Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe
Analysis ID:	1538279
MD5:	f937d31f13fcd8a8ad2bf6b231f2702f
SHA1:	048c894872b31484b39ffc86f38705baa80be950
SHA256:	ee559187bda33c1d7b223fae61887d5c527ed413e788d3f377a5d6e76d53c220
Tags:	exe
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe" MD5: F937D31F13FCD8A8AD2BF6B231F2702F)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

cmd.exe (PID: 7640 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7656 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7684 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7700 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7732 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7748 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7792 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7808 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7824 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7852 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7868 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7920 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7940 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7980 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7996 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8028 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8044 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 8060 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 8072 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 8092 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 8140 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 8156 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 8184 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7184 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7260 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7304 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7384 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7044 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 524 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4444 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5636 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WerFault.exe (PID: 5436 cmdline: C:\Windows\system32\WerFault.exe -u -p 7548 -s 996 MD5: 59550DE0393B1CDD584A1467D6D734E7)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2BCDD strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF73AD2BCDD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD4EBE0 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF73AD4EBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD50CD0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF73AD50CD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2DFC0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF73AD2DFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2AFD0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF73AD2AFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2DFB0 CryptHashData,	0_2_00007FF73AD2DFB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2DF60 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF73AD2DF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2B0A0 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF73AD2B0A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD48190 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF73AD48190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD47870 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF73AD47870

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF73AD10E80
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF73AD3A8A0

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.3:63891 version: TLS 1.2

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Fivem Cheat e Spoofer C++\Auth Fivem C++\x64\Release\EpicGames.pdb source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 47Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 172.67.72.57 172.67.72.57

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD07B60 malloc,recv,free,

0_2_00007FF73AD07B60

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 47Content-Type: application/x-www-form-urlencoded

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	String found in binary or memory: http://185.101.104.122/Runtimess.exe
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	String found in binary or memory: http://185.101.104.122/Runtimess.exeC:
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/Micro
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/pace
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/Commo
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/fivem

Source: unknown	Network traffic detected: HTTP traffic on port 63891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63891

Source: unknown

HTTPS traffic detected: 172.67.72.57:443 -> 192.168.2.3:63891 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD4EBE0 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF73AD4EBE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2BCDD	0_2_00007FF73AD2BCDD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD19A60	0_2_00007FF73AD19A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD21330	0_2_00007FF73AD21330
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD1A720	0_2_00007FF73AD1A720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD18720	0_2_00007FF73AD18720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD4EBE0	0_2_00007FF73AD4EBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFEB60	0_2_00007FF73ACFEB60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD50C60	0_2_00007FF73AD50C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFB97D	0_2_00007FF73ACFB97D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD29A60	0_2_00007FF73AD29A60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACF1000	0_2_00007FF73ACF1000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD3EFC0	0_2_00007FF73AD3EFC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFDFD0	0_2_00007FF73ACFDFD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD150D0	0_2_00007FF73AD150D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2BD9C	0_2_00007FF73AD2BD9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2BDA5	0_2_00007FF73AD2BDA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD123A0	0_2_00007FF73AD123A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD2E370	0_2_00007FF73AD2E370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD43350	0_2_00007FF73AD43350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD42320	0_2_00007FF73AD42320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFA4BB	0_2_00007FF73ACFA4BB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD27180	0_2_00007FF73AD27180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFA2DD	0_2_00007FF73ACFA2DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD3B2C0	0_2_00007FF73AD3B2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD36790	0_2_00007FF73AD36790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD0A730	0_2_00007FF73AD0A730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73ACFF8F0	0_2_00007FF73ACFF8F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD47870	0_2_00007FF73AD47870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD1B5E0	0_2_00007FF73AD1B5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD24630	0_2_00007FF73AD24630

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD52122 appears 47 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD1C040 appears 37 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD04DD0 appears 49 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD17890 appears 324 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD1C0D0 appears 33 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD1AB50 appears 46 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD11FE0 appears 70 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD1AC20 appears 36 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD1C1B0 appears 34 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: String function: 00007FF73AD17710 appears 380 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7548 -s 996

Source: classification engine

Classification label: mal64.evad.winEXE@69/22@1/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD03BEE FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF73AD03BEE

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7548

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\5c308abb-b4bd-4c94-82ac-d3f0ad741560

Jump to behavior

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

ReversingLabs: Detection: 50%

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@8t

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7548 -s 996
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD1A400 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF73AD1A400

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-48234

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

API coverage: 3.9 %

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: VMware-42 27 9c 31 6b 7d 78 89-be 90 b3 22 a5 ab 1b 52
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWbl
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD51C30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF73AD51C30

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD51FC8 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF73AD51FC8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD1A400 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF73AD1A400

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73ACF28E0 GetProcessHeap,

0_2_00007FF73ACF28E0

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD51C30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73AD51C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD51DD8 SetUnhandledExceptionFilter,	0_2_00007FF73AD51DD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD518C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73AD518C8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Code function: 0_2_00007FF73AD51E44 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF73AD51E44

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD26800 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF73AD26800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD193D0 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF73AD193D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD3D4F0 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF73AD3D4F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD3D2BE calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF73AD3D2BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	Code function: 0_2_00007FF73AD36790 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF73AD36790

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	50%	ReversingLabs	Win64.Trojan.Generic
SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	100%	Avira	HEUR/AGEN.1315669
SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	172.67.72.57	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
https://keyauth.win/api/1.1/Micro	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/Runtimess.exeC:	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	false		unknown
https://keyauth.win/api/1.1/pace	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/Runtimess.exe	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	false		unknown
https://curl.haxx.se/docs/http-cookies.html	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe	false		unknown
https://keyauth.win/api/1.2/	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.2/fivem	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://keyauth.win/api/1.2/Commo	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe, 00000000.00000002.1589581590.0000016CC830C000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.72.57	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538279
Start date and time:	2024-10-20 23:23:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@69/22@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 42 Number of non-executed functions: 244
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, watson.events.data.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollectorcommon.trafficmanager.net, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Simulations

Behavior and APIs

Time	Type	Description
17:25:09	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.72.57	SecuriteInfo.com.Win64.MalwareX-gen.10159.8143.exe	Get hash	malicious	Unknown	Browse
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse
	Iyto7FYCJO.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74313215.18321.7540.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.640280.26081.14300.exe	Get hash	malicious	Unknown	Browse
	fox vanguard bypass.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.8867.28776.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.28454.21428.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MulDrop28.40.18458.1049.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SecuriteInfo.com.Win64.MalwareX-gen.29573.28124.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.10159.8143.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.6639.30242.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.FileRepMalware.16016.24947.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.25010.24037.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.Evo-gen.20107.17462.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.Generic.36879400.484.7364.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.29573.28124.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.10159.8143.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.6639.30242.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.FileRepMalware.16016.24947.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.25010.24037.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	d600758023374f78d58acafbcaf94af66ad203b28e22a.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	SecuriteInfo.com.Win64.Evo-gen.20107.17462.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	d600758023374f78d58acafbcaf94af66ad203b28e22a.exe	Get hash	malicious	Quasar	Browse	172.67.72.57
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	J1un7vGf29.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	flX5YA1C09.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	bC7vK74a5a.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	G9e272AEyo.exe	Get hash	malicious	Unknown	Browse	172.67.72.57

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9bcc7898be1d4f9191567bd4d21a8cc341545d_d57ade92_b850ab27-e49f-4e0e-82ff-71445e2a72d7\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0503684392305133
Encrypted:	false
SSDEEP:	192:vp77nudBNOv09Wg1s6tjFPzlSuiFoH4lO8ZNT:B7judBNOc9Wge6tjTSuiFoH4lO8ZNT
MD5:	8444E73F025A13FE357DF1AD8EC66754
SHA1:	9B6B8E1806C5E700578C8FA884DD1F2A71DB6EC0
SHA-256:	7E8C606C40ADACCBC2475CEED9D4A7AB6A3E0E991011DEFF2D613DD36FBED60B
SHA-512:	C8F2BBEAE788C87A63D7872713DD74DF515EA592B1C8FE572FB2F625AD06D6AA13BEBBD92E718AC87A5AEC3BBFFBE55FEC4EB1F3636FF2D4345BED91F13AA24D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.3.3.0.9.7.7.0.5.5.2.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.3.3.0.9.8.2.2.1.1.3.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.5.0.a.b.2.7.-.e.4.9.f.-.4.e.0.e.-.8.2.f.f.-.7.1.4.4.5.e.2.a.7.2.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.7.5.7.d.8.b.-.2.b.5.7.-.4.7.a.d.-.8.8.f.3.-.8.5.e.d.7.7.d.9.f.e.8.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.6.4...D.r.o.p.p.e.r.X.-.g.e.n...1.8.6.0.6...1.8.3.5.6...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.5.-.a.0.0.b.-.8.f.7.e.3.6.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.b.c.8.f.1.2.5.5.7.b.e.f.2.5.4.4.8.2.d.5.1.8.5.0.8.a.4.2.e.b.9.0.0.0.0.f.f.f.f.!.0.0.0.0.0.4.8.c.8.9.4.8.7.2.b.3.1.4.8.4.b.3.9.f.f.c.8.6.f.3.8.7.0.5.b.a.a.8.0.b.e.9.5.0.!.S.e.c.u.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4798.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Oct 20 21:24:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	109686
Entropy (8bit):	1.5785979257615157
Encrypted:	false
SSDEEP:	384:u7BD/mG0/6RuKCl1/6i8bo9NwgG+KEhY9UKrQs/iYhjt:u7BD/mG0yRuKCl1ygGX0XYh
MD5:	32F1870D94C403C696467E45B310C87B
SHA1:	CFFC1D95659992EB9131B05C0A5035FE66AD2F1C
SHA-256:	0491C30BCA69CFF557D99B12A222609C1B207776D415589C00DA2C3B6A3C8760
SHA-512:	C073A2CAF198E3AF1FB7525FB3B467E6138038E974BCD12293462603BB76B81A349926FAD59EE4A4205D3B306ABC7EDD5F152B18C6927222422FA85276AEA93C
Malicious:	false
Preview:	MDMP..a..... .......)u.g............$...............,...........zK..........T.......8...........T...........p'..............< ..........("..............................................................................eJ......."......Lw......................T.......\|...!u.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4883.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10362
Entropy (8bit):	3.7188198260631404
Encrypted:	false
SSDEEP:	192:R6l79RJOQvm6YwZmO7dLgmfzq/plprt89bSf3fJmm:R6lXJOgm6YuJ7dLgmfzq/pCSPfB
MD5:	BBD746F5F7F89CA293913D07DA495A46
SHA1:	D798FC21870F8850FE89E29988E44C8CD938E55C
SHA-256:	DBD111D88A5FD88FE08606560B98A4655A13B24F915A7802F57EC01CABEADCC9
SHA-512:	6D613F03A271BB8E9613BF8E94A5001EC1C0C83DA5C3B544D74AEF0B99FE0A2EFA1CDED9BA6F1101A2CA169D306A62DE791CE90B77F78F36CEE7094D3626C14A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...3.4.4.8...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.3.4.4.8.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48C3.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4907
Entropy (8bit):	4.572930343917319
Encrypted:	false
SSDEEP:	48:cvIwr7SGl8zsgJgkZ71I9JAlXWpW8VY1Ym8M4J5Rb8LFFqkTyq85dOS22kPYPbd:uIafmh7sAlm7VlJWqkTR240bd
MD5:	1081ABD6787AC3A7E97D26694EBFB3B3
SHA1:	1747084C1F06EB4574D688FFDA9A48A0FD34E859
SHA-256:	02DE1C2B3B25619CB8441AF8B0154564F17BC65B04C485A2E073590CE402F047
SHA-512:	D7BD09E3DD9C9F86724651187CE52A8CDAB7447E4FD41194AF90B7955805F5E5B11CBE3B7BA7CF9AB0B6F4E4CF7806A6CE1C8B5C22DC5E838B6958D07A13C277
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="3448" />.. <arg nm="verqfe" val="3448" />.. <arg nm="csdbld" val="3448" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222896057" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.327533570170789
Encrypted:	false
SSDEEP:	6144:zRJufhX4RxLT+y6H4A0WBIIQfTa765q/E5ySvL+ML61VhcRo5d5OWiBe9u:lJQ3BIdBvL+S6cIdYFcu
MD5:	046E9A7714D95161855CA438FE561C2E
SHA1:	65E1268B6BDC3C2C901AB3A18CAF1477DA71C6F3
SHA-256:	4CB949D7A4F09DA193C8C223FEAABBB2B50D1A03E3DFDE61E65B1DAE2F15BBBF
SHA-512:	A4B8906EF7E43F1F23E47BA648FAC273044EFB8431B05007EDB72AA777917983CA8605240D2AA9B420D3209CF5F5C4A305688C08E0E2C49D7486853DF5495284
Malicious:	false
Preview:	regfO...O....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..R.6#..............................................................................................................................................................................................................................................................................................................................................&8F.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.422095119373222
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe
File size:	519'168 bytes
MD5:	f937d31f13fcd8a8ad2bf6b231f2702f
SHA1:	048c894872b31484b39ffc86f38705baa80be950
SHA256:	ee559187bda33c1d7b223fae61887d5c527ed413e788d3f377a5d6e76d53c220
SHA512:	8b02f0c10f7e6e8a996f1e4fe3d0ef175cad9fb190ed3b1373d3d8d44bde1e4623012cb6cd59a7d91213f0a6563924cb49d6a95f1c5eff793e63b37d878dca86
SSDEEP:	6144:KpGCzDQatlLMmRyHGq+FYiy3Ax16M6QmXFCgxrTOwt/vnXqPTYmO7wVWwoKn1JX:KpG4DQarqFyYiyk16jX0gxPOmHXqDe6
TLSH:	D5B46C56A7B903E9D1A7803C8547C603F7B6B4991311DBDB43A08A7A1F637E16E3B720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......--..iL..iL..iL..`4:.}L..o.T.aL..o...cL..o...mL..o...KL..o...oL.."4..~L..iL..YM...<...L......kL......hL....V.hL......hL..RichiL.

