF142F314AC01FDF32845B40721F454724F515691D2D6A0FD8269E2

Function 12023B40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000110,00000092,.\ssl\ssl_lib.c,00000D5A), ref: 12023B76
CRYPTO_free.LIBEAY32(?), ref: 12023B92
BUF_strdup.LIBEAY32(?), ref: 12023B9F

Strings

.\ssl\ssl_lib.c, xrefs: 12023B65

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: F_strdupO_freeR_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 1898569873-3333140318
Opcode ID: 7d5b2d5795bcfba91d16b4126a78b568fb54b3ccfacbd3bbcf6912aff57d3a8c
Instruction ID: ea750164cf67440b77903410e28f2695273f2bbdeec4c2c226a61ea236fe14b5
Opcode Fuzzy Hash: 7d5b2d5795bcfba91d16b4126a78b568fb54b3ccfacbd3bbcf6912aff57d3a8c
Instruction Fuzzy Hash: CC012673B002011BE643DF2CAC00BD6A3E5ABC4715F45832AEE5ACB254E970E4006641

Function 12010820 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\s3_both.c,0000027B,?,12010A5C,00000000,00000000,00000000,?,1200FEDC,?), ref: 12010831
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\s3_both.c,00000288), ref: 12010889
CRYPTO_free.LIBEAY32(00000000), ref: 12010896

Strings

.\ssl\s3_both.c, xrefs: 12010826, 12010880

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$O_free
String ID: .\ssl\s3_both.c
API String ID: 1526627863-639481419
Opcode ID: 19f98b0ae3b986623f4c0ce103115e91c7733911100f0c9677ae7c1ed5e850b0
Instruction ID: 1060dfce9d4496bb408250a35321242fc6bfef3eecc6d18416196a8d7bc93ea2
Opcode Fuzzy Hash: 19f98b0ae3b986623f4c0ce103115e91c7733911100f0c9677ae7c1ed5e850b0
Instruction Fuzzy Hash: 3901D433B44210CFE756DB00C884BAA77A3AF40701F1583A8ED892F695C630D840D6D1

Function 12010790 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\s3_both.c,00000266,?,12010901,00000001,00000000), ref: 120107A1
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\s3_both.c,00000270,120054AC,?,120054AC,?), ref: 120107ED
CRYPTO_malloc.LIBEAY32(120095EF,.\ssl\s3_both.c,00000272,?,?,?,?,120054AC,?,120054AC,?), ref: 12010804

Strings

.\ssl\s3_both.c, xrefs: 12010796, 120107E4, 120107FE

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$O_malloc
String ID: .\ssl\s3_both.c
API String ID: 4201103026-639481419
Opcode ID: 16ef02e2137cb8d2f85a82f21a394ef610131aabb2e8cf912dc19550a42c14d1
Instruction ID: cc4365aefee212e71fa60bf730dfae56b4ad42428eed94cbe96334f1cfd0d75c
Opcode Fuzzy Hash: 16ef02e2137cb8d2f85a82f21a394ef610131aabb2e8cf912dc19550a42c14d1
Instruction Fuzzy Hash: 9F01D673B40351ABE656EB24DC45F96B3926F40B21F258354FC486F6D1D620DC40AB91

Function 12034362 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,12032744), ref: 12034367
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 12034377

Strings

KERNEL32, xrefs: 12034362
IsProcessorFeaturePresent, xrefs: 12034371

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 89d4d44f23559454e7605dfb4ee33577ab93cf37cf7d03b3a703b586dec1ac07
Instruction ID: c75895db03aa2617c11c152c09f81c58e44fef44be83cda74274ddb09c1224f7
Opcode Fuzzy Hash: 89d4d44f23559454e7605dfb4ee33577ab93cf37cf7d03b3a703b586dec1ac07
Instruction Fuzzy Hash: 53F0903198095DD6EB01ABA1AD4D2AE7BB8FB80346F834B94E1D2A1094CF308074D351

Function 12021640 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000A8,000000BE,.\ssl\ssl_lib.c,000003C3), ref: 12021675
X509_check_private_key.LIBEAY32(?,00000000), ref: 1202168F
ERR_put_error.LIBEAY32(00000014,000000A8,000000B1,.\ssl\ssl_lib.c,000003BE), ref: 120216AE

Strings

.\ssl\ssl_lib.c, xrefs: 12021664, 1202169D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error$X509_check_private_key
String ID: .\ssl\ssl_lib.c
API String ID: 2185167962-3333140318
Opcode ID: 382a1594dc12bb15fce25d86bc56ce240035a877c16363fc203139791c80012e
Instruction ID: d268062c6670a8eb113d8392c4223f921e751a5b5225458508b665766dfe3d53
Opcode Fuzzy Hash: 382a1594dc12bb15fce25d86bc56ce240035a877c16363fc203139791c80012e
Instruction Fuzzy Hash: E3F0C87A3813006FEB42D710CC45FA673956F45B06F858278B5055F1D2EB70E800E611

Function 12027900 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_sess.c,00000466,?,120228B0,?,00000000), ref: 12027933
lh_doall_arg.LIBEAY32(00000009,120278F0,00000466,00000009,0000000C,.\ssl\ssl_sess.c,00000466,?), ref: 12027955
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_sess.c,0000046C,00000009,120278F0,00000466,00000009,0000000C,.\ssl\ssl_sess.c,00000466,?), ref: 1202796F

Strings

.\ssl\ssl_sess.c, xrefs: 12027926, 12027963

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock$lh_doall_arg
String ID: .\ssl\ssl_sess.c
API String ID: 2575105688-1959455021
Opcode ID: 5b088c7cd0d37bf99a9af50b3afe95edfcb240b4ab46a133173780c966e20403
Instruction ID: 0062249344b2b50d9a3230e676d4a9735c55230edc34dea6b64d87f5699e2a29
Opcode Fuzzy Hash: 5b088c7cd0d37bf99a9af50b3afe95edfcb240b4ab46a133173780c966e20403
Instruction Fuzzy Hash: 4BF08CB6684301AFE304DF58D881FABBBE0BF48B40F014B58F584AB291E730E9049B56

Function 12025490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

sk_new_null.LIBEAY32(?,?,1200B823,?,?), ref: 120254A2
sk_push.LIBEAY32(00000000,?,?,?,1200B823,?,?), ref: 120254B7
CRYPTO_add_lock.LIBEAY32(?,00000001,00000003,.\ssl\ssl_cert.c,00000243), ref: 120254DA

Strings

.\ssl\ssl_cert.c, xrefs: 120254CD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_add_locksk_new_nullsk_push
String ID: .\ssl\ssl_cert.c
API String ID: 2279531229-3404700246
Opcode ID: 3beefab6c01c534e4728e5fe7f8e67e46bfdde473877bbecfc3c7f7b60e8ad4e
Instruction ID: ecf345fe489f185a2a7c699acc98183ea5de2a60fc93471fa82d51725c6e3d60
Opcode Fuzzy Hash: 3beefab6c01c534e4728e5fe7f8e67e46bfdde473877bbecfc3c7f7b60e8ad4e
Instruction Fuzzy Hash: 7DF0E933A017105FD312C559FC00FDBE3E45BC4B26F4A862BF405AB140D261B9415795

Function 110571C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 110571CA
X509_TRUST_get_flags.LIBEAY32(00000000,?), ref: 110571D0
ERR_put_error.LIBEAY32(00000010,000000C2,00000042,.\crypto\ec\ec_asn1.c,00000066), ref: 11057213

Strings

.\crypto\ec\ec_asn1.c, xrefs: 11057205

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_errorT_get_flagsX509_pqueue_peek
String ID: .\crypto\ec\ec_asn1.c
API String ID: 1254514420-59035131
Opcode ID: 3d6969eae0cbfad0690ebe12a7171878c0a6d07ba14ca47e6c8db1591dbc46d5
Instruction ID: 042886d8586072b2672d22845906d34751629c1a363441b180704a19b1f52baf
Opcode Fuzzy Hash: 3d6969eae0cbfad0690ebe12a7171878c0a6d07ba14ca47e6c8db1591dbc46d5
Instruction Fuzzy Hash: D9F02E70F05B1257F6E1CA189C00BDB33D56F40748F40489DF041DB1C1D3B5E441D661

Function 1200A7C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(0000042C,.\ssl\s3_lib.c,00000BCD), ref: 1200A7D0
_memset.LIBCMT ref: 1200A7E9
SSL_SRP_CTX_init.SSLEAY32(?,00000000,00000000,0000042C), ref: 1200A810

Strings

.\ssl\s3_lib.c, xrefs: 1200A7C6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocX_init_memset
String ID: .\ssl\s3_lib.c
API String ID: 1540161045-3880942756
Opcode ID: 33d86e7753cfd8724ad1221bdade2e7eb891be3279c87da7773a57b9c17f4922
Instruction ID: dff6f4378b7253e6e0caabc5aff0e6b216a49ec3a19e6c1e869e89a5387396b0
Opcode Fuzzy Hash: 33d86e7753cfd8724ad1221bdade2e7eb891be3279c87da7773a57b9c17f4922
Instruction Fuzzy Hash: 0FF0B4729417106FE3A1DB399C41FDBBBE4AF89760F014129F5489B241D36478819BC5

Function 1201C590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(-00000013,00000000,1201C9A5), ref: 1201C5A0
SystemTimeToFileTime.KERNEL32(?,?), ref: 1201C5B0
__aulldvrm.LIBCMT ref: 1201C5D2

Strings

gfff, xrefs: 1201C5E1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Time$System$File__aulldvrm
String ID: gfff
API String ID: 239608527-1553575800
Opcode ID: 83b17d68cdc55e444b18f16e75bce611434e4ae799901ce8b376f22b7eafe6f9
Instruction ID: d6d6606c2115e67907665eb57d72d6d3b00bc9e9925c79dc85dd9294fefc9f82
Opcode Fuzzy Hash: 83b17d68cdc55e444b18f16e75bce611434e4ae799901ce8b376f22b7eafe6f9
Instruction Fuzzy Hash: 90F030B65043056FC708DF69EC85A9BB7E8FBC8701F04CD2DF589C6251E674E5049B52

Function 110831E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

sk_new.LIBEAY32(110831C0), ref: 110831F2

Part of subcall function 11068650: CRYPTO_malloc.LIBEAY32(00000014,.\crypto\stack\stack.c,000000A2,?,?,11068B37,00000000,11001512), ref: 1106865E
Part of subcall function 11068650: CRYPTO_malloc.LIBEAY32(00000010,.\crypto\stack\stack.c,000000A4), ref: 1106867A
Part of subcall function 11068650: CRYPTO_free.LIBEAY32(00000000), ref: 1106868A

sk_push.LIBEAY32(00000000,?), ref: 1108320A
ERR_put_error.LIBEAY32(0000000D,000000A9,00000041,.\crypto\asn1\x_crl.c,0000016F), ref: 11083233

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

Strings

.\crypto\asn1\x_crl.c, xrefs: 11083225

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc$R_get_stateR_put_errorsk_newsk_push
String ID: .\crypto\asn1\x_crl.c
API String ID: 442691277-2600505960
Opcode ID: 92ae349a7ad82e5717609058dfaf404ca53ecfc5ba6842fada26ffb1cdab40e1
Instruction ID: 2f78f5ce178b1ac2a2f156bbeb3b0ba4407d8828cff82d29175cf0809f4d9a20
Opcode Fuzzy Hash: 92ae349a7ad82e5717609058dfaf404ca53ecfc5ba6842fada26ffb1cdab40e1
Instruction Fuzzy Hash: 40F01CB5F483116EFB20DAA5BD01B9373E89F44B19F014469F5499A180EAB1F944C6A2