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400617c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6702C563 [Sun Oct 6 17:14:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9ff25bf28f7da212132215c8900cc49a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F38C08200C8h
dec eax
add esp, 28h
jmp 00007F38C081F8C7h
int3
int3
jmp 00007F38C0820384h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [0001A10Ch]
call dword ptr [00001926h]
mov eax, dword ptr [000198C8h]
dec eax
lea ecx, dword ptr [0001A0F9h]
mov edx, dword ptr [0001A693h]
inc eax
mov dword ptr [000198B3h], eax
mov dword ptr [ebx], eax
dec eax
mov eax, dword ptr [00000058h]
inc ecx
mov ecx, 00000004h
dec esp
mov eax, dword ptr [eax+edx*8]
mov eax, dword ptr [00019898h]
inc ebx
mov dword ptr [ecx+eax], eax
call dword ptr [00001AAEh]
dec eax
lea ecx, dword ptr [0001A0B7h]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000018DBh]
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [0001A0A0h]
call dword ptr [000018BAh]
cmp dword ptr [ebx], 00000000h
jne 00007F38C081FA74h
or dword ptr [ebx], FFFFFFFFh
jmp 00007F38C081FA97h
inc ebp
xor ecx, ecx
dec eax
lea edx, dword ptr [0001A086h]
inc ecx
or eax, FFFFFFFFh
dec eax
lea ecx, dword ptr [0001A073h]
call dword ptr [000018A5h]
jmp 00007F38C081FA2Bh
cmp dword ptr [ebx], FFFFFFFFh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x78988	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x81000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7c000	0x41a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0x528	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x720b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x72180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x71f70	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x63000	0x930	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x61f84	0x62000	2e69b165313b27b00e895f5c26c54794	False	0.5318030532525511	data	6.334168359583283	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x63000	0x1792c	0x17a00	d368d9177cb68044c85474e749b95e22	False	0.3799499834656085	data	5.573338132959243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7b000	0xfa0	0x400	bcad257222a22777a9b3e265f8f2ecab	False	0.294921875	data	3.616176831061314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7c000	0x41a0	0x4200	8e7ddc7b9f75621dd6d1bcbb77971801	False	0.48265861742424243	data	5.808300552779591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x81000	0x1e8	0x200	e73ca378742e6b073379dfc7ae4fd5a2	False	0.541015625	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0x528	0x600	6e1105187d23ad7a39ec4368153eba6c	False	0.53125	data	4.981525589219005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x81060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	GetFileSizeEx, WideCharToMultiByte, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, QueryPerformanceCounter, SetUnhandledExceptionFilter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, QueryPerformanceFrequency, WaitForMultipleObjects, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, LocalFree, CloseHandle, GetCurrentProcess, GetProcessHeap, DeleteCriticalSection, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, CreateFileA, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, MoveFileExA, VerSetConditionMask, GetSystemTimeAsFileTime, GetTickCount, HeapDestroy, HeapAlloc, HeapReAlloc, GetLastError, Sleep, HeapSize, InitializeCriticalSectionEx, HeapFree, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Beep, UnhandledExceptionFilter, GetStdHandle, ReleaseSRWLockExclusive, InitializeSListHead, OutputDebugStringW
USER32.dll	MessageBoxA, ShowWindow, SetLayeredWindowAttributes, GetWindowLongPtrA, SetWindowLongPtrA
ADVAPI32.dll	CryptEncrypt, GetTokenInformation, GetLengthSid, OpenProcessToken, IsValidSid, CopySid, ConvertSidToStringSidA, CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?id@?$ctype@D@std@@2V0locale@2@A, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, ?_Xlength_error@std@@YAXPEBD@Z, ??Bid@locale@std@@QEAA_KXZ, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?width@ios_base@std@@QEBA_JXZ, ?width@ios_base@std@@QEAA_J_J@Z, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?_Xbad_function_call@std@@YAXXZ, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore
WS2_32.dll	ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, listen, htonl, accept, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, WSACleanup
USERENV.dll	UnloadUserProfile
VCRUNTIME140.dll	__std_exception_copy, __std_terminate, _CxxThrowException, memcmp, __std_exception_destroy, memset, __C_specific_handler, strchr, strrchr, __current_exception_context, __current_exception, memchr, memcpy, strstr, memmove
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_resetstkoflw, _invalid_parameter_noinfo_noreturn, _beginthreadex, _invalid_parameter_noinfo, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 23:24:53.079811096 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.079855919 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:53.079933882 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.090677977 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.090692043 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:53.867048979 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:53.867212057 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.870316982 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.870326996 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:53.870754004 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:53.873989105 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:24:53.919413090 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:54.178067923 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:54.178128004 CEST	443	63891	172.67.72.57	192.168.2.3
Oct 20, 2024 23:24:54.178447962 CEST	63891	443	192.168.2.3	172.67.72.57
Oct 20, 2024 23:25:10.694904089 CEST	63891	443	192.168.2.3	172.67.72.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 23:24:53.067389965 CEST	62712	53	192.168.2.3	1.1.1.1
Oct 20, 2024 23:24:53.075136900 CEST	53	62712	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 23:24:53.067389965 CEST	192.168.2.3	1.1.1.1	0x41fb	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 23:24:53.075136900 CEST	1.1.1.1	192.168.2.3	0x41fb	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 20, 2024 23:24:53.075136900 CEST	1.1.1.1	192.168.2.3	0x41fb	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 20, 2024 23:24:53.075136900 CEST	1.1.1.1	192.168.2.3	0x41fb	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.3	63891	172.67.72.57	443	7548	C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-20 21:24:53 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 47 Content-Type: application/x-www-form-urlencoded
2024-10-20 21:24:53 UTC	47	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 31 2e 30 26 6e 61 6d 65 3d 66 69 76 65 6d 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=1.0&name=fivem&ownerid=9WIvTVJa9m

Target ID:	0
Start time:	17:24:49
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe"
Imagebase:	0x7ff73acf0000
File size:	519'168 bytes
MD5 hash:	F937D31F13FCD8A8AD2BF6B231F2702F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:24:49
Start date:	20/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:24:49
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:24:49
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7868, Parent PID: 7852

General

Target ID:	15
Start time:	17:24:50
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:24:51
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7940, Parent PID: 7920

General

Target ID:	17
Start time:	17:24:51
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:24:51
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7996, Parent PID: 7980

General

Target ID:	19
Start time:	17:24:51
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:24:52
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 8044, Parent PID: 8028

General

Target ID:	21
Start time:	17:24:52
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:24:52
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 8072, Parent PID: 8060

General

Target ID:	23
Start time:	17:24:52
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:24:52
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 8140, Parent PID: 7548

General

Target ID:	25
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 8156, Parent PID: 8140

General

Target ID:	26
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7184, Parent PID: 8184

General

Target ID:	28
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff7d6170000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7044, Parent PID: 7384

General

Target ID:	32
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:24:56
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 4444, Parent PID: 524

General

Target ID:	34
Start time:	17:24:57
Start date:	20/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6e35a0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:24:57
Start date:	20/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6eed10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:24:57
Start date:	20/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7548 -s 996
Imagebase:	0x7ff68a5d0000
File size:	576'896 bytes
MD5 hash:	59550DE0393B1CDD584A1467D6D734E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.4%
Total number of Nodes:	1938
Total number of Limit Nodes:	99

Executed Functions

Function 00007FF73AD21330 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21408
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD21415
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD214E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2156C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21613
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD216AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21775
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD217AD
strchr.VCRUNTIME140 ref: 00007FF73AD21927
strchr.VCRUNTIME140 ref: 00007FF73AD2193A
strchr.VCRUNTIME140 ref: 00007FF73AD2194C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21A53
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21AC3
memcpy.VCRUNTIME140 ref: 00007FF73AD21AEA
strchr.VCRUNTIME140 ref: 00007FF73AD21AFE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21B12
strstr.VCRUNTIME140 ref: 00007FF73AD21D48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21E81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD21FF9

Part of subcall function 00007FF73AD1AB50: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1ABC3

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD220AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD22131
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2238A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD223A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD223AF

Part of subcall function 00007FF73AD23700: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2375A

strchr.VCRUNTIME140 ref: 00007FF73AD22967
strchr.VCRUNTIME140 ref: 00007FF73AD2297A
strchr.VCRUNTIME140 ref: 00007FF73AD2298C

Part of subcall function 00007FF73AD23700: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2377A
Part of subcall function 00007FF73AD23700: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23783

strchr.VCRUNTIME140 ref: 00007FF73AD22BDF
strchr.VCRUNTIME140 ref: 00007FF73AD22BF2
strchr.VCRUNTIME140 ref: 00007FF73AD22C04

Part of subcall function 00007FF73AD25D30: strchr.VCRUNTIME140 ref: 00007FF73AD25E16
Part of subcall function 00007FF73AD25D30: strchr.VCRUNTIME140 ref: 00007FF73AD25E29
Part of subcall function 00007FF73AD25D30: strchr.VCRUNTIME140 ref: 00007FF73AD25E3B

Strings

Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF73AD22038
ftp://%s:%s@%s, xrefs: 00007FF73AD2215B
chunked, xrefs: 00007FF73AD21966
If-Modified-Since, xrefs: 00007FF73AD225FD
Transfer-Encoding: chunked, xrefs: 00007FF73AD21A1F
Cookie, xrefs: 00007FF73AD21732
%s%s, xrefs: 00007FF73AD22540
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF73AD21A2C
multipart/form-data, xrefs: 00007FF73AD2185A
Failed sending POST request, xrefs: 00007FF73AD22839, 00007FF73AD22A7D
Content-Length: 0, xrefs: 00007FF73AD22800
File already completely uploaded, xrefs: 00007FF73AD21F99
Host: %s%s%s:%d, xrefs: 00007FF73AD21C12
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF73AD22F0E
Host:%s, xrefs: 00007FF73AD21B56
PUT, xrefs: 00007FF73AD214A8
Failed sending HTTP request, xrefs: 00007FF73AD22AD6
?%s, xrefs: 00007FF73AD2219B
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF73AD22684
POST, xrefs: 00007FF73AD214B5
Expect, xrefs: 00007FF73AD22904, 00007FF73AD22B79
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF73AD22B61
If-Unmodified-Since, xrefs: 00007FF73AD225F4
HEAD, xrefs: 00007FF73AD21471
User-Agent, xrefs: 00007FF73AD214CD
Failed sending HTTP POST request, xrefs: 00007FF73AD22E0B
Transfer-Encoding:, xrefs: 00007FF73AD218DE
Content-Length, xrefs: 00007FF73AD22744, 00007FF73AD22899, 00007FF73AD22B1E
Proxy-Connection: Keep-Alive, xrefs: 00007FF73AD2222F, 00007FF73AD22244
Expect:, xrefs: 00007FF73AD22925, 00007FF73AD22B9A
%s?%s, xrefs: 00007FF73AD21505
%s, xrefs: 00007FF73AD228E3
Invalid TIMEVALUE, xrefs: 00007FF73AD225B3
1.0, xrefs: 00007FF73AD22090
Could only read %I64d bytes from the input, xrefs: 00007FF73AD21FB5
Host: %s%s%s, xrefs: 00007FF73AD21BCD
Content-Range, xrefs: 00007FF73AD21FDE
Range, xrefs: 00007FF73AD21E62
%s , xrefs: 00007FF73AD220C3
Accept: */*, xrefs: 00007FF73AD21E15
ftp, xrefs: 00007FF73AD21D19
http, xrefs: 00007FF73AD21CAB
1.1, xrefs: 00007FF73AD2209E
%x, xrefs: 00007FF73AD22D05
Content-Type, xrefs: 00007FF73AD21817, 00007FF73AD22B4D
Referer, xrefs: 00007FF73AD216C3
;type=, xrefs: 00007FF73AD21D3E
Cookie: , xrefs: 00007FF73AD2249E, 00007FF73AD22514
Proxy-Connection, xrefs: 00007FF73AD22203
Accept, xrefs: 00007FF73AD21E03
Transfer-Encoding, xrefs: 00007FF73AD218BD
Range: bytes=%s, xrefs: 00007FF73AD21E8E
Accept-Encoding: %s, xrefs: 00007FF73AD21782
0, xrefs: 00007FF73AD22D56, 00007FF73AD22E55
%s%s=%s, xrefs: 00007FF73AD224B9
GET, xrefs: 00007FF73AD214C2
Content-Length: %I64d, xrefs: 00007FF73AD2275B, 00007FF73AD228B0, 00007FF73AD22B35
Host:, xrefs: 00007FF73AD21B21
OPTIONS, xrefs: 00007FF73AD2149B
Could not seek stream, xrefs: 00007FF73AD21EF8
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF73AD2236B
Accept-Encoding, xrefs: 00007FF73AD21751
Last-Modified, xrefs: 00007FF73AD225EB
Failed sending PUT request, xrefs: 00007FF73AD227D9
Host, xrefs: 00007FF73AD21A59
Content-Range: bytes %s/%I64d, xrefs: 00007FF73AD22046
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF73AD22014
100-continue, xrefs: 00007FF73AD229A6, 00007FF73AD22C26
Referer: %s, xrefs: 00007FF73AD216DE
;type=%c, xrefs: 00007FF73AD21DB1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 955865406a5f8e2f9fc8f83f6401c383669c58a7e88c3455f6c98b275ceff23b
Instruction ID: 6ecd3c9845e224021bd6b0ff319f2300784faaa9ed5157855dbc9f14c1cbdcf8
Opcode Fuzzy Hash: 955865406a5f8e2f9fc8f83f6401c383669c58a7e88c3455f6c98b275ceff23b
Instruction Fuzzy Hash: 2E03D579A2868AA1FB58AB25D4423FDA7A0EF45B84FC440B1DE1D0769DDF3CE541E320

Function 00007FF73AD2BCDD Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD2BE38
strchr.VCRUNTIME140 ref: 00007FF73AD2BE64
strchr.VCRUNTIME140 ref: 00007FF73AD2BE9E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BEC2
strchr.VCRUNTIME140 ref: 00007FF73AD2BFD2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BFEA

Strings

schannel: Failed to read cert file %s, xrefs: 00007FF73AD2C399
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF73AD2C2EF
LocalMachineEnterprise, xrefs: 00007FF73AD2BFAB
Microsoft Unified Security Protocol Provider, xrefs: 00007FF73AD2C3DF
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF73AD2C4D3
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF73AD2C2A4
LocalMachineGroupPolicy, xrefs: 00007FF73AD2BF8C
CurrentUser, xrefs: 00007FF73AD2BEB2
http/1.1, xrefs: 00007FF73AD2C507
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF73AD2BED7
schannel: unable to allocate memory, xrefs: 00007FF73AD2C35C, 00007FF73AD2C5E7
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF73AD2C279
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF73AD2C3C2
Users, xrefs: 00007FF73AD2BF56
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF73AD2C455
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF73AD2BD6B
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF73AD2C050
http/1.1, xrefs: 00007FF73AD2C4F3
schannel: ALPN, offering %s, xrefs: 00007FF73AD2C515
CurrentUserGroupPolicy, xrefs: 00007FF73AD2BF6D
Services, xrefs: 00007FF73AD2BF37
CurrentService, xrefs: 00007FF73AD2BF15
LocalMachine, xrefs: 00007FF73AD2BEF3

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 1627879a47a5845c18c4de8ee2a585c2af060702f9ac72af15faa4f2d1283c54
Instruction ID: 0c0fb1f2713a472c1fad837bf182fa2af76f51c16d09fa83ae6876971263bac3
Opcode Fuzzy Hash: 1627879a47a5845c18c4de8ee2a585c2af060702f9ac72af15faa4f2d1283c54
Instruction Fuzzy Hash: 9642F179A28B46A2FB24AF21D4563B9A7A0FF45B84FC04075CA1E47798DF3DE444E720

Function 00007FF73AD1A720 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF73AD1A748
WSACleanup.WS2_32 ref: 00007FF73AD1A763
GetModuleHandleA.KERNEL32 ref: 00007FF73AD1A7B4
GetProcAddress.KERNEL32 ref: 00007FF73AD1A7E0
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1A7FA
LoadLibraryA.KERNEL32 ref: 00007FF73AD1A81D
GetProcAddress.KERNEL32 ref: 00007FF73AD1A83A
LoadLibraryExA.KERNELBASE ref: 00007FF73AD1A850
GetSystemDirectoryA.KERNEL32 ref: 00007FF73AD1A866
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1A87E
GetSystemDirectoryA.KERNEL32 ref: 00007FF73AD1A892
LoadLibraryA.KERNEL32 ref: 00007FF73AD1A900
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1A90C
GetProcAddress.KERNEL32 ref: 00007FF73AD1A938
VerSetConditionMask.KERNEL32 ref: 00007FF73AD1A9C1
VerSetConditionMask.KERNEL32 ref: 00007FF73AD1A9D4
VerSetConditionMask.KERNEL32 ref: 00007FF73AD1A9E3
VerSetConditionMask.KERNEL32 ref: 00007FF73AD1A9F2
VerSetConditionMask.KERNEL32 ref: 00007FF73AD1AA02
VerifyVersionInfoA.KERNEL32 ref: 00007FF73AD1AA13
QueryPerformanceFrequency.KERNEL32 ref: 00007FF73AD1AA2F

Strings

AddDllDirectory, xrefs: 00007FF73AD1A830
iphlpapi.dll, xrefs: 00007FF73AD1A7E6
LoadLibraryExA, xrefs: 00007FF73AD1A7CE
kernel32, xrefs: 00007FF73AD1A79B
if_nametoindex, xrefs: 00007FF73AD1A92E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: a2949ce53e448b5f0c449650b4e06b854fbaa729135adb64d1c555148e16f196
Instruction ID: 6f99ae4006be175ab83b4211b8177f5be7f760eb7cbafe7990f3a89b78678b49
Opcode Fuzzy Hash: a2949ce53e448b5f0c449650b4e06b854fbaa729135adb64d1c555148e16f196
Instruction Fuzzy Hash: 47919769E1CB82A1FB60AB21E4163B9A3A1FF89B80FC44175D94D0776CEF3CE5459720

Function 00007FF73AD19A60 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF73AD19AFC
socket.WS2_32 ref: 00007FF73AD19B45
htons.WS2_32 ref: 00007FF73AD19BD1
setsockopt.WS2_32 ref: 00007FF73AD19C33
WSAGetLastError.WS2_32 ref: 00007FF73AD19C3D
getsockopt.WS2_32 ref: 00007FF73AD19CDF
setsockopt.WS2_32 ref: 00007FF73AD19D0E
setsockopt.WS2_32 ref: 00007FF73AD19D4D
WSAIoctl.WS2_32 ref: 00007FF73AD19DDA
WSAGetLastError.WS2_32 ref: 00007FF73AD19DE4

Part of subcall function 00007FF73AD26A30: ioctlsocket.WS2_32 ref: 00007FF73AD26A49