Function 12019B97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBEAY32(?), ref: 12019BB5
pqueue_peek.LIBEAY32(00000000,?), ref: 12019BBB
ERR_put_error.LIBEAY32(00000014,0000011E,00000144,.\ssl\t1_enc.c,000003AA), ref: 12019BF5
EVP_MD_CTX_init.LIBEAY32(?), ref: 12019C0B
EVP_MD_CTX_copy_ex.LIBEAY32(?,00000000,?), ref: 12019C16
EVP_DigestFinal_ex.LIBEAY32(?,?,?), ref: 12019C31
EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 12019C4A

Strings

.\ssl\t1_enc.c, xrefs: 12019BE4

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: DigestFinal_exR_put_errorX509_X_cleanupX_copy_exX_initY_get_objectpqueue_peek
String ID: .\ssl\t1_enc.c
API String ID: 1175335983-3943519339
Opcode ID: 466e5091211e24e5c6d0ffaafd3e3ac6be6f740686899d132f2722a2adb607ba
Instruction ID: fb54cdb4d250ffe886b4891428f387c16b4644f47ab8bcb34f0f9ea34892d48d
Opcode Fuzzy Hash: 466e5091211e24e5c6d0ffaafd3e3ac6be6f740686899d132f2722a2adb607ba
Instruction Fuzzy Hash: C7F05537B00208AFD601DBA8CCC1FC9F3B5BB48308F950271DA869F181D632E442E6D2

Function 12025610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(000000FC,.\ssl\ssl_cert.c,0000027F,?,12004408), ref: 12025620
ERR_put_error.LIBEAY32(00000014,000000E1,00000041,.\ssl\ssl_cert.c,00000281,?,?,12004408), ref: 12025641
_memset.LIBCMT ref: 12025655

Strings

.\ssl\ssl_cert.c, xrefs: 12025616, 12025633

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocR_put_error_memset
String ID: .\ssl\ssl_cert.c
API String ID: 3001995100-3404700246
Opcode ID: 666491623ba21c8b06c23127fad6a905a24cf92139dcc9abdfe2d58e822637e1
Instruction ID: 1c81add31783cb5daa5eb5e52add0ca00103dace54cc4811037d28dc72b63162
Opcode Fuzzy Hash: 666491623ba21c8b06c23127fad6a905a24cf92139dcc9abdfe2d58e822637e1
Instruction Fuzzy Hash: C6E09B33BC03127BF9B19250BC47FD676904B00B10F468531FA097D5C1E9D555816295

Function 1108D150 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_printf.LIBEAY32(?,-----BEGIN %s-----,?), ref: 1108D162

Part of subcall function 110655A0: BIO_vprintf.LIBEAY32(?,?,?,11003678,?,%ld bytes leaked in %d chunks,?,?), ref: 110655AF

Part of subcall function 1108D0D0: BIO_f_base64.LIBEAY32(?,1108D181,?,?,?,?,?,?,-----BEGIN %s-----,?), ref: 1108D0D1
Part of subcall function 1108D0D0: BIO_new.LIBEAY32(00000000,?,1108D181,?,?,?,?,?,?,-----BEGIN %s-----,?), ref: 1108D0D7
Part of subcall function 1108D0D0: ERR_put_error.LIBEAY32(0000000D,000000D2,00000041,.\crypto\asn1\asn_mime.c,0000009B), ref: 1108D0F8

BIO_printf.LIBEAY32(?,-----END %s-----,?,?,?,?,?,?,?,-----BEGIN %s-----,?), ref: 1108D18A

Strings

-----END %s-----, xrefs: 1108D182
-----BEGIN %s-----, xrefs: 1108D15C

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_printf$O_f_base64O_newO_vprintfR_put_error
String ID: -----BEGIN %s-----$-----END %s-----
API String ID: 994511499-1096442987
Opcode ID: 40843f9c012f2a123f597f9a6586c9b77329cf1843a4fc0b8cc27d0f3bc301d9
Instruction ID: 2f5e4ae3a2d5d18c0a2adaa51c7689c7159f6a295055f97a11bf6276da71f0ae
Opcode Fuzzy Hash: 40843f9c012f2a123f597f9a6586c9b77329cf1843a4fc0b8cc27d0f3bc301d9
Instruction Fuzzy Hash: E8E01276A152117F9200DA5A9C84D5FB7EDEFCD668F44061EF544E3210D261FE01CBB2

Function 1201DDE0 Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 1201DC70: pqueue_peek.LIBEAY32(?), ref: 1201DC8A
Part of subcall function 1201DC70: pqueue_peek.LIBEAY32(?), ref: 1201DCCE
Part of subcall function 1201DC70: pqueue_pop.LIBEAY32(?), ref: 1201DCEF
Part of subcall function 1201DC70: CRYPTO_free.LIBEAY32(?,00000000), ref: 1201DD09
Part of subcall function 1201DC70: pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201DD0F
Part of subcall function 1201DC70: pqueue_peek.LIBEAY32(?), ref: 1201DD7D

pqueue_pop.LIBEAY32(?), ref: 1201DE0C
CRYPTO_free.LIBEAY32(?,00000000), ref: 1201E051
pqueue_free.LIBEAY32(00000000,?,00000000), ref: 1201E057

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: pqueue_peek$O_freepqueue_freepqueue_pop
String ID:
API String ID: 4057555279-0
Opcode ID: 5b2b8ce620b82130483e093490135488264f96f27df4a114ab07f3f7c7cf6fd3
Instruction ID: 6dc92d22de8741db52c713564a2744df1718eec6bde8e06cad98cc6d508abb96
Opcode Fuzzy Hash: 5b2b8ce620b82130483e093490135488264f96f27df4a114ab07f3f7c7cf6fd3
Instruction Fuzzy Hash: B671F276A00652ABD712DF15C8887FAB7E5BF40309F04822EED458FA41D339F991EB91

Function 1201BE15 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 12010130: ERR_put_error.LIBEAY32(00000014,0000008C,00000095,.\ssl\s3_both.c,00000111), ref: 120101E3

BUF_MEM_free.LIBEAY32(?), ref: 1201C0C6

Part of subcall function 1201C4A0: SSL_get_rbio.SSLEAY32(1201ADD9,0000002D,00000000,8AFFFD3E,00000000,1201ADD9,?), ref: 1201C4E6
Part of subcall function 1201C4A0: BIO_ctrl.LIBEAY32(00000000,?), ref: 1201C4EF

BUF_MEM_new.LIBEAY32 ref: 1201BEBE
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201BED7
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201BF87

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrl$L_get_rbioM_freeM_growM_newR_put_error
String ID:
API String ID: 3339721261-0
Opcode ID: 59bca98b4543f9b2a3ca142399dc79f5db4b0331aecb67c2cfec4c8357a42c04
Instruction ID: 1ea63ae15cc0b4e62d18a825e5c801d92814fa457e929178d449219f054553a9
Opcode Fuzzy Hash: 59bca98b4543f9b2a3ca142399dc79f5db4b0331aecb67c2cfec4c8357a42c04
Instruction Fuzzy Hash: 0D51CFB6900B448FC362CF15D980AABBBE1EF48308F050A2EE58A8B751D775F545DF86

Function 1200EEA7 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1200F020
SSL_get_rbio.SSLEAY32(?), ref: 1200F09B
BIO_clear_flags.LIBEAY32(00000000,0000000F,?), ref: 1200F0A5
BIO_set_flags.LIBEAY32(00000000,00000009,00000000,0000000F,?), ref: 1200F0AD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_rbioL_stateO_clear_flagsO_set_flags
String ID:
API String ID: 31076922-0
Opcode ID: b8f8bad96d1c1f67b1d4a5308757abc6a52d6a9178dba6070714f82ac240e593
Instruction ID: 49253cdb8468b66eb978e1cf7e00b52a301a7b55335cedcb60dfb45876156ab8
Opcode Fuzzy Hash: b8f8bad96d1c1f67b1d4a5308757abc6a52d6a9178dba6070714f82ac240e593
Instruction Fuzzy Hash: 5551C372500786CFF725DF10C888BEBB3E2AF45345F14467DDA4A0B652DB31A885EB89

Function 1200EEA9 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1200F020
SSL_get_rbio.SSLEAY32(?), ref: 1200F09B
BIO_clear_flags.LIBEAY32(00000000,0000000F,?), ref: 1200F0A5
BIO_set_flags.LIBEAY32(00000000,00000009,00000000,0000000F,?), ref: 1200F0AD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_rbioL_stateO_clear_flagsO_set_flags
String ID:
API String ID: 31076922-0
Opcode ID: b1d5293d2c0bc1db77d1db2493b87eaa2980c25dddc4f7b0248508ea28823ca7
Instruction ID: 17b97dd43322ad21a82aa0d3a3631e6afbf21a930eaba35bd9f3c6e0d95aaea3
Opcode Fuzzy Hash: b1d5293d2c0bc1db77d1db2493b87eaa2980c25dddc4f7b0248508ea28823ca7
Instruction Fuzzy Hash: 1451E572500786CFF725DF10C888BE6B3E2BF45345F14467DDA4A07652DB31A885EB89

Function 1200EEB7 Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

SSL_state.SSLEAY32(?), ref: 1200F020
SSL_get_rbio.SSLEAY32(?), ref: 1200F09B
BIO_clear_flags.LIBEAY32(00000000,0000000F,?), ref: 1200F0A5
BIO_set_flags.LIBEAY32(00000000,00000009,00000000,0000000F,?), ref: 1200F0AD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_get_rbioL_stateO_clear_flagsO_set_flags
String ID:
API String ID: 31076922-0
Opcode ID: 5e35594bdf86f8a17a0300d807a60a57fc82229f9d7a1c5afe3e13989d6f7010
Instruction ID: 947e6e6c25b6b24d8b959cd6acf4ec289b846e85b2d25be3b778682346a3726a
Opcode Fuzzy Hash: 5e35594bdf86f8a17a0300d807a60a57fc82229f9d7a1c5afe3e13989d6f7010
Instruction Fuzzy Hash: EE51E472900786CFF725DF10C888BE6B3E2BF45345F14467DD64A07652DB30A885EB89

Function 1200A326 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

BUF_MEM_new.LIBEAY32 ref: 1200A3C9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A3E2
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A473

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_growM_newO_ctrl
String ID:
API String ID: 2084970400-0
Opcode ID: 6608dbc98e25a2ca9a124cb8d65cb289ecb3d1502a5fefb206b7913b3a252f47
Instruction ID: ec09bbe647edfd19adf94b5621320b386cc92678a7c56ff9e337afcabef5a285
Opcode Fuzzy Hash: 6608dbc98e25a2ca9a124cb8d65cb289ecb3d1502a5fefb206b7913b3a252f47
Instruction Fuzzy Hash: 484105B79007458BF322CF10C984BABB3E1BF84785F040B2DEA8686640D775F584EB4A

Function 1201BDD1 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 12006820: ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000926), ref: 12006943

BUF_MEM_new.LIBEAY32 ref: 1201BEBE
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201BED7
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201BF87
BUF_MEM_free.LIBEAY32(?), ref: 1201C0C6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: 5669bbd135cdde6270e074650f010afd2710e88f31765b7f297e2a7153cc4159
Instruction ID: 87d6be76f064bd1c6a9900b99e4761032de18d25ebc72957b049d5a564804e0c
Opcode Fuzzy Hash: 5669bbd135cdde6270e074650f010afd2710e88f31765b7f297e2a7153cc4159
Instruction Fuzzy Hash: 6851CEB6901B498FC362CF15D940AABBBE1EF48308F050A2EE0898B751D775F585DF86

Function 1201BDF3 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 12006A60: ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006B95

BUF_MEM_new.LIBEAY32 ref: 1201BEBE
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1201BED7
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1201BF87
BUF_MEM_free.LIBEAY32(?), ref: 1201C0C6

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: f4e3577e16d1ff6ca88d3fc2b56f92545b7efbbef771ce6d1e3b1ac9a1bb71f8
Instruction ID: 830acf8ca19089019cebe1463e9bb049b335a399cf9c32611c8f069dc1aa1b7f
Opcode Fuzzy Hash: f4e3577e16d1ff6ca88d3fc2b56f92545b7efbbef771ce6d1e3b1ac9a1bb71f8
Instruction Fuzzy Hash: 4A51BDB6901B488FC362CF15D940AABBBE1EF48308F050A2EE1898B751D775F585DF82

Function 1200A2E2 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 12006820: ERR_put_error.LIBEAY32(00000014,0000011B,00000041,.\ssl\s3_clnt.c,00000926), ref: 12006943

BUF_MEM_free.LIBEAY32(?), ref: 1200A064
BUF_MEM_new.LIBEAY32 ref: 1200A3C9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A3E2
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A473

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: a27fd78871771c10f6163fbb9f35c1953124a52554cf4361debca40d0edf5b1d
Instruction ID: 18f328689f1fd1e4eb5fa076e2636998a36844f6934b983fd09c39c81a7f9038
Opcode Fuzzy Hash: a27fd78871771c10f6163fbb9f35c1953124a52554cf4361debca40d0edf5b1d
Instruction Fuzzy Hash: 4C4118B75007458BF322CF10C984BABB7E1BF84385F000B2DE64286640D775F584EB9A

Function 1200A304 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 12006A60: ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006B95

BUF_MEM_free.LIBEAY32(?), ref: 1200A064
BUF_MEM_new.LIBEAY32 ref: 1200A3C9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A3E2
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A473

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrlR_put_error
String ID:
API String ID: 3213175576-0
Opcode ID: 8b8a0e04381c9f5dc4354553acba5908866d961d73b565ae718983ee5419b0a9
Instruction ID: bc28eca41b438cc1485b54e437de81dd564c124960f1d321c9bc7af0c6ce557d
Opcode Fuzzy Hash: 8b8a0e04381c9f5dc4354553acba5908866d961d73b565ae718983ee5419b0a9
Instruction Fuzzy Hash: 284105BB5007458BF322CF11C984BABB3E1AF84785F000B2DE68286640D775F5C4EB9A

Function 1200A22A Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 120083F0: _memset.LIBCMT ref: 12008447

BUF_MEM_free.LIBEAY32(?), ref: 1200A064
BUF_MEM_new.LIBEAY32 ref: 1200A3C9
BUF_MEM_grow.LIBEAY32(00000000,00004000), ref: 1200A3E2
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200A473

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growM_newO_ctrl_memset
String ID:
API String ID: 3432697489-0
Opcode ID: 5524716dab1e00ac7b1ec19c64e0276f3948627d5c34964ceaaf8a0b1fd555d4
Instruction ID: d8b48f4da16addf618ffe73ff6ed327e48c52cb34b2fdf6bec0f15e721a2c7cd
Opcode Fuzzy Hash: 5524716dab1e00ac7b1ec19c64e0276f3948627d5c34964ceaaf8a0b1fd555d4
Instruction Fuzzy Hash: C541F6BB5007458BF322CF14C984BABB3E5BF84385F000B2DEA4286641D775F584AB5A

Function 12016960 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 120167B0: CRYPTO_free.LIBEAY32(?,?,?,?,?,1201697C,?,00000000,?,1201852E,?,?,00000000,12001A88,?), ref: 120167DE
Part of subcall function 120167B0: CRYPTO_malloc.LIBEAY32(00000000,.\ssl\t1_lib.c,00000EF5), ref: 12016892

EVP_sha1.LIBEAY32 ref: 12016A3F
EVP_sha1.LIBEAY32 ref: 12016A4D
EVP_sha1.LIBEAY32 ref: 12016A55
EVP_sha1.LIBEAY32 ref: 12016A66

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1$O_freeO_malloc
String ID:
API String ID: 2669612496-0
Opcode ID: 8611f3c5c939c10a3f441f5181c04917a409242429a48057563c98d40ba60161
Instruction ID: 59df2a6616082e8f9013fe5dc24bba5af731c2afea3dcbf946f58edf46c9c01a
Opcode Fuzzy Hash: 8611f3c5c939c10a3f441f5181c04917a409242429a48057563c98d40ba60161
Instruction Fuzzy Hash: 9531BAB2900652AFC706CF68CC487D9F7E4BB05312F444A29D05A8B284D779F5A8EBD1

Function 12022000 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(?), ref: 12022032
sk_num.LIBEAY32(?), ref: 12022046
sk_value.LIBEAY32(?,00000000), ref: 12022054
sk_num.LIBEAY32(?), ref: 12022093

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$sk_value
String ID:
API String ID: 354181917-0
Opcode ID: 4e8e21955dfee8ce381e52a945219a70693984ac536474d411a8ed66b3bbf88a
Instruction ID: 9212edc08221e92bd7264d33bb838fad832723699a8dd8bea2d11947ce363ec1
Opcode Fuzzy Hash: 4e8e21955dfee8ce381e52a945219a70693984ac536474d411a8ed66b3bbf88a
Instruction Fuzzy Hash: 6C215B332043428FD712CBB89880BA7F7D8AFD1255F554276F88DC3216E725E809D3A2

Function 12007DB0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

pqueue_peek.LIBEAY32(?), ref: 12007E2D
X509_get_pubkey.LIBEAY32(?), ref: 12007E4C
EVP_PKEY_cmp_parameters.LIBEAY32(?,00000000), ref: 12007E5C
EVP_PKEY_free.LIBEAY32(00000000,?,00000000), ref: 12007E64

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X509_get_pubkeyY_cmp_parametersY_freepqueue_peek
String ID:
API String ID: 2469085989-0
Opcode ID: e852dcf3007c95a8aa375792c2d0858b94649902a8e54073928b626d41999af7
Instruction ID: e9fce637979bb8855fc14dcb8db802f5cb3a365fed7b134da7b0248ce9901feb
Opcode Fuzzy Hash: e852dcf3007c95a8aa375792c2d0858b94649902a8e54073928b626d41999af7
Instruction Fuzzy Hash: 2E2105376002045FF726CA64D844BAA73E9AF493A8F244265E80D4F2A2C339FC81D784

Function 12030C70 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

RAND_bytes.LIBEAY32(?,00000030), ref: 12030CF2
BN_bin2bn.LIBEAY32(?,00000030,00000000), ref: 12030D07
OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000030,00000000), ref: 12030D19
SRP_Calc_B.LIBEAY32(?,?,?,?,?,00000030,?,00000030,00000000), ref: 12030D3A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Calc_D_bytesL_cleanseN_bin2bn
String ID:
API String ID: 1479540177-0
Opcode ID: 11216f8dd0cf0093493d1cb5a993a6037fc32ee8151a2e3d258779b4a02eda34
Instruction ID: 3b915d095fbdaaa1142209ac06d04b41212ae6e51517f1c2c0bcbdf67e9bdd93
Opcode Fuzzy Hash: 11216f8dd0cf0093493d1cb5a993a6037fc32ee8151a2e3d258779b4a02eda34
Instruction Fuzzy Hash: 1121B076601701AFE366CB74C855BEBB3E9AF89301F400A1DE59A862C0D775F440DB52

Function 1103B190 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

BN_mod_exp_mont.LIBEAY32(?,?,?,?,?,00000000,1103B8B2,00000000,00000001,?), ref: 1103B19A
BN_cmp.LIBEAY32(?,?,00000000,?,?,1103B8B2,00000000,00000001,?), ref: 1103B1C7
BN_mod_mul.LIBEAY32(?,?,?,?,?,?,00000000,?,?,1103B8B2,00000000,00000001,?), ref: 1103B1E5
BN_cmp.LIBEAY32(?,?,?,?,?,?,?,?,00000000,?,?,1103B8B2,00000000,00000001,?), ref: 1103B208

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N_cmp$N_mod_exp_montN_mod_mul
String ID:
API String ID: 986298303-0
Opcode ID: 24c23f23a99b7b8b7b7e570b015c2c0754ee572af5498d1caa239299ba30a701
Instruction ID: e0b77ee08dc5b420889df2af90bda6eed7969b8672ebef418e55724430bd7c4e
Opcode Fuzzy Hash: 24c23f23a99b7b8b7b7e570b015c2c0754ee572af5498d1caa239299ba30a701
Instruction Fuzzy Hash: 5C11A3B5D20A45AEE611DD159C00F6B7BDCDFC135FF50869DF86881080D334E540CB62

Function 12031230 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

BN_ucmp.LIBEAY32(?,?,?,120089E7,?,?), ref: 12031243
BN_ucmp.LIBEAY32(?,?,?,?), ref: 12031261
BN_num_bits.LIBEAY32(?,?,?,?,?), ref: 12031280

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: N_ucmp$N_num_bits
String ID:
API String ID: 25110953-0
Opcode ID: c2eea23c2808a6800643760cc1ff6291e55ccdb68756f40cd6beadef69eb8c69
Instruction ID: 256d63d13d967ae7e9e0c75d9ffdcbdc4e5e8f05dc0ee1c717e5ea69eb5d85b3
Opcode Fuzzy Hash: c2eea23c2808a6800643760cc1ff6291e55ccdb68756f40cd6beadef69eb8c69
Instruction Fuzzy Hash: 6711EF766157009FE752CBB4E840BE7B3F4AF49311F008A18E89AC7240D735F851DBA1

Function 120253C0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

sk_pop_free.LIBEAY32(?,Function_000316CE,?,1200B7EB,?,?), ref: 120253E4
X509_chain_up_ref.LIBEAY32(?,?,?,1200B7EB,?,?), ref: 120253FC
sk_pop_free.LIBEAY32(?,Function_000316CE), ref: 12025421

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_pop_free$X509_chain_up_ref
String ID:
API String ID: 1732490864-0
Opcode ID: a313dfee2f2cdf2a11e4fcd65a1e34bddcb27ea74134feac942c1a09cd234bf1
Instruction ID: 8e924733c46d2835b2b8b3c3f72bd5e4210178858e235472d170ef3e28eadc29
Opcode Fuzzy Hash: a313dfee2f2cdf2a11e4fcd65a1e34bddcb27ea74134feac942c1a09cd234bf1
Instruction Fuzzy Hash: 3801D837B002101FD642C969FC44BDBBBF49F84722F45856AFC85D7220E625E841A7D4