Part of subcall function 00007FF73AD1F550: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF73AD075CF), ref: 00007FF73AD1F567

connect.WS2_32 ref: 00007FF73AD19F0B
WSAGetLastError.WS2_32 ref: 00007FF73AD19F28

Part of subcall function 00007FF73AD042A0: GetLastError.KERNEL32 ref: 00007FF73AD042C2
Part of subcall function 00007FF73AD042A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042CA

Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179B5
Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179D0

Part of subcall function 00007FF73AD18370: closesocket.WS2_32 ref: 00007FF73AD183B3

Strings

Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF73AD19D5A
@, xrefs: 00007FF73AD19C77
Trying %s:%ld..., xrefs: 00007FF73AD19BDF
Immediate connect fail for %s: %s, xrefs: 00007FF73AD19F58
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF73AD19FCE
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF73AD19DED
Could not set TCP_NODELAY: %s, xrefs: 00007FF73AD19C5A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 7db98673a1862746b6fb662ee0155c3ef7d425d7e40dea859b6aa2dc1ddde034
Instruction ID: b886627aed14009f7a36c4700db93906e5f29ad99a6af5ec6cd15fc99e1130c1
Opcode Fuzzy Hash: 7db98673a1862746b6fb662ee0155c3ef7d425d7e40dea859b6aa2dc1ddde034
Instruction Fuzzy Hash: 18F1E579A28242A6FB90EB35D4462BDA390FB44B44FC04475EA4E47B9CDF3CE545EB10

Function 00007FF73AD1A400 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF73AD4425A,?,?,?,?,00007FF73AD1A78B), ref: 00007FF73AD1A414
GetProcAddress.KERNEL32(?,?,00007FF73AD4425A,?,?,?,?,00007FF73AD1A78B), ref: 00007FF73AD1A439
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF73AD4425A,?,?,?,?,00007FF73AD1A78B), ref: 00007FF73AD1A44C

Strings

AddDllDirectory, xrefs: 00007FF73AD1A493
LoadLibraryExA, xrefs: 00007FF73AD1A42A
kernel32, xrefs: 00007FF73AD1A40D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 930ffd6944da0613daa0a17fe6f37ed625366f21847b97e45e01bf7b474feb0e
Instruction ID: 8e7259d15134bc35a57f51034edee4d5906cb055bc52857528a3f164421405c3
Opcode Fuzzy Hash: 930ffd6944da0613daa0a17fe6f37ed625366f21847b97e45e01bf7b474feb0e
Instruction Fuzzy Hash: 4841E85AF1D64262FF55AF66A411139A791EF46BE1F888170CE1D037A8DF3CD486D320

Function 00007FF73AD26800 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF73AD26841
htonl.WS2_32 ref: 00007FF73AD2686E
setsockopt.WS2_32 ref: 00007FF73AD268A5
bind.WS2_32 ref: 00007FF73AD268C0
getsockname.WS2_32 ref: 00007FF73AD268DC
listen.WS2_32 ref: 00007FF73AD268F1
socket.WS2_32 ref: 00007FF73AD26908
connect.WS2_32 ref: 00007FF73AD26927
accept.WS2_32 ref: 00007FF73AD2693E
send.WS2_32 ref: 00007FF73AD2698C
recv.WS2_32 ref: 00007FF73AD269AA
memcmp.VCRUNTIME140 ref: 00007FF73AD269C5
closesocket.WS2_32 ref: 00007FF73AD269D1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 6cc5f48b77c786b183805c6372d46d3aefc17a40480fa3092477dd1ea067b7c8
Instruction ID: 18f950b8884021a4059057cb4ccc98cdd88d5863e43c4a6d8481d48b6dce1a36
Opcode Fuzzy Hash: 6cc5f48b77c786b183805c6372d46d3aefc17a40480fa3092477dd1ea067b7c8
Instruction Fuzzy Hash: 0551D075628A46A2FB10AF25E455169B361EF84BB0F804331EABE03AECDF3CD449D710

Function 00007FF73AD18720 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %I64dms connect time, move on!, xrefs: 00007FF73AD188E5
Failed to connect to %s port %ld: %s, xrefs: 00007FF73AD18C4E
connect to %s port %ld failed: %s, xrefs: 00007FF73AD1899D
Connection time-out, xrefs: 00007FF73AD18809
Connection failed, xrefs: 00007FF73AD18B06

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: f1202ecb1fa770e4090af42aa361c3384aef45fef6d8e9a7931020e231e9cf06
Instruction ID: c65c9b0af87c32c847dd024fcd22f523ea2bf195e20d40806dbf1946ee9a6a83
Opcode Fuzzy Hash: f1202ecb1fa770e4090af42aa361c3384aef45fef6d8e9a7931020e231e9cf06
Instruction Fuzzy Hash: B1E1126AB28682A2FB94EB34D1463BDA3A1FB45794F840275EA5D077C9DF3CE401D310

Function 00007FF73AD07B60 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF73AD07F56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD07F77

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: 6e71e634e3f003646cfc9b0eeaab8402402f034b778676c0a0fe01f72510a5ee
Instruction ID: ca520014e387509612c4f28cd43b78f4533862be35f9de7787754e0c9a7af721
Opcode Fuzzy Hash: 6e71e634e3f003646cfc9b0eeaab8402402f034b778676c0a0fe01f72510a5ee
Instruction Fuzzy Hash: E2C1283AB28A8296FB25DB2590013B9A390FF45BA4F844275DE6E477C8DF3CE8419711

Function 00007FF73AD035B0 Relevance: 47.4, APIs: 16, Strings: 11, Instructions: 135
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF73AD035CB
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF73AD035EC

Part of subcall function 00007FF73AD03290: rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF73AD032D0

SetConsoleTitleA.KERNEL32 ref: 00007FF73AD03611
GetConsoleWindow.KERNELBASE ref: 00007FF73AD03621
GetWindowLongPtrA.USER32 ref: 00007FF73AD03632
SetWindowLongPtrA.USER32 ref: 00007FF73AD03648
SetLayeredWindowAttributes.USER32 ref: 00007FF73AD0365C
GetStdHandle.KERNEL32 ref: 00007FF73AD0366C
SetConsoleTextAttribute.KERNELBASE ref: 00007FF73AD03678

Part of subcall function 00007FF73AD03580: GetStdHandle.KERNEL32 ref: 00007FF73AD0358E

Part of subcall function 00007FF73ACF2DD0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2F78

Part of subcall function 00007FF73AD03810: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,0000000B,00007FF73AD0369E), ref: 00007FF73AD03834
Part of subcall function 00007FF73AD03810: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,0000000B,00007FF73AD0369E), ref: 00007FF73AD03855

Part of subcall function 00007FF73AD02010: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD02052
Part of subcall function 00007FF73AD02010: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z.MSVCP140 ref: 00007FF73AD0206C
Part of subcall function 00007FF73AD02010: ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF73AD0208D
Part of subcall function 00007FF73AD02010: ?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD020DF
Part of subcall function 00007FF73AD02010: ?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD020F4
Part of subcall function 00007FF73AD02010: ?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD02113
Part of subcall function 00007FF73AD02010: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD02132
Part of subcall function 00007FF73AD02010: ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF73AD0213B
Part of subcall function 00007FF73AD02010: ?width@ios_base@std@@QEAA_J_J@Z.MSVCP140 ref: 00007FF73AD021EC

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD03763
GetConsoleWindow.KERNEL32 ref: 00007FF73AD03769
ShowWindow.USER32 ref: 00007FF73AD03774
Beep.KERNEL32 ref: 00007FF73AD03781
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD037E7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD037F4
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD037FC

Strings

##########################################################, xrefs: 00007FF73AD036C6
cd C:\, xrefs: 00007FF73AD037E0
http://185.101.104.122/Runtimess.exe, xrefs: 00007FF73AD03787
[ Selecione uma opcao: ], xrefs: 00007FF73AD036B2
fivem, xrefs: 00007FF73AD03686, 00007FF73AD03750
.exe, xrefs: 00007FF73AD035D4
start C:\Windows\System32\ServiceHubSettingsHostDialog.exe, xrefs: 00007FF73AD037ED
Inserir Key: , xrefs: 00007FF73AD03716
C:\Windows\System32\ServiceHubSettingsHostDialog.exe, xrefs: 00007FF73AD0379C
##########################################################, xrefs: 00007FF73AD0369E
cls, xrefs: 00007FF73AD0375C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: U?$char_traits@Window$?width@ios_base@std@@ConsoleD@std@@@std@@$randsystem$?rdbuf@?$basic_ios@D@std@@@2@HandleLongV?$basic_streambuf@$?getloc@ios_base@std@@?sgetc@?$basic_streambuf@AttributeAttributesBeepIpfx@?$basic_istream@LayeredShowTextTitleVlocale@2@__acrt_iob_func__stdio_common_vfprintf_invalid_parameter_noinfo_noreturnexit
String ID: Inserir Key: $##########################################################$##########################################################$.exe$C:\Windows\System32\ServiceHubSettingsHostDialog.exe$[ Selecione uma opcao: ]$cd C:\$cls$fivem$http://185.101.104.122/Runtimess.exe$start C:\Windows\System32\ServiceHubSettingsHostDialog.exe
API String ID: 3205950358-389504625
Opcode ID: f27d5433c3341dc8c674189e7306529748f819ba727e9977b5b18e8fb9edc4d3
Instruction ID: 1ef49dce3d1fc42624f2a9cddf2937a5cbca756b30670c2e771cb40989c7805e
Opcode Fuzzy Hash: f27d5433c3341dc8c674189e7306529748f819ba727e9977b5b18e8fb9edc4d3
Instruction Fuzzy Hash: 6851BA68A29943B1FB04FB20E8671B9E355FF90741FC040B5D51E469BAEF2CE549E720

Function 00007FF73ACF2DD0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2BD7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2C47
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CA7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CF7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2D47

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2F78

Part of subcall function 00007FF73ACF5640: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF5700

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2FC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3007
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3055
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3094
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3148
memcpy.VCRUNTIME140 ref: 00007FF73ACF316D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3243
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF328A
ShellExecuteA.SHELL32 ref: 00007FF73ACF3382
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF338A
MessageBoxA.USER32 ref: 00007FF73ACF33C0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF33D1
Sleep.KERNEL32 ref: 00007FF73ACF3439
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3441
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF3448

Part of subcall function 00007FF73ACF3490: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF359F
Part of subcall function 00007FF73ACF3490: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF35E0

Part of subcall function 00007FF73ACF49A0: memcpy.VCRUNTIME140 ref: 00007FF73ACF49F3

Part of subcall function 00007FF73ACF3600: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF36E0

Part of subcall function 00007FF73ACF3700: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF37E0

Strings

open, xrefs: 00007FF73ACF3379
Failure, xrefs: 00007FF73ACF33B7
sessionid, xrefs: 00007FF73ACF31CE
invalidver, xrefs: 00007FF73ACF3309
message, xrefs: 00007FF73ACF32D3, 00007FF73ACF3391
download, xrefs: 00007FF73ACF3345
success, xrefs: 00007FF73ACF31A6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: c6c0d88f1881646470753c44f85bd3bd17c848248a9b68d82f9522dd865cdc20
Instruction ID: f368e829d7731613cbeb6630bde61e33ab7d9db326d87de9191e5c70c699561e
Opcode Fuzzy Hash: c6c0d88f1881646470753c44f85bd3bd17c848248a9b68d82f9522dd865cdc20
Instruction Fuzzy Hash: A3022866E19B82A5FB00EB24D4563ADA761FB40794FC05271EAAD07BDADF7CE080D350

Function 00007FF73AD2D360 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF73AD2D9A1
memcpy.VCRUNTIME140 ref: 00007FF73AD2D9BD

Strings

schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF73AD2D405
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF73AD2D7FF
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF73AD2D7B8
schannel: server indicated shutdown in a prior call, xrefs: 00007FF73AD2D428
schannel: remote party requests renegotiation, xrefs: 00007FF73AD2D782
schannel: failed to read data from server: %s, xrefs: 00007FF73AD2D8F2
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF73AD2D52D
schannel: can't renogotiate, an error is pending, xrefs: 00007FF73AD2D922
schannel: Curl_read_plain returned error %d, xrefs: 00007FF73AD2D701
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF73AD2D94E
schannel: failed to decrypt data, need more data, xrefs: 00007FF73AD2D8CA
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF73AD2D942
schannel: renegotiation failed, xrefs: 00007FF73AD2D92E
schannel: unable to re-allocate memory, xrefs: 00007FF73AD2D49D, 00007FF73AD2D906
schannel: enough decrypted data is already available, xrefs: 00007FF73AD2D3E5
schannel: server closed the connection, xrefs: 00007FF73AD2D834

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 658663e5c896aa931729701bfbad33902eb0a8421c31b811211404a493ba3bfb
Instruction ID: be893e487933c01b086de291a1660bc31f6e1c6be723f1df2ce22ca681808e6b
Opcode Fuzzy Hash: 658663e5c896aa931729701bfbad33902eb0a8421c31b811211404a493ba3bfb
Instruction Fuzzy Hash: B302357AA28B4995FB50EF19D4453A9ABA4FB80B94FA00276DE8D433ACDF3CD441D710

Function 00007FF73AD2C7F0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2C8E0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2C931
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2C974
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2CA57
memcpy.VCRUNTIME140 ref: 00007FF73AD2CAF9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2CB62
memcpy.VCRUNTIME140 ref: 00007FF73AD2CC3A
memset.VCRUNTIME140 ref: 00007FF73AD2CE07
CertFreeCertificateContext.CRYPT32 ref: 00007FF73AD2CE6A

Strings

schannel: unable to allocate memory, xrefs: 00007FF73AD2CF5F
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF73AD2CC66
SSL: failed retrieving public key from server certificate, xrefs: 00007FF73AD2CE8A
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF73AD2CEAA
schannel: SNI or certificate check failed: %s, xrefs: 00007FF73AD2CCCB
SSL: public key does not match pinned public key!, xrefs: 00007FF73AD2CE4C, 00007FF73AD2CE74
schannel: unable to re-allocate memory, xrefs: 00007FF73AD2C982
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF73AD2CD14
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF73AD2CCFE, 00007FF73AD2CF12

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 9a453b4f3af2256e115fd8ec33db338714afa8d6d4086593a2de63151eed420b
Instruction ID: 2e5a715c0d45239bbcb84407a873f819d5fe569cf82efc6e52287bb9d8309833
Opcode Fuzzy Hash: 9a453b4f3af2256e115fd8ec33db338714afa8d6d4086593a2de63151eed420b
Instruction Fuzzy Hash: 3912037AA18B8596FB60EB29D8493BEB7A0FB44B84F900072CA5D47798DF3DD841D710

Function 00007FF73AD2BA10 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF73AD2BAE1
GetProcAddress.KERNEL32 ref: 00007FF73AD2BAF1

Strings

schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF73AD2BB82
ntdll, xrefs: 00007FF73AD2BADA
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF73AD2C789
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF73AD2C4D3
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF73AD2BAC2
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF73AD2C6AC, 00007FF73AD2C6F3
http/1.1, xrefs: 00007FF73AD2C507
schannel: unable to allocate memory, xrefs: 00007FF73AD2C5E7
wine_get_version, xrefs: 00007FF73AD2BAEA
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF73AD2C48F
schannel: ALPN, offering %s, xrefs: 00007FF73AD2C515
http/1.1, xrefs: 00007FF73AD2C4F3
schannel: SNI or certificate check failed: %s, xrefs: 00007FF73AD2C6CD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: eb65caeb0ec1ceeca98515e8ebfcbbb51050129689c5196f292fa902b77437af
Instruction ID: a56c235d66d25c25adab162493667f625dcef4335c7c9dfb224946539fb38864
Opcode Fuzzy Hash: eb65caeb0ec1ceeca98515e8ebfcbbb51050129689c5196f292fa902b77437af
Instruction Fuzzy Hash: 59021F7AA18B85AAFB20AB24D8453FEB7A4FB44784F800176DA5D07798DF3CE540E710

Function 00007FF73AD0D050 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D082
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D11D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF73AD0D136

Part of subcall function 00007FF73AD26800: socket.WS2_32 ref: 00007FF73AD26841

DeleteCriticalSection.KERNEL32 ref: 00007FF73AD0D170
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D17A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D184
closesocket.WS2_32 ref: 00007FF73AD0D1A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D1D8
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0D1DE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0D20D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D227
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0D230
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0D265
EnterCriticalSection.KERNEL32 ref: 00007FF73AD0D286
LeaveCriticalSection.KERNEL32 ref: 00007FF73AD0D29A
CloseHandle.KERNEL32 ref: 00007FF73AD0D2A7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D2D2
closesocket.WS2_32 ref: 00007FF73AD0D2EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D2FF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 1ab21e29e097ba9015accc2a1786f64bc2b6e26699699161f436a0ea4b40475b
Instruction ID: 56c4939578745ff474d8b04d13383906d4c4e6b402969292675a83ec70fed0f8
Opcode Fuzzy Hash: 1ab21e29e097ba9015accc2a1786f64bc2b6e26699699161f436a0ea4b40475b
Instruction Fuzzy Hash: 9A818E2AD15B8196F724EF21E851269B360FB98B54F805375DB9E037A9DF38E0D4D310

Function 00007FF73AD146C0 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF73AD14F40
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF73AD14F12
proxy, xrefs: 00007FF73AD14D82
No more connections allowed to host %s: %zu, xrefs: 00007FF73AD14E52
host, xrefs: 00007FF73AD14D90
ftp@example.com, xrefs: 00007FF73AD1487F
No connections available., xrefs: 00007FF73AD14E61
No connections available in cache, xrefs: 00007FF73AD150BB
anonymous, xrefs: 00007FF73AD14878
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF73AD14DA3

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 4ee4e4438b715250b0852179961d660f393744e2c14307a6a4f5d37ba513111d
Instruction ID: e624ae60bc0581f6ef847c3bc50dda70c82f98fed33e1c2d1f8d3025f349fb31
Opcode Fuzzy Hash: 4ee4e4438b715250b0852179961d660f393744e2c14307a6a4f5d37ba513111d
Instruction Fuzzy Hash: D142D6AAB19B8261FBD9EB3195413B9A390FB55B84F8841B5CE5D07789DF3CE060D320

Function 00007FF73AD13650 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD03901,?,?,?,?,00007FF73ACF4301), ref: 00007FF73AD13668
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD136B1

Strings

<, xrefs: 00007FF73AD137C7
<, xrefs: 00007FF73AD138EE
v, xrefs: 00007FF73AD1395F
<, xrefs: 00007FF73AD138F8
`, xrefs: 00007FF73AD1394A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: ed4afc367ca02616cb8f6bc22ca0dcd32d3313aa164d0e3b3b22a3d0f2c825f4
Instruction ID: 80c2198777c5ab3a99d1e4ea4e55f2a8312e5711c15e461f9232da12e758d6cf
Opcode Fuzzy Hash: ed4afc367ca02616cb8f6bc22ca0dcd32d3313aa164d0e3b3b22a3d0f2c825f4
Instruction Fuzzy Hash: 2B916B76918BC186E3409F34D4053E87BA0FB95B5CF485239CF990A79ADF7AA094C720

Function 00007FF73AD190A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF73AD1910C
WSAGetLastError.WS2_32 ref: 00007FF73AD19116

Part of subcall function 00007FF73AD042A0: GetLastError.KERNEL32 ref: 00007FF73AD042C2
Part of subcall function 00007FF73AD042A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042CA

getsockname.WS2_32 ref: 00007FF73AD19196
WSAGetLastError.WS2_32 ref: 00007FF73AD191A0

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF73AD19136
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF73AD192BC
getsockname() failed with errno %d: %s, xrefs: 00007FF73AD191C0
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF73AD19226

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: ae4c1ae73554bbbf6e251e1cbcb7cc57b8f9f27a25c1969845fcb2e9fb67ec3b
Instruction ID: 82d01cf6e9480de4ac13ed92ab2fe12ac05458e2873881ded5b959d5cc4ba44a
Opcode Fuzzy Hash: ae4c1ae73554bbbf6e251e1cbcb7cc57b8f9f27a25c1969845fcb2e9fb67ec3b
Instruction Fuzzy Hash: A191E27AA28BC192EB10DF35C4513E973A0FB89B88F845235EE4D47659DF39E185CB20

Function 00007FF73AD2A470 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF73AD2A492
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A4FE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A538
memcpy.VCRUNTIME140(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A551
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A55F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A59A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5A3
freeaddrinfo.WS2_32(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5D1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5E5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5FC
WSASetLastError.WS2_32(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A61D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 3b81a1883c57e47432cecb4e621141014c86fe15a50a35486e3fd9914ba85bd1
Instruction ID: cae8469d3854cf5479ab8e0d9b4a63fde5ae6f861f963774ddf2e4777d278466
Opcode Fuzzy Hash: 3b81a1883c57e47432cecb4e621141014c86fe15a50a35486e3fd9914ba85bd1
Instruction Fuzzy Hash: 18517F79A19B4696FB25AF11A50113AF7A0FB44B90F844075CE9E07B68DF3CE845E720

Function 00007FF73AD27D80 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF73AD27DDD
Sleep.KERNEL32 ref: 00007FF73AD27DEE
WSASetLastError.WS2_32 ref: 00007FF73AD27F58
Sleep.KERNEL32 ref: 00007FF73AD27F69
__WSAFDIsSet.WS2_32 ref: 00007FF73AD2801C
__WSAFDIsSet.WS2_32 ref: 00007FF73AD28033
__WSAFDIsSet.WS2_32 ref: 00007FF73AD2804E
__WSAFDIsSet.WS2_32 ref: 00007FF73AD28062
__WSAFDIsSet.WS2_32 ref: 00007FF73AD2807D
__WSAFDIsSet.WS2_32 ref: 00007FF73AD28091