Function 12031300 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

RAND_bytes.LIBEAY32(?,00000030), ref: 12031321
BN_bin2bn.LIBEAY32(?,00000030,?), ref: 1203134E
OPENSSL_cleanse.LIBEAY32(?,00000030,?,00000030,?), ref: 12031360
SRP_Calc_A.LIBEAY32(?,?,?,?,00000030,?,00000030,?), ref: 1203137A

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Calc_D_bytesL_cleanseN_bin2bn
String ID:
API String ID: 1479540177-0
Opcode ID: dfcfa71274f4e2def9d333c63ed6fe8b8546e691b319873ad4eb6c5c31dcd481
Instruction ID: 88219b04880407579c438a009ba9af0421edfd5bf7ad039156ec79957ae4da94
Opcode Fuzzy Hash: dfcfa71274f4e2def9d333c63ed6fe8b8546e691b319873ad4eb6c5c31dcd481
Instruction Fuzzy Hash: C211A5766147006FD799CB74CC85BEBB3E8AF88310F404A1DB96A87280EB74B900D782

Function 1203422D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 12034253

Part of subcall function 12034078: __fltout2.LIBCMT ref: 120340A4

__cftog_l.LIBCMT ref: 12034279
__cftoe_l.LIBCMT ref: 120342AB

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 263b4aec2397cb2a1324ca8dea28406390192fd137612503a9b6da1686dabfda
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F111277B40014ABF8F439E859C418EE3F66FB19356B968615FE1869120C236D5B1BB81

Function 110811A0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

ASN1_item_d2i.LIBEAY32(00000000,?,?,1110D9A4), ref: 110811BD

Part of subcall function 11088780: ASN1_item_ex_d2i.LIBEAY32(11081619,?,?,?,000000FF,00000000,00000000,?,00000000,11081619,00000000,?,00000000,1110DA10,110446BA,00000000), ref: 110887BA

X509_PUBKEY_get.LIBEAY32(00000000), ref: 110811D0
ASN1_item_free.LIBEAY32(00000000,1110D9A4,00000000), ref: 110811DD

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: N1_item_d2iN1_item_ex_d2iN1_item_freeX509_Y_get
String ID:
API String ID: 1092598321-0
Opcode ID: 4c118f89a4e104fe68e2e774b49536133b0b0a3ae5d99b4c6446eb9893abbd69
Instruction ID: aa7e73b27ba495ee57dbe3149af101919362ae1be0d7da0250d37ed4ee57fbc0
Opcode Fuzzy Hash: 4c118f89a4e104fe68e2e774b49536133b0b0a3ae5d99b4c6446eb9893abbd69
Instruction Fuzzy Hash: 22F086BBE056515BCB11DE99DC40A9FB7D5EFC4265F04496AF98497200E731E8048BE2

Function 12025160 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

X509_free.LIBEAY32(?), ref: 1202517B
EVP_PKEY_free.LIBEAY32(?), ref: 1202518E
sk_pop_free.LIBEAY32(?,120316CE), ref: 120251A5
CRYPTO_free.LIBEAY32(?), ref: 120251B7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeX509_freeY_freesk_pop_free
String ID:
API String ID: 4091115441-0
Opcode ID: 6e6bf2482c47f56d479585ea8d408d7772a1ee04ee9972ab5286933771be767c
Instruction ID: 9c654adb528dcca694e6fb7bc2d1631d6ed302e197441c434b747ef0939080de
Opcode Fuzzy Hash: 6e6bf2482c47f56d479585ea8d408d7772a1ee04ee9972ab5286933771be767c
Instruction Fuzzy Hash: 7A018FF7E006105FE613CF59EC8489AFBF9AB943057A84A1AE4C6D3214E372E884DB50

Function 1200DA30 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

BIO_free.LIBEAY32(?,?,120054F3,?), ref: 1200DA43
BIO_s_mem.LIBEAY32(?), ref: 1200DA60
BIO_new.LIBEAY32(00000000), ref: 1200DA66
BIO_ctrl.LIBEAY32(?,00000009,00000001,00000000), ref: 1200DA96

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_mem
String ID:
API String ID: 458502033-0
Opcode ID: 9cd46670adcd8aa5ff91103ff1ad6ef9800e73caf158967fa9cad07400784909
Instruction ID: c5f06615a48d684b4aea7a368b70a10e674c0545c61dfc0a29788c31b9c37742
Opcode Fuzzy Hash: 9cd46670adcd8aa5ff91103ff1ad6ef9800e73caf158967fa9cad07400784909
Instruction Fuzzy Hash: 46F0C876A043004FF781C725D848BDB73F49F45308F494578E4098B241D671F8C19795

Function 11017050 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

DES_check_key_parity.LIBEAY32(?), ref: 1101705F
DES_is_weak_key.LIBEAY32(?), ref: 11017071
DES_set_key_unchecked.LIBEAY32(?,?), ref: 110170A0

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: S_check_key_parityS_is_weak_keyS_set_key_unchecked
String ID:
API String ID: 4178210762-0
Opcode ID: 12d0569979d271136d3c7a1994e391e2e8421be51eb10d1cff146e34c5f10511
Instruction ID: c951b75a4059f6c1d5196e699b3d2a292f91d40b93b3e0311c49b1a3d61e5390
Opcode Fuzzy Hash: 12d0569979d271136d3c7a1994e391e2e8421be51eb10d1cff146e34c5f10511
Instruction Fuzzy Hash: 87F0EC6ED1462167D641E738BC009DB32DC4F8122CF058674F959CA299FB78E941D6E3

Function 120248A0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EVP_MD_CTX_destroy.LIBEAY32(?,?,1200CB00,?,?), ref: 120248AC
EVP_MD_CTX_create.LIBEAY32(?,1200CB00,?,?), ref: 120248BA
EVP_DigestInit_ex.LIBEAY32(00000000,1200CB00,00000000,?,1200CB00,?,?), ref: 120248D1
EVP_MD_CTX_destroy.LIBEAY32(00000000,?,1200CB00,?,?), ref: 120248E4

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: X_destroy$DigestInit_exX_create
String ID:
API String ID: 3088442214-0
Opcode ID: 07497ef6c0d7243d51a54f7b28cc005264479de86f64eae728a48c8b0104dd14
Instruction ID: 5e47b6c9eb2b89871175dcec6d8c065f8628c81bbefb8ed0f902cb1c4802100f
Opcode Fuzzy Hash: 07497ef6c0d7243d51a54f7b28cc005264479de86f64eae728a48c8b0104dd14
Instruction Fuzzy Hash: A3F05EB7A102429BEB56DF24A805BAAB3F8AF14304F15092DE885C3640EA30E440A751

Function 12012330 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

SSL_get_ciphers.SSLEAY32(?), ref: 12012337
sk_num.LIBEAY32(00000000,?), ref: 12012341
sk_value.LIBEAY32(00000000,00000000), ref: 12012352
sk_num.LIBEAY32(00000000), ref: 12012362

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: sk_num$L_get_cipherssk_value
String ID:
API String ID: 1850632280-0
Opcode ID: 1c45945ba0101b6de0baead5d4fd08b39be20a7a96f094d0aca22653b09c97b0
Instruction ID: c49fad826f6a97b59633b4d70b0339f4486a8bd11991fccd4da1ad56cfbc2d47
Opcode Fuzzy Hash: 1c45945ba0101b6de0baead5d4fd08b39be20a7a96f094d0aca22653b09c97b0
Instruction Fuzzy Hash: B9E0D1B79000207ECFA3D6357C44DFFE2A89B95661B060239F80AC5110E515E947B7E2

Function 120372B0 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 120372BC

Part of subcall function 120361E4: __getptd_noexit.LIBCMT ref: 120361E7
Part of subcall function 120361E4: __amsg_exit.LIBCMT ref: 120361F4

__getptd.LIBCMT ref: 120372D3
__amsg_exit.LIBCMT ref: 120372E1
__lock.LIBCMT ref: 120372F1

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 4293f647c06c070efc2c65a52baefce9bae797b09257eef084a6fd9b12f7b687
Instruction ID: 62170dc6c0a4589dd234fc8c5a409e44d6d60a43252ab38181e26f536718d984
Opcode Fuzzy Hash: 4293f647c06c070efc2c65a52baefce9bae797b09257eef084a6fd9b12f7b687
Instruction Fuzzy Hash: 68F06D37941B40CFE797EB649800BAD37E07F05722F414759E850676A0CB34AA00FA65

Function 1105D1B0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBEAY32 ref: 1105D1B1

Part of subcall function 110754A0: CRYPTO_malloc.LIBEAY32(00000020,.\crypto\evp\p_lib.c,000000BC,11048046), ref: 110754AC
Part of subcall function 110754A0: ERR_put_error.LIBEAY32(00000006,0000006A,00000041,.\crypto\evp\p_lib.c,000000BE), ref: 110754CA

EVP_PKEY_set1_EC_KEY.LIBEAY32(00000000,?), ref: 1105D1C2

Part of subcall function 11075AE0: EC_KEY_up_ref.LIBEAY32(?), ref: 11075B13

EVP_PKEY_print_private.LIBEAY32(?,00000000,?,00000000), ref: 1105D1DC
EVP_PKEY_free.LIBEAY32(00000000,?,00000000,?,00000000), ref: 1105D1E4

Part of subcall function 11075B70: CRYPTO_add_lock.LIBEAY32(?,000000FF,0000000A,.\crypto\evp\p_lib.c,00000187,?,11079C29,?,?,1106F514,?,?,1106F61A,?,?,?), ref: 11075B8B
Part of subcall function 11075B70: ENGINE_finish.LIBEAY32(?), ref: 11075BBA
Part of subcall function 11075B70: sk_pop_free.LIBEAY32(?,?), ref: 11075BD6
Part of subcall function 11075B70: CRYPTO_free.LIBEAY32(?), ref: 11075BDF

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: E_finishO_add_lockO_freeO_mallocR_put_errorY_freeY_newY_print_privateY_set1_Y_up_refsk_pop_free
String ID:
API String ID: 1570852239-0
Opcode ID: 2b4f2848eaa9cf187f9f6c9a2412348c559773cc2ef7b1ac0c983219a351a151
Instruction ID: 9f347f25118916f9fc1226dd4d9bd254f8605ee7bf8d3c43e1554540182c9397
Opcode Fuzzy Hash: 2b4f2848eaa9cf187f9f6c9a2412348c559773cc2ef7b1ac0c983219a351a151
Instruction Fuzzy Hash: BCE0926AF052A237D540D228BC41EEF2688AFC1265F454469F844C7200E921EC0286F9

Function 110B7100 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

OPENSSL_load_builtin_modules.LIBEAY32(110708FC,00000000), ref: 110B7109

Part of subcall function 110B70F0: ENGINE_add_conf_module.LIBEAY32(110B710E,110708FC,00000000), ref: 110B70F5

ENGINE_load_builtin_engines.LIBEAY32(110708FC,00000000), ref: 110B710E

Part of subcall function 110C0A90: ENGINE_load_rdrand.LIBEAY32(110B7113,110708FC,00000000), ref: 110C0A95
Part of subcall function 110C0A90: ENGINE_load_dynamic.LIBEAY32(110B7113,110708FC,00000000), ref: 110C0A9A