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 5b13c4459e5748bf63562c5fbd040ba3a850f07834c93df58ed827bc88dc06bf
Instruction ID: 43c8858b8195b89966ab1c7c7cdc066e9b7492f9ba08edc77b213fe4a24a6f82
Opcode Fuzzy Hash: 5b13c4459e5748bf63562c5fbd040ba3a850f07834c93df58ed827bc88dc06bf
Instruction Fuzzy Hash: 93914C29B2C686A6FB346E2499421B9E2A1FF45754F904174EA1D87BCCDF3CE901E720

Function 00007FF73AD16C90 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16CDF

Strings

Unix socket path too long: '%s', xrefs: 00007FF73AD16D36
Couldn't resolve proxy '%s', xrefs: 00007FF73AD16EBC
Couldn't resolve host '%s', xrefs: 00007FF73AD16E11

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 298ca9fd91460239932b425c5934b15dc46c6d5126ddd13708cd9e9d54dcac22
Instruction ID: 681996ba9be8174f6bf7754ef0a13b64f9728232c666d67a678c7d330796fd36
Opcode Fuzzy Hash: 298ca9fd91460239932b425c5934b15dc46c6d5126ddd13708cd9e9d54dcac22
Instruction Fuzzy Hash: 1851F72AB1CB42A3FB99AB35D051379A790EB84780F944571EF4C433A8DF3DE451A720

Function 00007FF73ACF2B70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2BD7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2C47
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CA7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CF7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2D47
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2DB8

Strings

.8, xrefs: 00007FF73ACF2D95
h%49, xrefs: 00007FF73ACF2D8E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 04e1bb3fdf93c86dc89e0371cfefaac794fe8f72405b8646e5bcbe3c504f26a1
Instruction ID: 24aa7df3952545eb4e8d9ec3f3f5c0d4967992b9dd784b4c76a22dcf3022f212
Opcode Fuzzy Hash: 04e1bb3fdf93c86dc89e0371cfefaac794fe8f72405b8646e5bcbe3c504f26a1
Instruction Fuzzy Hash: C6617077E28BD698F301DB78D8061BCB770FB99748F8052B4DEC526D1AEBA85148C354

Function 00007FF73AD5164C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73AD51675
__scrt_release_startup_lock.LIBCMT ref: 00007FF73AD516E3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD51731
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD51736
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD5173E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD51746
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD51768
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD517C2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: 0b57f4e5e11b319b301b3d568c6fca9fb7e553c9c51a03cb5587130aab8ce9b2
Instruction ID: c152532b934a0df1e0d58a0e5faabcad6d08ab74a42cc25b9bc45275773632f2
Opcode Fuzzy Hash: 0b57f4e5e11b319b301b3d568c6fca9fb7e553c9c51a03cb5587130aab8ce9b2
Instruction Fuzzy Hash: ED312BA9E2D243A1FE14BB2494137BA9391EF41784FC440B5F64D076DFDF2CA849A630

Function 00007FF73AD0CF40 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD2A470: getaddrinfo.WS2_32 ref: 00007FF73AD2A492
Part of subcall function 00007FF73AD2A470: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A4FE
Part of subcall function 00007FF73AD2A470: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A538
Part of subcall function 00007FF73AD2A470: memcpy.VCRUNTIME140(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A551
Part of subcall function 00007FF73AD2A470: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A55F
Part of subcall function 00007FF73AD2A470: freeaddrinfo.WS2_32(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5D1
Part of subcall function 00007FF73AD2A470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5E5
Part of subcall function 00007FF73AD2A470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5EF
Part of subcall function 00007FF73AD2A470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CF95), ref: 00007FF73AD2A5FC

WSAGetLastError.WS2_32 ref: 00007FF73AD0CF9B
WSAGetLastError.WS2_32 ref: 00007FF73AD0CFA5
EnterCriticalSection.KERNEL32 ref: 00007FF73AD0CFC0
LeaveCriticalSection.KERNEL32 ref: 00007FF73AD0CFCF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0CFE0
send.WS2_32 ref: 00007FF73AD0D003
WSAGetLastError.WS2_32 ref: 00007FF73AD0D00D
LeaveCriticalSection.KERNEL32 ref: 00007FF73AD0D020

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: eca7f3fa03cb7088b04734fff395d0f0ef4854b132db828a14a1e6d0a8eb1d44
Instruction ID: ee244dbf4a9519cad175bb8bc7b8fac13ad736d44aad1a4b3ea54d6c9e15d696
Opcode Fuzzy Hash: eca7f3fa03cb7088b04734fff395d0f0ef4854b132db828a14a1e6d0a8eb1d44
Instruction Fuzzy Hash: 6431E775A18A42A2FB00EF35E455269B7A0FF84F98F800172DA5E836ACDF3CD845D761

Function 00007FF73AD279E0 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF73AD27A46
WSASetLastError.WS2_32 ref: 00007FF73AD27C06
Sleep.KERNEL32 ref: 00007FF73AD27C16
__WSAFDIsSet.WS2_32 ref: 00007FF73AD27D2A
__WSAFDIsSet.WS2_32 ref: 00007FF73AD27D42
Sleep.KERNEL32 ref: 00007FF73AD27D6D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: c8679dafddfc3f6c28f1eb495d0364e39bcf7d316b2b1e20d03c4006334b0ab5
Instruction ID: 9dc5d62c208c4307a88215c04dc147c79cb91f13de002f9440170ffabbd2dcd3
Opcode Fuzzy Hash: c8679dafddfc3f6c28f1eb495d0364e39bcf7d316b2b1e20d03c4006334b0ab5
Instruction Fuzzy Hash: 91A14B29B3864A96FB796F24D4052B9A2A5FF86BA0F804274E91D47BCCDF3DD500E710

Function 00007FF73AD2DA30 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2DACE
memcpy.VCRUNTIME140 ref: 00007FF73AD2DB66
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2DC9C

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF73AD2DC64
select/poll on SSL socket, errno: %d, xrefs: 00007FF73AD2DC44

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 5b335bf0d44496320023fedbc5dd29276b42dff4725346786d21bfd590ced9a1
Instruction ID: 835eb8c238c9083c51cc77e4e3e4d80ed3934ba777b7ee860fdf34020db7ae2f
Opcode Fuzzy Hash: 5b335bf0d44496320023fedbc5dd29276b42dff4725346786d21bfd590ced9a1
Instruction Fuzzy Hash: E071AD7AB18B059AFB10EF65D4516AD73A1FB48BA8F800275DE6D477D8EE38E006D310

Function 00007FF73AD08AA0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08AEE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08B05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08C32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08C5E

Strings

%s, xrefs: 00007FF73AD08D67
Connection #%ld to host %s left intact, xrefs: 00007FF73AD08D1B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 7146bb7cb77169b74bd752f62843a2f7559ec1fea6529fc12f3af6bbe38571ea
Instruction ID: 3db8d25b01fff5c683aae7d8f1a607804547954f8f7c53375b07622c4cd6b7fc
Opcode Fuzzy Hash: 7146bb7cb77169b74bd752f62843a2f7559ec1fea6529fc12f3af6bbe38571ea
Instruction Fuzzy Hash: EB91B13AA28681A2FB58FB2195463FDB3E0FB45B84F844471DE4E07259CF3CE460A361

Function 00007FF73AD12F30 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12F5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12F71

Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12D8D
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DAA
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DBE
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DDA
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DF7
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E1A
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E2E
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E42
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E68
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E7C
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E90
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12EDF
Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12EEC

Part of subcall function 00007FF73AD12D10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12F15

memset.VCRUNTIME140 ref: 00007FF73AD12FA5

Strings

User-Agent: %s, xrefs: 00007FF73AD1303F
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF73AD13181

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: fa8131d12a719602b61b1e86ffa4e1997d555cdfa0adbb24a1c8e12bb0559bf3
Instruction ID: 7a74f2734769f9384f44d1780d3702ddb72f07a344eaf754dc385889eb591822
Opcode Fuzzy Hash: fa8131d12a719602b61b1e86ffa4e1997d555cdfa0adbb24a1c8e12bb0559bf3
Instruction Fuzzy Hash: CD71916AA1CBC291F791EF35D4023BDA790EB81B94F884175DB5D0B699DF3DE4809320

Function 00007FF73AD234B0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23551
memcpy.VCRUNTIME140 ref: 00007FF73AD2356C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD236CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD236D5

Strings

1.1, xrefs: 00007FF73AD234BF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 1bd5f0f387f3a883000cfacb9928adfb29df4d7921f4b7b1319418afa16f066e
Instruction ID: 46842e934c4c2e0aea38d4df54441ea427c05bf81f51614a936e859ebaf189ee
Opcode Fuzzy Hash: 1bd5f0f387f3a883000cfacb9928adfb29df4d7921f4b7b1319418afa16f066e
Instruction Fuzzy Hash: 8751AF7A718B8996E764AF22E4413AAB3A4FB45B84F844071DFAD47B58CF3CE094D310

Function 00007FF73AD17C70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17D36
recv.WS2_32 ref: 00007FF73AD17D60
send.WS2_32 ref: 00007FF73AD17D83
WSAGetLastError.WS2_32 ref: 00007FF73AD17D95

Strings

Send failure: %s, xrefs: 00007FF73AD17DC5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: d1fc5e5179596be071d0c38d7398d39a64957bf0ca119ddfe01feb8fd2c11583
Instruction ID: a8cfb2f2506b6f240452bd007f8251a9b5331b894c4cbda52debe84e3aa7ab24
Opcode Fuzzy Hash: d1fc5e5179596be071d0c38d7398d39a64957bf0ca119ddfe01feb8fd2c11583
Instruction Fuzzy Hash: DC41CF7A719B8595FBA0AF25E801779A290EB0AFE8F844675CE6D033A8DF3CD001D710

Function 00007FF73AD09B98 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD09CE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD09D2F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD09D5A

Part of subcall function 00007FF73AD08AA0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08AEE
Part of subcall function 00007FF73AD08AA0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD08B05

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD09D8F

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF73AD090D6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: c2a34b1b45cb065c9d649304fbdcad52066438d8b336b1c57e8476e612c7512c
Instruction ID: 93d7af2493013f1696a343854cf30a3705f15189e2580bf0fe93f0e93194f662
Opcode Fuzzy Hash: c2a34b1b45cb065c9d649304fbdcad52066438d8b336b1c57e8476e612c7512c
Instruction Fuzzy Hash: CAD1D229A28642A5FB64EF3594563BDA3A0FF40B88F844071CE0E0769DDF3CE441E362

Function 00007FF73ACF42C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2BD7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2C47
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CA7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CF7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2D47

MessageBoxA.USER32 ref: 00007FF73ACF4497

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF44FA

Strings

keyauth.win, xrefs: 00007FF73ACF4423
null, xrefs: 00007FF73ACF4322

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: 91c01acedcb4111391999ea3e5a931a389cdf41610cc0d000267b5aeb74d4831
Instruction ID: b4fa55c3c77867a67f3aa5dedd2d00851dab66832695905bfac71689c636f694
Opcode Fuzzy Hash: 91c01acedcb4111391999ea3e5a931a389cdf41610cc0d000267b5aeb74d4831
Instruction Fuzzy Hash: 2B51242AB28B5296FB04EB75D5263AC6361FB45B88F804074CE4D27F8ACF7C9081E350