ERR_clear_error.LIBEAY32(110708FC,00000000), ref: 110B7113

Part of subcall function 1106C580: ERR_get_state.LIBEAY32(?,?,?,11039BA8), ref: 1106C58D
Part of subcall function 1106C580: CRYPTO_free.LIBEAY32(00000000), ref: 1106C5B8

CONF_modules_load_file.LIBEAY32(00000000,?,00000030,110708FC,00000000), ref: 110B7121

Part of subcall function 110B7050: NCONF_new.LIBEAY32(00000000,?,?,?,?,110B7126,00000000,?,00000030,110708FC,00000000), ref: 110B7059
Part of subcall function 110B7050: CONF_get1_default_config_file.LIBEAY32 ref: 110B706F
Part of subcall function 110B7050: NCONF_load.LIBEAY32(00000000,?,00000000), ref: 110B7082
Part of subcall function 110B7050: ERR_peek_last_error.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110B7095
Part of subcall function 110B7050: ERR_clear_error.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110B70A4
Part of subcall function 110B7050: CRYPTO_free.LIBEAY32(00000000), ref: 110B70CA
Part of subcall function 110B7050: NCONF_free.LIBEAY32(00000000), ref: 110B70D3

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeR_clear_error$E_add_conf_moduleE_load_builtin_enginesE_load_dynamicE_load_rdrandF_freeF_get1_default_config_fileF_loadF_modules_load_fileF_newL_load_builtin_modulesR_get_stateR_peek_last_error
String ID:
API String ID: 1361286186-0
Opcode ID: 307658aa3c0f5a68080e20a5d660952ca3e52d48c8889fbcd95190eedf361df9
Instruction ID: 3e948c9e265cbc60e4ddc6dce6d759f7f3f882fd85c44ef731e92e2e8d1abb5e
Opcode Fuzzy Hash: 307658aa3c0f5a68080e20a5d660952ca3e52d48c8889fbcd95190eedf361df9
Instruction Fuzzy Hash: 41D022BCD09253EEF320DBA08840B0CB2C45B50F0CF040468F018090C8C7B22080CF6E

Function 120250A0 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250A1
EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250AD
EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250B5
EVP_sha1.LIBEAY32(?,1201859C,?,?,00000000,12001A88,?), ref: 120250BD

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: P_sha1
String ID:
API String ID: 360267384-0
Opcode ID: 428f2d06466e459424aa0c8781c48ceab85250140c36ecd5b52aa9e450823e26
Instruction ID: d4c8385d9c6f9e59444921abbfca09a50a71600f0827ef7993d36ea4010afc7d
Opcode Fuzzy Hash: 428f2d06466e459424aa0c8781c48ceab85250140c36ecd5b52aa9e450823e26
Instruction Fuzzy Hash: 03D0C27E805B908ECFA2EFB190041EAFAF0AF48B11F094E5E959757650D734B441DB91

Function 120177C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,0000014D,00000172,.\ssl\t1_lib.c,0000043F,00000000,?,12003CD6,?,?,?,00000000), ref: 1201781E
ERR_put_error.LIBEAY32(00000014,0000014D,00000170,.\ssl\t1_lib.c,00000472), ref: 1201798F

Strings

.\ssl\t1_lib.c, xrefs: 1201780D, 1201787C, 120178BC, 120178DF, 12017956, 1201797E

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\t1_lib.c
API String ID: 1767461275-2047370388
Opcode ID: 86c7c8a4f0ea1edee2b5affcfe48fbff32960a865058ff6ab6a9b75bffaa9742
Instruction ID: c9caf17994722c57a18ee56f3f1569ce33b4c03bb523f36e84277eeb85e99d83
Opcode Fuzzy Hash: 86c7c8a4f0ea1edee2b5affcfe48fbff32960a865058ff6ab6a9b75bffaa9742
Instruction Fuzzy Hash: C7514B77B843476AE70ACB20DC40BEA73E1AB45708F444328F9899F2D4E721D949E392

Function 1201A6D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

OpenSSLDie.LIBEAY32(.\ssl\t1_ext.c,000000A8,!(meth->ext_flags & SSL_EXT_FLAG_SENT),?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1201A7F0

Strings

!(meth->ext_flags & SSL_EXT_FLAG_SENT), xrefs: 1201A7E1
.\ssl\t1_ext.c, xrefs: 1201A7EB

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: Open
String ID: !(meth->ext_flags & SSL_EXT_FLAG_SENT)$.\ssl\t1_ext.c
API String ID: 71445658-3815644718
Opcode ID: 4804a5b4691c1d26e9f177fdbfe20c0cc3db360be78de5aa950e233484ff585c
Instruction ID: de0aa810aaa507152570edf930a90568e6fa44faf13ba859c7975d06c571f74f
Opcode Fuzzy Hash: 4804a5b4691c1d26e9f177fdbfe20c0cc3db360be78de5aa950e233484ff585c
Instruction Fuzzy Hash: 604195765083429FD315CF64DC919ABB7F1AFC8205F048A2DF89997701D334EA85DBA1

Function 12006A60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000121,00000041,.\ssl\s3_clnt.c,0000098E), ref: 12006B95

Strings

.\ssl\s3_clnt.c, xrefs: 12006AB8, 12006ADC, 12006B11, 12006B6C, 12006B82

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_clnt.c
API String ID: 1767461275-2155475665
Opcode ID: f429345cd2889186f55974ea179a4551f5eaa72c04585f755d54db86f80163ad
Instruction ID: 381167ec32a81f70915dfa0f5ec5fe2e470867a485a88666a20670ab31f4af84
Opcode Fuzzy Hash: f429345cd2889186f55974ea179a4551f5eaa72c04585f755d54db86f80163ad
Instruction Fuzzy Hash: E6318773A442117FF20AC714CC41FE5B7A69B417A4F254379F6093F2C2CAA1A8C1D790

Function 1200531B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C
BUF_MEM_free.LIBEAY32(?,?), ref: 120055AE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeO_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 489248819-3445611115
Opcode ID: e34e78209c1d3a352857a4238859bea5b3691523a565e631d75d54df84d40f4e
Instruction ID: 338a0a95facfec335803cc152b8f2c10a46d13366a61a6010b3a08650eb505b4
Opcode Fuzzy Hash: e34e78209c1d3a352857a4238859bea5b3691523a565e631d75d54df84d40f4e
Instruction Fuzzy Hash: 2A3125332017018BF311CF04DD84AAABBE2FF84744F410A2DE9469B690C736F902DB49

Function 1200538C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 1094062903-3445611115
Opcode ID: 8e1a6a084c4b9ea7ddc37c30baf9a8fe613c9643d3462d65ef9f0f343563f597
Instruction ID: 75e732623b6d13e9aa70d5c48a11bc863c3a68ca032c41df86935c9ed8b399cc
Opcode Fuzzy Hash: 8e1a6a084c4b9ea7ddc37c30baf9a8fe613c9643d3462d65ef9f0f343563f597
Instruction Fuzzy Hash: 5931FE736007428BF321CF04D985AAABBE2FB84759F450B2EE6464B690C372F905DB49

Function 12005277 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 1094062903-3445611115
Opcode ID: 8248301c7eee8443d2f1db8f8b3617e6cb6faeec5883ce87ee0fdb02e38f876d
Instruction ID: 2c279a8c0177d88cdffccee61a21fc68378a268d7cad1cc4967f674a81590283
Opcode Fuzzy Hash: 8248301c7eee8443d2f1db8f8b3617e6cb6faeec5883ce87ee0fdb02e38f876d
Instruction Fuzzy Hash: 33310373601B028BF321CF04D9846AABBE2FB84749F410B3EE2865B580C376F505DB49

Function 12005243 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 12003B40: EVP_MD_CTX_init.LIBEAY32(?), ref: 12003B6E
Part of subcall function 12003B40: BIO_free.LIBEAY32(?), ref: 12003FEC
Part of subcall function 12003B40: EVP_MD_CTX_cleanup.LIBEAY32(?), ref: 1200400C
Part of subcall function 12003B40: EVP_PKEY_free.LIBEAY32(00000000,?), ref: 12004012

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C
BUF_MEM_free.LIBEAY32(?,?), ref: 120055AE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeO_ctrlO_freeR_put_errorX_cleanupX_initY_free
String ID: .\ssl\s3_srvr.c
API String ID: 1095167141-3445611115
Opcode ID: d8e5eb2ee6b80ec159cb22ac506ab10c6ad73288d802c8c199d83c5f44f8c1d2
Instruction ID: b0b94db0a950afd52f015df11e399547e115ef065b79444ce3a846efc465b9bd
Opcode Fuzzy Hash: d8e5eb2ee6b80ec159cb22ac506ab10c6ad73288d802c8c199d83c5f44f8c1d2
Instruction Fuzzy Hash: 112148736017028BF321CF14D9846AEBBE2FB80789F450B3EE24697680C336F8059B49

Function 1200E2DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000124,00000085,.\ssl\s3_pkt.c,00000689), ref: 1200E32D
ERR_put_error.LIBEAY32(00000014,00000124,00000044,.\ssl\s3_pkt.c,000006A5), ref: 1200E3A3

Strings

.\ssl\s3_pkt.c, xrefs: 1200E31C, 1200E395

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\s3_pkt.c
API String ID: 1767461275-4041216366
Opcode ID: 6cf37c55307691e4be414c1e2ee84683c06537656bc5d2e7a9f4c3be53a35266
Instruction ID: 0e8fcabf7bc8f76b36dc40c45fe09f6718ea701994794c86a230fde3763cae56
Opcode Fuzzy Hash: 6cf37c55307691e4be414c1e2ee84683c06537656bc5d2e7a9f4c3be53a35266
Instruction Fuzzy Hash: 41219C763403019FF305DB19D889F9677E5AF89315F0642ACE94A9B391D770F982CB90

Function 11061070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000020,00000071,00000078,.\crypto\bio\bio_lib.c,000000EF,?,?,?,?,1106552C,?,?,?,00000001,110655B4), ref: 110610C3

Strings

.\crypto\bio\bio_lib.c, xrefs: 110610B8, 11061107

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\crypto\bio\bio_lib.c
API String ID: 1767461275-2723797896
Opcode ID: 7a9f460c4e068a2789cea8b6c3d28b4a3003f604ff5031be03d7ed5a5fd2c936
Instruction ID: 3cd7ab1470c9b286ede21e44d6349f991e7d4d02afdad44255272efb39392ae2
Opcode Fuzzy Hash: 7a9f460c4e068a2789cea8b6c3d28b4a3003f604ff5031be03d7ed5a5fd2c936
Instruction Fuzzy Hash: 0A11E632F443013BF520D52DFC42F9B77DC9FC0B64F054159F948AA1D1EAA1B980C6A1