Function 00007FF73AD44220 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD1A400: GetModuleHandleA.KERNEL32(?,?,?,00007FF73AD4425A,?,?,?,?,00007FF73AD1A78B), ref: 00007FF73AD1A414

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF73AD1A78B), ref: 00007FF73AD44270

Strings

InitSecurityInterfaceA, xrefs: 00007FF73AD44266
secur32.dll, xrefs: 00007FF73AD44243
security.dll, xrefs: 00007FF73AD4424A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: d4c6a8a4b507def5e730b413bfa4ab8bd59957322d8615b0279df938ddcedc57
Instruction ID: 809ba263032810ddcb57ba3df24f9dd68d4e4832f6e8ea855cdf45e81749616a
Opcode Fuzzy Hash: d4c6a8a4b507def5e730b413bfa4ab8bd59957322d8615b0279df938ddcedc57
Instruction Fuzzy Hash: 2AF03CACF29B1361FE88B725A883774A391FF64344FC840F4C40C426A8EF2CE185A320

Function 00007FF73AD096CB Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF73AD090D6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 55be08e2d3e19c291efd03ebd0f8e0b29753fb8546e2701047407bbb22ee9059
Instruction ID: da9da0ff346227e066e467c90c80683cc2b684071fac40a476a71a64acc0711d
Opcode Fuzzy Hash: 55be08e2d3e19c291efd03ebd0f8e0b29753fb8546e2701047407bbb22ee9059
Instruction Fuzzy Hash: F1B1E73AA28642A5FB64EF3594563BDA7A0EF41B88FC44171C91F0729DDE3DE440E362

Function 00007FF73AD23070 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23170

Part of subcall function 00007FF73AD23700: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2375A

Part of subcall function 00007FF73AD234B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23548
Part of subcall function 00007FF73AD234B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23551

Strings

TCP6, xrefs: 00007FF73AD230F7
TCP4, xrefs: 00007FF73AD2310A
PROXY %s %s %s %li %li, xrefs: 00007FF73AD23144

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 45be2aec400c7d59d6bdeaaeb9b6dce72d69af401b23e24f33f9db4f36e27481
Instruction ID: 580de2189c52f9bd7944007461888426b7313547fb6f8441b1f8b266ea7312e1
Opcode Fuzzy Hash: 45be2aec400c7d59d6bdeaaeb9b6dce72d69af401b23e24f33f9db4f36e27481
Instruction Fuzzy Hash: 7241C979A2C78656FB51EB34A4033B9B7A1EB85384F884072DA8C4768DDF3DD405D720

Function 00007FF73AD07960 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF73AD03996,?,?,?,?,00000000,?,00007FF73ACF447E), ref: 00007FF73AD0797D
closesocket.WS2_32 ref: 00007FF73AD07A89
closesocket.WS2_32 ref: 00007FF73AD07A96

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: adcd41059a93c5a12562aac0115d5b4778b5ccd73cececd10c8aa0c0fa95c822
Instruction ID: 942f1d116f8a220c1a3a1570583c43e989733a0b5421ddf3613ef253cb6ac2aa
Opcode Fuzzy Hash: adcd41059a93c5a12562aac0115d5b4778b5ccd73cececd10c8aa0c0fa95c822
Instruction Fuzzy Hash: 08419239628A42A1F740FF31D4522E9A361EF88724FC44276DE5D4A2DEEF38D2059330

Function 00007FF73AD2B820 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FF73AD2B97C
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF73AD2B963

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: bef170d119d3551d91fe1efd9ca46ca6567ff3494167cb8991f2f6b72ba38573
Instruction ID: 6407952e852da80b9bc18115955e41734570dc7e33dd8f87f145e47c6ea986bd
Opcode Fuzzy Hash: bef170d119d3551d91fe1efd9ca46ca6567ff3494167cb8991f2f6b72ba38573
Instruction Fuzzy Hash: A051E829B2864AA5FB50AB218543379F3A1FB457A8F948271DA6D473D8DF7CE001E320

Function 00007FF73AD13C30 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13C95

Strings

User-Agent: %s, xrefs: 00007FF73AD13CA6
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF73AD13DD4

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 823838333e7cdc50a4f9ed4410d19f08b348a5a54098fdbe177a74f7df289918
Instruction ID: a281ff557c27056797376e09d35a65f0641e69c36e09f6473f0493a8fdf1db5e
Opcode Fuzzy Hash: 823838333e7cdc50a4f9ed4410d19f08b348a5a54098fdbe177a74f7df289918
Instruction Fuzzy Hash: C5518E66A18AC291F7819F39D0413E9A760EB85F98F884171DE9C0B79EDF7CD491D320

Function 00007FF73AD17A90 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF73AD17A9C
WSAGetLastError.WS2_32 ref: 00007FF73AD17AAB

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: e75c1192dd4fd5a57e77694487cd01bf22fc594a0e8d0d7ccf1d47ada6a12edb
Instruction ID: ba2d28d3a8228e117965a27607468f07cd6ca0b2218eba2d16c4714d91128cc8
Opcode Fuzzy Hash: e75c1192dd4fd5a57e77694487cd01bf22fc594a0e8d0d7ccf1d47ada6a12edb
Instruction Fuzzy Hash: 1DE0DF61F1850942FF286B70E8663381190DF48731F844778DA3A867C4DA2C45D29710

Function 00007FF73AD18370 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF73AD183B3

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4bfacc65b28e4e5b74e3d713c9b2aff8daa8d44071257a7161c37984f54c1391
Instruction ID: bcfec114bf223923b9b3f24b2ab8e7a735c997c29a4e29879eaa13459c31cc4c
Opcode Fuzzy Hash: 4bfacc65b28e4e5b74e3d713c9b2aff8daa8d44071257a7161c37984f54c1391
Instruction Fuzzy Hash: B401D615B25941A1FB54E73AE0593ADB350EF88B84F8C4071D70D8B299DF2DD4919311

Function 00007FF73AD1FE90 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF73AD1FEB9

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: becd7a5ff14762408319016343dfb43986883124b2cf6d12fa017e53fd5bac3a
Instruction ID: bbf2113f488c2dc605a0ef673bb60393ebd585fc3acb24dac750b49d8114af08
Opcode Fuzzy Hash: becd7a5ff14762408319016343dfb43986883124b2cf6d12fa017e53fd5bac3a
Instruction Fuzzy Hash: B3E0223EE1264192EE48B73984926B82360EB44734FC443B2C63D063D2CE2CD256AB10

Function 00007FF73AD2AAF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD2AB0B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 2dec2157a321897fdf059764d08ed67426825e7b25764f03caee5d0884abbd61
Instruction ID: 3c0cbf661c5a33f8fb245a975cecb75e92dd6747669d9d04d357ee4a49e6f8c5
Opcode Fuzzy Hash: 2dec2157a321897fdf059764d08ed67426825e7b25764f03caee5d0884abbd61
Instruction Fuzzy Hash: 87D02BA3B18A00439F10DF71A851029E351F788770B884338AE7D827E4EB3CD1454600

Function 00007FF73AD26A30 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF73AD26A49

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 405ead4ae07c6f026bc210f9fbb496f0cb9ffb6ecbebfd299f215b64ef538add
Instruction ID: a68a059a13378874712311c2bdb725ee96901f8373cfe5b88b66dc22114bc3b9
Opcode Fuzzy Hash: 405ead4ae07c6f026bc210f9fbb496f0cb9ffb6ecbebfd299f215b64ef538add
Instruction Fuzzy Hash: E8C0805BF24581C2D7446F615489087A771FBC4204FD56435E10B82528EE3CC2A5DB40

Non-executed Functions

Function 00007FF73AD3EFC0 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179B5
Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179D0

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F04E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F082
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F08C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F0BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F0C5
#22.WLDAP32 ref: 00007FF73AD3F0D6
#211.WLDAP32 ref: 00007FF73AD3F170
#217.WLDAP32 ref: 00007FF73AD3F18C
#211.WLDAP32 ref: 00007FF73AD3F1A5
#211.WLDAP32 ref: 00007FF73AD3F1B7
#60.WLDAP32 ref: 00007FF73AD3F1E7
#211.WLDAP32 ref: 00007FF73AD3F302
#60.WLDAP32 ref: 00007FF73AD3F327
#22.WLDAP32 ref: 00007FF73AD3F3CA
#41.WLDAP32 ref: 00007FF73AD3F7E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F80E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F818
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F838
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F84B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3F854
#46.WLDAP32 ref: 00007FF73AD3F866

Strings

DN: , xrefs: 00007FF73AD3F4C2
encrypted, xrefs: 00007FF73AD3F11E
LDAP remote: %s, xrefs: 00007FF73AD3F447
LDAP local: %s, xrefs: 00007FF73AD3F0DC
There are more than %d entries, xrefs: 00007FF73AD3F7F6
cleartext, xrefs: 00007FF73AD3F0FF
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF73AD3F20B
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF73AD3EFF4
LDAP local: %s, xrefs: 00007FF73AD3F037
Microsoft Corporation., xrefs: 00007FF73AD3EFE0
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF73AD3F3D4
LDAP local: trying to establish %s connection, xrefs: 00007FF73AD3F109
;binary, xrefs: 00007FF73AD3F650

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 5a27c8f7a7e85cb9c839a577cf93d0005398a7b06e3f97042b69b9d58b9455a9
Instruction ID: 196d9d0e639e3d5ee66162cd0844ecbfc581d2589bd0152faff150a595e89265
Opcode Fuzzy Hash: 5a27c8f7a7e85cb9c839a577cf93d0005398a7b06e3f97042b69b9d58b9455a9
Instruction Fuzzy Hash: BC42A379F29B46A6FB14AF62D4152B9A3A1FB48B88F8044B1CE0D5B798DF3DE405D310

Function 00007FF73ACFA2DD Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF73ACFACDD
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF73ACFACE4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFADC4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFADF2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFAE00
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFAE3B

Strings

array, xrefs: 00007FF73ACFAEFA
object separator, xrefs: 00007FF73ACFA9E3, 00007FF73ACFB21A
object key, xrefs: 00007FF73ACFAB6F, 00007FF73ACFB3A9
number overflow parsing ', xrefs: 00007FF73ACFAD00
object, xrefs: 00007FF73ACFB089

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 6de16f66f950f8ec2507d0f5c2894ec5dac0ac7ed59934fa8fa6312eb6c6831b
Instruction ID: cc7b9156fc90c98573c7d0a8cf575e2a81cca9ded0b90e542b5e684753a83e8c
Opcode Fuzzy Hash: 6de16f66f950f8ec2507d0f5c2894ec5dac0ac7ed59934fa8fa6312eb6c6831b
Instruction Fuzzy Hash: AAA2F376A19B87A6FF00EB68D4553ADA361FB417A4F804271DA9D07AD9DF7CE080E310