Function 120052D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 12004540: i2d_SSL_SESSION.SSLEAY32(?,00000000), ref: 12004583
Part of subcall function 12004540: CRYPTO_malloc.LIBEAY32(00000000,.\ssl\s3_srvr.c,00000D61), ref: 120045AC
Part of subcall function 12004540: EVP_CIPHER_CTX_init.LIBEAY32(?), ref: 120045C3
Part of subcall function 12004540: HMAC_CTX_init.LIBEAY32(?,?), ref: 120045D0
Part of subcall function 12004540: i2d_SSL_SESSION.SSLEAY32(?,?,?,?), ref: 120045E5
Part of subcall function 12004540: d2i_SSL_SESSION.SSLEAY32(00000000,?,00000000), ref: 12004601
Part of subcall function 12004540: i2d_SSL_SESSION.SSLEAY32 ref: 1200461D
Part of subcall function 12004540: i2d_SSL_SESSION.SSLEAY32(00000000,?,00000000,00000000), ref: 12004643
Part of subcall function 12004540: SSL_SESSION_free.SSLEAY32(00000000,?,?,00000000,00000000), ref: 12004654
Part of subcall function 12004540: BUF_MEM_grow.LIBEAY32(?,?,00000000,?,?,00000000,00000000), ref: 12004672

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C
BUF_MEM_free.LIBEAY32(?,?), ref: 120055AE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: i2d_$X_init$M_freeM_growN_freeO_ctrlO_mallocR_put_errord2i_
String ID: .\ssl\s3_srvr.c
API String ID: 4031021300-3445611115
Opcode ID: 3b5b8b027c8c75458a059ba999f4dbb6d5cd914433d10dbe23efe5e10a594903
Instruction ID: e8ea82174d90ee29e5d9ef7a03cec75584d6c1b128975067cd2cff11a72d0a3e
Opcode Fuzzy Hash: 3b5b8b027c8c75458a059ba999f4dbb6d5cd914433d10dbe23efe5e10a594903
Instruction Fuzzy Hash: 0D2147735017028BF321CF04E9845AEBBD2FB80789F410B3EE24157580D376F8059B49

Function 120052F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 12004AA0: BUF_MEM_grow.LIBEAY32(?,?), ref: 12004ACC

ERR_put_error.LIBEAY32(00000014,00000080,000000FF,.\ssl\s3_srvr.c,00000365), ref: 12004DB4
BIO_ctrl.LIBEAY32(?,0000000B,00000000,00000000), ref: 1200555C
BUF_MEM_free.LIBEAY32(?,?), ref: 120055AE

Strings

.\ssl\s3_srvr.c, xrefs: 12004DA3

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: M_freeM_growO_ctrlR_put_error
String ID: .\ssl\s3_srvr.c
API String ID: 234834961-3445611115
Opcode ID: c6abd66cf51c82a95930668fc0bd9ad5375df6a7558818de35576a432a67b905
Instruction ID: c35dbbf474f409f70d609e8a70cdcc6d2f4630463ddf007ea20727b4647aa3dd
Opcode Fuzzy Hash: c6abd66cf51c82a95930668fc0bd9ad5375df6a7558818de35576a432a67b905
Instruction Fuzzy Hash: 702147735017028BF321CF44E9845AEBBD2FB80789F410B3EE24657540C336F805AB4A

Function 12015510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,?,12018210,?), ref: 1201556F
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,0000080A,?,?,?,12018210,?), ref: 12015582

Strings

.\ssl\t1_lib.c, xrefs: 1201557C

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\t1_lib.c
API String ID: 2609694610-2047370388
Opcode ID: 144a8fa46f44948d836aca82456f283c084a4ec84322182540f0d9eaed5981a5
Instruction ID: f9a7a502fb1f57f3572b40a78ade036db69c90b45f2f434bb58a3f69fa610546
Opcode Fuzzy Hash: 144a8fa46f44948d836aca82456f283c084a4ec84322182540f0d9eaed5981a5
Instruction Fuzzy Hash: F821F673E012214BCB16CA38A8547EABBA7AB85325F09437AD85DDF382DB72D44197D0

Function 110611E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000020,00000068,00000078,.\crypto\bio\bio_lib.c,0000012B), ref: 1106122F
ERR_put_error.LIBEAY32(00000020,00000068,00000079,.\crypto\bio\bio_lib.c,00000121), ref: 11061277

Strings

.\crypto\bio\bio_lib.c, xrefs: 11061224, 1106126C

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\crypto\bio\bio_lib.c
API String ID: 1767461275-2723797896
Opcode ID: 22c13fcc501d5eda1ee936ec64cf05c3f234d1293656959e8cc5c959c0b4d906
Instruction ID: bbe30432781b1ecc111d7f1c386e9fe59127078b0b0e1e583faa4e4ab29bcffe
Opcode Fuzzy Hash: 22c13fcc501d5eda1ee936ec64cf05c3f234d1293656959e8cc5c959c0b4d906
Instruction Fuzzy Hash: C311E372F847153BF510E518BC46FA7779C9FC1B28F020159FA54AB1C1DA76A860C6A1

Function 11061130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000020,0000006E,00000078,.\crypto\bio\bio_lib.c,0000010D,?,?,?,110612BC,?,110F9204,?,?,1107573F,?,00000000), ref: 1106117B
ERR_put_error.LIBEAY32(00000020,0000006E,00000079,.\crypto\bio\bio_lib.c,00000103,?,110612BC,?,110F9204,?,?,1107573F,?,00000000,00000080), ref: 110611C8

Strings

.\crypto\bio\bio_lib.c, xrefs: 11061170, 110611BD

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\crypto\bio\bio_lib.c
API String ID: 1767461275-2723797896
Opcode ID: 37ad40124627d6a721319ec7b45a5e780fa9a135b2fa6586041cba801db131f8
Instruction ID: 3fb4c804ceb8a2d85304c588e0da6fa6f0eee3121512a51d1341ed314699d428
Opcode Fuzzy Hash: 37ad40124627d6a721319ec7b45a5e780fa9a135b2fa6586041cba801db131f8
Instruction Fuzzy Hash: A711C635F84712BBF660D51CAD42F97769D5FC0F24F110298FA546F2C1E6B1E940C691

Function 110B5100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(0000000E,00000070,00000043,.\crypto\conf\conf_lib.c,0000014F), ref: 110B5119

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

NCONF_get_string.LIBEAY32(?,?,?), ref: 110B5136

Strings

.\crypto\conf\conf_lib.c, xrefs: 110B510E

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: F_get_stringO_freeR_get_stateR_put_error
String ID: .\crypto\conf\conf_lib.c
API String ID: 2382375947-4105481173
Opcode ID: 20ef379b1d0e462b94b0a3fa49731349954ca4fffa5721c2e1da2b199d0261a9
Instruction ID: 653e872b1b43fa9cc32a8dd0902d5f93a6ed49e33a073bd1684205613692b199
Opcode Fuzzy Hash: 20ef379b1d0e462b94b0a3fa49731349954ca4fffa5721c2e1da2b199d0261a9
Instruction Fuzzy Hash: C611BF796001526BD315CE64DC80F6673E9EF89310F1404A9F6848B381E77AAA02C6A1

Function 120155F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?,?,?,00000000,12001C0D,?), ref: 1201566A
CRYPTO_malloc.LIBEAY32(?,.\ssl\t1_lib.c,0000082A,?,?,?,00000000,12001C0D,?), ref: 1201567F

Strings

.\ssl\t1_lib.c, xrefs: 12015679

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\t1_lib.c
API String ID: 2609694610-2047370388
Opcode ID: 1028f5de307a5e1f18a0ea25512b89bfedefb06bcf6582d4ac877ecdf86e1a10
Instruction ID: cb82adb7c3e70f81d4d79179abc3789c9758c0f5a8cde992c3ac2a1a89ede63b
Opcode Fuzzy Hash: 1028f5de307a5e1f18a0ea25512b89bfedefb06bcf6582d4ac877ecdf86e1a10
Instruction Fuzzy Hash: 03217CB52043409FD305CB25C844BA6B7F5EF88309F4886BCE5894F351DB76E845DB91

Function 1201A970 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SSL_extension_supported.SSLEAY32(?,?,?,1201AA43,?,?,?,?), ref: 1201A986
CRYPTO_realloc.LIBEAY32(?,?,.\ssl\t1_ext.c,000000F7), ref: 1201A9C0

Strings

.\ssl\t1_ext.c, xrefs: 1201A9B7

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: L_extension_supportedO_realloc
String ID: .\ssl\t1_ext.c
API String ID: 2810361572-2266425821
Opcode ID: 9fac8e7ae598438ab2a0e4b568d7147052d13848a813d63ced66c97a317e6075
Instruction ID: 0dd32487124428e499f9c200c1ea2b1469005dd5dee46b2c4b36098a9b355c6c
Opcode Fuzzy Hash: 9fac8e7ae598438ab2a0e4b568d7147052d13848a813d63ced66c97a317e6075
Instruction Fuzzy Hash: FA114FB66043068FD305CF28D840AA6B3E5EF45324B06467ED808CB365EB35E994DB91

Function 1200C0E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 1200C0FB
BUF_strdup.LIBEAY32(?), ref: 1200C144

Strings

.\ssl\s3_lib.c, xrefs: 1200C15F, 1200C170

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: F_strdupO_free
String ID: .\ssl\s3_lib.c
API String ID: 2295947540-3880942756
Opcode ID: ca7780c8efeddae0f64905e148a0cba1e16d4d61cc8b761498851584763a18cd
Instruction ID: 030c8f87a3736d579d63639fa284f93318b4a50bdb4e9557ef75c17d5307d3a8
Opcode Fuzzy Hash: ca7780c8efeddae0f64905e148a0cba1e16d4d61cc8b761498851584763a18cd
Instruction Fuzzy Hash: 88014CB37087439BF302CA348C547D6F7E59B51B49F004321EE45DB241E771D904A388

Function 12020B1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

sk_value.LIBEAY32(?,00000000), ref: 12020B4B
ERR_put_error.LIBEAY32(00000014,00000136,00000160,.\ssl\d1_srtp.c,00000161,?), ref: 12020B95

Strings

.\ssl\d1_srtp.c, xrefs: 12020B84

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_value
String ID: .\ssl\d1_srtp.c
API String ID: 2687124137-3998674507
Opcode ID: a5ff1ca1adcd89c36d05b72ce46c50c9549e6fab35a7852583fe64b930a51028
Instruction ID: 34f997c9686656f28773c6ddfddc8710ebc14ade02267fbea1187639b0478f52
Opcode Fuzzy Hash: a5ff1ca1adcd89c36d05b72ce46c50c9549e6fab35a7852583fe64b930a51028
Instruction Fuzzy Hash: 85014C336043519BC723CF149C90B6BB7F2ABD0709F4906AAF9C51B181D2B1D545D793

Function 120168E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

.\ssl\t1_lib.c, xrefs: 12016923

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID:
String ID: .\ssl\t1_lib.c
API String ID: 0-2047370388
Opcode ID: d33e7b0d853887a081ec2373dccca5015c6be7c8f471d15efeab8df1356506ca
Instruction ID: 4f9b8d3eda3d3b7488b8e3c83771674e4e98fb7e7a1dc7a844e8c9df17a7eda9
Opcode Fuzzy Hash: d33e7b0d853887a081ec2373dccca5015c6be7c8f471d15efeab8df1356506ca
Instruction Fuzzy Hash: 9A01D173B042015FD391CB28FC44FE7B3E89BC4724F050179F488DB245D620E882A691

Function 1202BB20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000AE,00000043,.\ssl\ssl_rsa.c,00000261), ref: 1202BB3C
ERR_put_error.LIBEAY32(00000014,000000AE,00000041,.\ssl\ssl_rsa.c,00000265), ref: 1202BB73

Strings

.\ssl\ssl_rsa.c, xrefs: 1202BB2E, 1202BB65

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: a31ffd9ecaca724b84e0b352c399af40662131ce6f5b99701729c10c1a7dbd86
Instruction ID: 855772720aa81c633e1d3c969c2102477b50310881ad6475b7b3d541d73946be
Opcode Fuzzy Hash: a31ffd9ecaca724b84e0b352c399af40662131ce6f5b99701729c10c1a7dbd86
Instruction Fuzzy Hash: B7F0E9B77C87043AF542D31CBC42F9773545B80720F9A4236FA4ABA1C5F5E1B1912066

Function 1202B580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000C9,00000043,.\ssl\ssl_rsa.c,00000133), ref: 1202B59C
ERR_put_error.LIBEAY32(00000014,000000C9,00000041,.\ssl\ssl_rsa.c,00000137), ref: 1202B5D3

Strings

.\ssl\ssl_rsa.c, xrefs: 1202B58E, 1202B5C5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 31fd15e36672377a1caafa8b11a1c56f43dc0bafcd975fea63d4e21890084e15
Instruction ID: bd78096b47ea8f67abb19d312147dc98aa416a9872618aaf6c8b1271b7faa20a
Opcode Fuzzy Hash: 31fd15e36672377a1caafa8b11a1c56f43dc0bafcd975fea63d4e21890084e15
Instruction Fuzzy Hash: 11F059BB7C42003AF542D31CBC03FD6A3444F90720F994232FA0ABA2C4F5A0B35060A6

Function 1202C340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000C6,00000043,.\ssl\ssl_rsa.c,00000048), ref: 1202C359
ERR_put_error.LIBEAY32(00000014,000000C6,00000041,.\ssl\ssl_rsa.c,0000004C), ref: 1202C38D

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C34B, 1202C37F

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: 4573630cf5d7aeb720c979c47ed9bf27002ad8f00b5c3b0af0fe21d1d7ba1a9e
Instruction ID: f523e3f00bb8f15e7f14b7e293565e3c531e93bf7767bb8995c104348ad3c428
Opcode Fuzzy Hash: 4573630cf5d7aeb720c979c47ed9bf27002ad8f00b5c3b0af0fe21d1d7ba1a9e
Instruction Fuzzy Hash: D4F0AEF7FC130037F561D7A45C82F8763845B14711F554532FB0EAA1C1F5A5A1647159

Function 12020BC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,00000134,0000016B,.\ssl\d1_srtp.c,0000016F,12014FD1,?,00000000,?,00000000), ref: 12020BE9
ERR_put_error.LIBEAY32(00000014,00000134,00000171,.\ssl\d1_srtp.c,00000175,12014FD1,?,00000000,?,00000000), ref: 12020C1A

Strings

.\ssl\d1_srtp.c, xrefs: 12020BD8, 12020C09

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\d1_srtp.c
API String ID: 1767461275-3998674507
Opcode ID: 4c417b92b3a12b1d04a39915fb275edf7c017911a9877ba9331b5df5c3c44163
Instruction ID: 222a46945190082b72e213bc7c2c5d6b4c6a55c7e9c596cd0309cb1ec3b6f448
Opcode Fuzzy Hash: 4c417b92b3a12b1d04a39915fb275edf7c017911a9877ba9331b5df5c3c44163
Instruction Fuzzy Hash: B801B175288380AEE743C724CC59B82BBE26B51705F4A81E8E1880F2C2CBB69509E721

Function 1202C7D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000AB,00000043,.\ssl\ssl_rsa.c,0000017E), ref: 1202C7EC
ERR_put_error.LIBEAY32(00000014,000000AB,00000041,.\ssl\ssl_rsa.c,00000182), ref: 1202C823

Strings

.\ssl\ssl_rsa.c, xrefs: 1202C7DE, 1202C815

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_rsa.c
API String ID: 1767461275-614043423
Opcode ID: ff9c85a03b721f5fd7f844c597cb850a8005b695eb462193b82d9874c54b04ea
Instruction ID: 03a4772bfb825c5da80b5eb016c9b6ba4e35c8596c4608a30a607a0f195c3475
Opcode Fuzzy Hash: ff9c85a03b721f5fd7f844c597cb850a8005b695eb462193b82d9874c54b04ea
Instruction Fuzzy Hash: 1FF0E2F7B803003BF542E7A8AC82FC733844B04711F994572FA4AAA1C1E6A1A26061A6

Function 11045100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000004,0000006F,0000006D,.\crypto\rsa\rsa_none.c,00000057), ref: 1104511B

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

_memset.LIBCMT ref: 11045136

Strings

.\crypto\rsa\rsa_none.c, xrefs: 11045110

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: O_freeR_get_stateR_put_error_memset
String ID: .\crypto\rsa\rsa_none.c
API String ID: 1187584809-1580155239
Opcode ID: e4ca231704a9830c82360e86dcdf9484bccbcae8081102de53d6d2500a4396ae
Instruction ID: 4b21ed88ea347d877d42d02071a16896c294f8b754d7973171a1f8718e0ebed5
Opcode Fuzzy Hash: e4ca231704a9830c82360e86dcdf9484bccbcae8081102de53d6d2500a4396ae
Instruction Fuzzy Hash: E1F0A7B6B4431227D510D91D5C81F5BA35D9BD5638F140669F754AB2C1C661A80141E1

Function 12025320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000DE,00000043,.\ssl\ssl_cert.c,0000020D,?,1202B5B9,?), ref: 1202533C
ERR_put_error.LIBEAY32(00000014,000000DE,00000041,.\ssl\ssl_cert.c,00000212,?,1202B5B9,?), ref: 1202536B

Strings

.\ssl\ssl_cert.c, xrefs: 1202532E, 1202535D

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_cert.c
API String ID: 1767461275-3404700246
Opcode ID: c287d119c00722f17f77b39a874ee5b5676405360ad875c3ad7838a55aae8849
Instruction ID: 950bfbb9b4efc376a0f3c1f7b2de2145292c05f748e2b8fef18efe5163988e88
Opcode Fuzzy Hash: c287d119c00722f17f77b39a874ee5b5676405360ad875c3ad7838a55aae8849
Instruction Fuzzy Hash: B9E0E573BC03567AFA92A764BC42FC1A2804B00B10F860132B2467D4C1E4E184C021E0

Function 12022640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 12022651
CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_lib.c,000006F4), ref: 12022668

Strings

.\ssl\ssl_lib.c, xrefs: 12022662

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\ssl_lib.c
API String ID: 2609694610-3333140318
Opcode ID: 999ea5ee0eaa4e19c0ac4bea826a7740cc36698d468299b7b1c26c179990a409
Instruction ID: 2ccf41b920498a55fb9afbd971b58bccc889b3de75f882f5492ed768320ad445
Opcode Fuzzy Hash: 999ea5ee0eaa4e19c0ac4bea826a7740cc36698d468299b7b1c26c179990a409
Instruction Fuzzy Hash: 20F0A0B7B042126FD741DB69BC04ADBF7A8AF90321F05063BF818E3200EA70F85192D2

Function 120225E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 120225F1
CRYPTO_malloc.LIBEAY32(?,.\ssl\ssl_lib.c,000006E0), ref: 12022608

Strings

.\ssl\ssl_lib.c, xrefs: 12022602

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\ssl_lib.c
API String ID: 2609694610-3333140318
Opcode ID: 6ab3cd1877b2b3399adb628bc325c67c33cbcfe81f69bc97fb3bc11156e1fea9
Instruction ID: 4f0a8203570827fb2a8b6a67808f7e9349b1e6578ff3c10d7045a539bc0eb1b2
Opcode Fuzzy Hash: 6ab3cd1877b2b3399adb628bc325c67c33cbcfe81f69bc97fb3bc11156e1fea9
Instruction Fuzzy Hash: A5F082B7B05212ABE741DB65AC05ADBF798EF84350F04063AF804D3240E771F8519291

Function 12021F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000), ref: 12021FBE
ERR_put_error.LIBEAY32(00000014,0000010F,000000B9,.\ssl\ssl_lib.c,00000578), ref: 12021FE0

Strings

.\ssl\ssl_lib.c, xrefs: 12021FCF

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_num
String ID: .\ssl\ssl_lib.c
API String ID: 3777708388-3333140318
Opcode ID: e80248692cb30620168f161cdd56503b89a3b9f515b97173f15bd6da9a16167d
Instruction ID: ae4840048ff1d60f5e22c0f9802079515fc37107799d8dcbe83adcd04863292b
Opcode Fuzzy Hash: e80248692cb30620168f161cdd56503b89a3b9f515b97173f15bd6da9a16167d
Instruction Fuzzy Hash: 9DF089BA7402006FE741D760CC41FA772E45B84701F4546B9B91A572A2FA61E800D551

Function 110450A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000004,0000006B,0000006E,.\crypto\rsa\rsa_none.c,00000045), ref: 110450B9

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

ERR_put_error.LIBEAY32(00000004,0000006B,0000007A,.\crypto\rsa\rsa_none.c,0000004A), ref: 110450D3

Strings

.\crypto\rsa\rsa_none.c, xrefs: 110450AE, 110450C8

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_state
String ID: .\crypto\rsa\rsa_none.c
API String ID: 4246747085-1580155239
Opcode ID: 1d4820536f7a2f4687ed12cd7ac606801b1b6f9316cfcb81fd8a6f7869b3aabd
Instruction ID: 7dc02fea7553dfee3d347f527e22de87cb024bb102fae07cff7d09f52c1d6abe
Opcode Fuzzy Hash: 1d4820536f7a2f4687ed12cd7ac606801b1b6f9316cfcb81fd8a6f7869b3aabd
Instruction Fuzzy Hash: E1F09BECF8034337E660D6248D43F1B32966794B0AF500C68F30DEA5C6EAB6E4508166

Function 1200B170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBEAY32(?), ref: 1200B17B
CRYPTO_malloc.LIBEAY32(?,.\ssl\s3_lib.c,000010F1), ref: 1200B1AB

Strings

.\ssl\s3_lib.c, xrefs: 1200B1A5

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_freeO_malloc
String ID: .\ssl\s3_lib.c
API String ID: 2609694610-3880942756
Opcode ID: f4b23da22b9d9da408a0dd929f3253230b13b8315199c2dfb2b58fcc1774a747
Instruction ID: c9329433a799bd52788749b2a39331f1a2f4f90ae74c44763aabc778ed603615
Opcode Fuzzy Hash: f4b23da22b9d9da408a0dd929f3253230b13b8315199c2dfb2b58fcc1774a747
Instruction Fuzzy Hash: 18F0E5F3E40B0156FB22CE369C42BE3B5E85F80785F40063CB94981180FF74E800B555

Function 12021F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

sk_num.LIBEAY32(00000000), ref: 12021F58
ERR_put_error.LIBEAY32(00000014,0000010D,000000B9,.\ssl\ssl_lib.c,00000567), ref: 12021F7A