Function 00007FF73AD3B2C0 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3B30F
WSAStartup.WS2_32 ref: 00007FF73AD3B3B0
FreeLibrary.KERNEL32 ref: 00007FF73AD3B59D
GetStdHandle.KERNEL32 ref: 00007FF73AD3B5AC
GetFileType.KERNEL32 ref: 00007FF73AD3B5CD
WaitForMultipleObjects.KERNEL32 ref: 00007FF73AD3B617
PeekNamedPipe.KERNEL32 ref: 00007FF73AD3B69C
ReadFile.KERNEL32 ref: 00007FF73AD3B6C3
ReadFile.KERNEL32 ref: 00007FF73AD3B77D
WSAGetLastError.WS2_32 ref: 00007FF73AD3B7DE
WSAGetLastError.WS2_32 ref: 00007FF73AD3B9DA
FreeLibrary.KERNEL32 ref: 00007FF73AD3B9FA
GetLastError.KERNEL32 ref: 00007FF73AD3BA04

Part of subcall function 00007FF73AD3C230: send.WS2_32 ref: 00007FF73AD3C26D
Part of subcall function 00007FF73AD3C230: WSAGetLastError.WS2_32 ref: 00007FF73AD3C277

Strings

failed to load WS2_32.DLL (%u), xrefs: 00007FF73AD3B42B
WSAEnumNetworkEvents, xrefs: 00007FF73AD3B4E0
WSACreateEvent failed (%d), xrefs: 00007FF73AD3B51E
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF73AD3BA0A
insufficient winsock version to support telnet, xrefs: 00007FF73AD3BA3F
failed to find WSACloseEvent function (%u), xrefs: 00007FF73AD3B48C
WS2_32.DLL, xrefs: 00007FF73AD3B3FE
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF73AD3B500
WSAStartup failed (%d), xrefs: 00007FF73AD3B3BD
failed to find WSACreateEvent function (%u), xrefs: 00007FF73AD3B463
, xrefs: 00007FF73AD3B9A2
Time-out, xrefs: 00007FF73AD3B9B7
WSAEnumNetworkEvents failed (%d), xrefs: 00007FF73AD3B7F2
failed to find WSAEventSelect function (%u), xrefs: 00007FF73AD3B4D7
WSACloseEvent failed (%d), xrefs: 00007FF73AD3B9E0
WSACloseEvent, xrefs: 00007FF73AD3B46C
WSACreateEvent, xrefs: 00007FF73AD3B445
WSAEventSelect, xrefs: 00007FF73AD3B4B1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: 09bab5dfd0a1050dc16566aa1b7cf4762c81da28fbbf565bb227b1c71a5ee9be
Instruction ID: 752b54a13b86386de5ea34081982c55f101a43e3536ce959b4d3b97ca6f898b7
Opcode Fuzzy Hash: 09bab5dfd0a1050dc16566aa1b7cf4762c81da28fbbf565bb227b1c71a5ee9be
Instruction Fuzzy Hash: A412C079E28A82A1FB64AF2594163B9A3A0FB45B84F844175DA4E077DCDF7DE040E720

Function 00007FF73ACFB97D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC314
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC342
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC350
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC38A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC3E7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC4A0
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC4CE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC4DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC516
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC573

Part of subcall function 00007FF73ACFFD30: memcmp.VCRUNTIME140 ref: 00007FF73ACFFDBD
Part of subcall function 00007FF73ACFFD30: memcmp.VCRUNTIME140 ref: 00007FF73ACFFE41

Strings

array, xrefs: 00007FF73ACFC789
object separator, xrefs: 00007FF73ACFC280, 00007FF73ACFCAA9
object key, xrefs: 00007FF73ACFC40C, 00007FF73ACFCC38
number overflow parsing ', xrefs: 00007FF73ACFC58F
object, xrefs: 00007FF73ACFC918

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: dc7c8f70ece017b678ce96ceb78a522e73b5f35ef2c887ae0adcbfb1cdb96434
Instruction ID: 4dde2615f542e6136dc1a27de6954bd2c878c14f73c03f09bb8df093af227a00
Opcode Fuzzy Hash: dc7c8f70ece017b678ce96ceb78a522e73b5f35ef2c887ae0adcbfb1cdb96434
Instruction Fuzzy Hash: E692D276B19B86A6FF10EB68D4553ADA361FB417A4F800231DA6D07AD9DF7CE081E310

Function 00007FF73AD10E80 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD10EE6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD10F0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD10F68

Strings

public key hash: sha256//%s, xrefs: 00007FF73AD10F7E
sha256//, xrefs: 00007FF73AD10EDC, 00007FF73AD1102E
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF73AD1113A
;sha256//, xrefs: 00007FF73AD10FE0
-----END PUBLIC KEY-----, xrefs: 00007FF73AD1116E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: a88bebe2319867f2a29d7404d9809670e682c1f6d8e34b4361839db4683956b6
Instruction ID: f45890f83c01aaa5c19402b14d808361fbf21e59f1281f55b7a8684ca732cd0a
Opcode Fuzzy Hash: a88bebe2319867f2a29d7404d9809670e682c1f6d8e34b4361839db4683956b6
Instruction Fuzzy Hash: FEA1A059A29B4261FF94AB26A402279A790FF45BD0FC840B4ED4E47799EF3CE445E320

Function 00007FF73AD48190 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73AD481D6

Part of subcall function 00007FF73AD043E0: GetLastError.KERNEL32 ref: 00007FF73AD043FC
Part of subcall function 00007FF73AD043E0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04404

CreateFileA.KERNEL32 ref: 00007FF73AD48230
GetLastError.KERNEL32 ref: 00007FF73AD48241
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4857D

Strings

schannel: failed to read from CA file '%s': %s, xrefs: 00007FF73AD48480
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF73AD48553
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF73AD48542
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF73AD484D5
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF73AD484B6
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF73AD481F0
-----END CERTIFICATE-----, xrefs: 00007FF73AD483A9
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF73AD482A2
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF73AD48521
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF73AD48505
-----BEGIN CERTIFICATE-----, xrefs: 00007FF73AD4837E
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF73AD482D9
schannel: failed to open CA file '%s': %s, xrefs: 00007FF73AD4825B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 837417be68a0b86993f0d9a2acaf56ac0aabc9627356470fb6c0b852d90db816
Instruction ID: f3c4aaf903dd4ed810ddf7891cbf41ef80972a75a5dcbac197eb291a347cf81c
Opcode Fuzzy Hash: 837417be68a0b86993f0d9a2acaf56ac0aabc9627356470fb6c0b852d90db816
Instruction Fuzzy Hash: C3B1C369F28B51A2FA10AB25E4026ADA3A1FB457C4FC044B5DD4E5BB9CDF3CE500E720

Function 00007FF73AD150D0 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD1512A
memset.VCRUNTIME140 ref: 00007FF73AD1513F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1515B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15182
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD151F9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1522C
strchr.VCRUNTIME140 ref: 00007FF73AD15316
strchr.VCRUNTIME140 ref: 00007FF73AD1535B
strchr.VCRUNTIME140 ref: 00007FF73AD1538B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15433

Part of subcall function 00007FF73AD2DCE0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD08
Part of subcall function 00007FF73AD2DCE0: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD2E
Part of subcall function 00007FF73AD2DCE0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD4F
Part of subcall function 00007FF73AD2DCE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD60

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15506
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15535
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1555B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15587
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15595
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD155A7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1574A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15753

Strings

Uses proxy env variable %s == '%s', xrefs: 00007FF73AD1528C, 00007FF73AD154EA
no_proxy, xrefs: 00007FF73AD15251
all_proxy, xrefs: 00007FF73AD154B9
NO_PROXY, xrefs: 00007FF73AD1526D
http_proxy, xrefs: 00007FF73AD1547D
_proxy, xrefs: 00007FF73AD15449
memory shortage, xrefs: 00007FF73AD15207
ALL_PROXY, xrefs: 00007FF73AD154D0

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 87a442d9f6b5ce944168b9e003a38c7973c54f2c93fe0649b83e4c14fcefe897
Instruction ID: 620883f62f0d9407474018729348214b23c4b44af28e49df6f97f0ed1069bd4c
Opcode Fuzzy Hash: 87a442d9f6b5ce944168b9e003a38c7973c54f2c93fe0649b83e4c14fcefe897
Instruction Fuzzy Hash: 3102D36962D782A5FB91EB21A4163B9A790FF45788FC800B5DE8D07799DF3CE044E320

Function 00007FF73AD43350 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43406
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD434C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD434CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD434E1

Strings

digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF73AD436FB
realm, xrefs: 00007FF73AD43667
WDigest, xrefs: 00007FF73AD43391, 00007FF73AD437C5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 8398a34d6a0bf133b77949f209b192bff7e2f6d19aea41e0e4df37f24a9cf00a
Instruction ID: aa80c6528954099c9de34e050b035c61ea813380da9268699687fd5397158542
Opcode Fuzzy Hash: 8398a34d6a0bf133b77949f209b192bff7e2f6d19aea41e0e4df37f24a9cf00a
Instruction Fuzzy Hash: 3412AC7AA18B56AAFB10EF25E4452A9B7A4FB44B84FC440B5DE8D43BA8DF3CD404D710

Function 00007FF73AD193D0 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD194A2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD194BD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD194FC

Strings

Local Interface %s is ip %s using address family %i, xrefs: 00007FF73AD195B7
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF73AD196C8
Couldn't bind to '%s', xrefs: 00007FF73AD19592
bind failed with errno %d: %s, xrefs: 00007FF73AD19888
Bind to local port %hu failed, trying next, xrefs: 00007FF73AD197B0
getsockname() failed with errno %d: %s, xrefs: 00007FF73AD1984C
Couldn't bind to interface '%s', xrefs: 00007FF73AD19640
Local port: %hu, xrefs: 00007FF73AD198A5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 2a2872e945a84521f6b84c8d07c5cde60640c61a2f25760f1ebbd45357a6bd0c
Instruction ID: 4147f5446f3947b15a1bf3162f973b146cc074d06c8d50e8c987d2e8978ea49a
Opcode Fuzzy Hash: 2a2872e945a84521f6b84c8d07c5cde60640c61a2f25760f1ebbd45357a6bd0c
Instruction Fuzzy Hash: 83E1F66AF28682A6FB50EB21E4012F9A7A0FB85788F805176EE4F43759DF7CD440D710

Function 00007FF73AD2BD9C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD2BE38
strchr.VCRUNTIME140 ref: 00007FF73AD2BE64
strchr.VCRUNTIME140 ref: 00007FF73AD2BE9E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BEC2
strchr.VCRUNTIME140 ref: 00007FF73AD2BFD2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BFEA
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD2C115
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD2C141

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF73AD2C279
, xrefs: 00007FF73AD2BD9C
CurrentUser, xrefs: 00007FF73AD2BEB2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 08de004a40b4f3057b7c83490c12781fcf786c47ed8a6be9df3ff724dc8f06b1
Instruction ID: 101997bbd45c09591edd0c17fd6ff1f68a2e73915398dad805570369bce17c39
Opcode Fuzzy Hash: 08de004a40b4f3057b7c83490c12