Strings

.\ssl\ssl_lib.c, xrefs: 12021F69

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_errorsk_num
String ID: .\ssl\ssl_lib.c
API String ID: 3777708388-3333140318
Opcode ID: 2d442b474674a8b805aaca1fa4b45c60b1b647e98fd9286399dbcc479e483b5e
Instruction ID: e34ff2e223cb896884636f35fe636895164023e743494f780d56f738d0fe8b18
Opcode Fuzzy Hash: 2d442b474674a8b805aaca1fa4b45c60b1b647e98fd9286399dbcc479e483b5e
Instruction Fuzzy Hash: 6AF030FF7442007FEB41D764CC45FA772E89B88B01F8686B4B9069B292F670E900E561

Function 12026450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

X509_STORE_free.LIBEAY32(?,?,1200BAEE,?,?,?,?), ref: 12026471
CRYPTO_add_lock.LIBEAY32(-00000044,00000001,0000000B,.\ssl\ssl_cert.c,000004ED,1200BAEE,?,?,?,?), ref: 1202649D

Strings

.\ssl\ssl_cert.c, xrefs: 12026490

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: E_freeO_add_lockX509_
String ID: .\ssl\ssl_cert.c
API String ID: 2773195634-3404700246
Opcode ID: af31370ee8456cf94d2569c2c7552ee598a23f40346c2e4ed90ebf35158fd5d6
Instruction ID: 7d6deba8d7a9984858cd9cdf1ecb145cf0bc16e3e7a012af23172d7116f9b6a1
Opcode Fuzzy Hash: af31370ee8456cf94d2569c2c7552ee598a23f40346c2e4ed90ebf35158fd5d6
Instruction Fuzzy Hash: D8F065B3E44301AFFB11CA54CD01BDBB3E85B54719F85C53ABDC8AB284E275E8409692

Function 12021830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000D0,00000114,.\ssl\ssl_lib.c,00000416), ref: 12021850
ERR_put_error.LIBEAY32(00000014,000000D0,000000CF,.\ssl\ssl_lib.c,0000041C), ref: 1202187F

Strings

.\ssl\ssl_lib.c, xrefs: 1202183F, 1202186B

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 1767461275-3333140318
Opcode ID: f24e7bf8a2948db137d01838a77ba60df3f9d89649e18c4950a98bb9ddce0cc6
Instruction ID: 109d46687291dab9f4a47cf3b98a2bacd35bf1e9c4ae01f8bd8c09d65c889f05
Opcode Fuzzy Hash: f24e7bf8a2948db137d01838a77ba60df3f9d89649e18c4950a98bb9ddce0cc6
Instruction Fuzzy Hash: C6F0A7B97C0304BFF655D7248C42F857A916B40B14F9647B8B7196F5E3E3B1D840A514

Function 1202F760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBEAY32(00000018,.\ssl\bio_ssl.c,0000006A), ref: 1202F769
ERR_put_error.LIBEAY32(00000020,00000076,00000041,.\ssl\bio_ssl.c,0000006C), ref: 1202F784

Strings

.\ssl\bio_ssl.c, xrefs: 1202F762, 1202F779

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: .\ssl\bio_ssl.c
API String ID: 2513334388-1980322992
Opcode ID: 83299df036545a8ab64fc5d3da243e92f54c28fa1956512c2dd42bd239ba281f
Instruction ID: a4304bed309f2f4d73de0f4f0f8bec4f26b79baf94b46b505c49921f81199cc7
Opcode Fuzzy Hash: 83299df036545a8ab64fc5d3da243e92f54c28fa1956512c2dd42bd239ba281f
Instruction Fuzzy Hash: 2CF05EB1A853009FE748CF18A806B41BAE0BB08701F46C2BEB50EDF392C674C1409A45

Function 12024210 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ERR_put_error.LIBEAY32(00000014,000000E0,00000114,.\ssl\ssl_lib.c,0000042C), ref: 12024230

Strings

.\ssl\ssl_lib.c, xrefs: 1202421F, 12024256

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: R_put_error
String ID: .\ssl\ssl_lib.c
API String ID: 1767461275-3333140318
Opcode ID: 821a7fe2140d7c8bb5373190f81b15e2aeb8b39a7b740f7b063fe0ffcd559b2f
Instruction ID: 9708b85330714841a279e7008c1acf86b6087e916fb2b26342fa6326cf1fd255
Opcode Fuzzy Hash: 821a7fe2140d7c8bb5373190f81b15e2aeb8b39a7b740f7b063fe0ffcd559b2f
Instruction Fuzzy Hash: 07F0E5B6B80300BFF642D710CC43F5A7AA09B44F20FD283A8B6296E0D3E3F0D941A114

Function 120269F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000E,.\ssl\ssl_sess.c,000000A5), ref: 120269FF
CRYPTO_lock.LIBEAY32(0000000A,0000000E,.\ssl\ssl_sess.c,000000A9), ref: 12026A29

Strings

.\ssl\ssl_sess.c, xrefs: 120269F6, 12026A20

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock
String ID: .\ssl\ssl_sess.c
API String ID: 1396966674-1959455021
Opcode ID: 6c456a2f0b04a5fed76c88249ca59e4e303314e62ec9f5acf1c64d9d875fcb08
Instruction ID: 56d828c45284a6c19c4c51209b026720d66714a7ce675c73c7d181a16b47d0b5
Opcode Fuzzy Hash: 6c456a2f0b04a5fed76c88249ca59e4e303314e62ec9f5acf1c64d9d875fcb08
Instruction Fuzzy Hash: 98E0C237BC23106EF220E348DC02FE1A2509F11F42F054B90BF583F2C2E0D0584062D2

Function 110A7080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

s2i_ASN1_INTEGER.LIBEAY32(00000000,?), ref: 110A7087

Part of subcall function 110A3660: ERR_put_error.LIBEAY32(00000022,0000006C,0000006D,.\crypto\x509v3\v3_utl.c,000000B6,?,1108E5BD,00000000), ref: 110A368B

ERR_put_error.LIBEAY32(00000022,0000007D,00000083,.\crypto\x509v3\v3_sxnet.c,0000009D), ref: 110A70A6

Part of subcall function 1106C490: ERR_get_state.LIBEAY32(?,00000000,11060CC0,00000007,00000068,00000041,.\crypto\buffer\buf_str.c,0000005E), ref: 1106C492
Part of subcall function 1106C490: CRYPTO_free.LIBEAY32(?), ref: 1106C545

Strings

.\crypto\x509v3\v3_sxnet.c, xrefs: 110A7098

Memory Dump Source

Source File: 00000003.00000002.2027907370.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2027831757.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2033183445.00000000110E7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035211895.000000001113D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035301395.000000001113F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035401374.0000000011142000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2035551546.0000000011149000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_rutserv.jbxd

Similarity

API ID: R_put_error$O_freeR_get_states2i_
String ID: .\crypto\x509v3\v3_sxnet.c
API String ID: 3275821782-1855245706
Opcode ID: c65f817dd8fa8c4c9584e3545db680993e5db24310f850bbdcec0138596981e8
Instruction ID: b99f5b4b83349cf52983786ad4f234f91cff55ce750fc7b7b80214c9a8b10d55
Opcode Fuzzy Hash: c65f817dd8fa8c4c9584e3545db680993e5db24310f850bbdcec0138596981e8
Instruction Fuzzy Hash: F6D0A7A8FC830276E910E6F0AC03F5B76E81B94F49F008424BB0DDC1C2FEA09100C122

Function 12020ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,0000000C,.\ssl\ssl_lib.c,000001D3), ref: 12020EDE
CRYPTO_lock.LIBEAY32(0000000A,0000000C,.\ssl\ssl_lib.c,000001D5,00000009,0000000C,.\ssl\ssl_lib.c,000001D3), ref: 12020EFF

Strings

.\ssl\ssl_lib.c, xrefs: 12020ED5, 12020EF0

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock
String ID: .\ssl\ssl_lib.c
API String ID: 1396966674-3333140318
Opcode ID: 2ecc98865011fc98052f033ec0e5ed6f3c9d0b522e1844ffe00b8c8e196caf80
Instruction ID: 96c9c9d42dca1c6d7ed39a984dc7cd7a9cbe1f8d135e66940c4ff8117cd22aa3
Opcode Fuzzy Hash: 2ecc98865011fc98052f033ec0e5ed6f3c9d0b522e1844ffe00b8c8e196caf80
Instruction Fuzzy Hash: ECD0A5357C430066F610E750CC62FD777515744F01F004718B6103E9C3F4D158015712

Function 12020F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_lock.LIBEAY32(00000009,00000010,.\ssl\ssl_lib.c,000001DB), ref: 12020F1E
CRYPTO_lock.LIBEAY32(0000000A,00000010,.\ssl\ssl_lib.c,000001DD,00000009,00000010,.\ssl\ssl_lib.c,000001DB), ref: 12020F3F

Strings

.\ssl\ssl_lib.c, xrefs: 12020F15, 12020F30

Memory Dump Source

Source File: 00000003.00000002.2035873623.0000000012001000.00000020.00000001.01000000.00000008.sdmp, Offset: 12000000, based on PE: true

Associated: 00000003.00000002.2035772629.0000000012000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037263103.000000001203F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037543867.000000001204D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037593158.000000001204E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2037690250.0000000012053000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12000000_rutserv.jbxd

Similarity

API ID: O_lock
String ID: .\ssl\ssl_lib.c
API String ID: 1396966674-3333140318
Opcode ID: bab2e3f3791814aeb27167be12dd8f24e9fe403801b81419187c9be2cbf55dcf
Instruction ID: 94ecdd7bbb46382db53c67b95543d011b87df851fe54f9e5bdba8ca97eb0a49f
Opcode Fuzzy Hash: bab2e3f3791814aeb27167be12dd8f24e9fe403801b81419187c9be2cbf55dcf
Instruction Fuzzy Hash: BAD05E3AB843006AF610DB908CA2FD5A650AB48F01F004A68BA403EAC3E5E26841A216

Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1691555824.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevp8decoder.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1810927214.000000007ACE4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevp8decoder.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1692274270.000000007FD40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevp8encoder.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780195201.000000007FE00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmmux.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1699206006.000000007FCF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1695396902.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmvorbisencoder.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1808351802.000000007FE1F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmvorbisencoder.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1690906381.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1676731888.000000007FD40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1775703239.000000007FDE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevp8decoder.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1774910474.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1693900507.000000007FE00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmmux.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1776550532.000000007FCBE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevp8encoder.dllP vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1700928542.000000007FA4E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1780878867.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmvorbisdecoder.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe
Source: SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe, 00000000.00000003.1694578650.000000007FDF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewebmvorbisdecoder.dllH vs SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\EULA.rtf

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\eventmsg.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\libeay32.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rfusclient.exe

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\rutserv.exe

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\settings.dat

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\ssleay32.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8decoder.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\vp8encoder.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmmux.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisdecoder.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\70020\DBEBCA0792\webmvorbisencoder.dll

C:\Users\user\AppData\Roaming\Remote Utilities Agent\Logs\rut_log_2024-05.html

C:\Users\user\AppData\Roaming\Remote Utilities Agent\Logs\rut_log_2024-07.html

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_09E960F015FF4A8F16C13B5E9BAAA43F

Windows Analysis Report
SecuriteInfo.com.PUA.Tool.RemoteControl.18.25736.20264.exe

Function 1106A900 Relevance: 159.9, APIs: 64, Strings: 27, Instructions: 603
libraryloadermemoryCOMMON

Function 11002690 Relevance: .0, Instructions: 21
COMMON

Function 110D2BFE Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Function 12037987 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Function 110DD4AD Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre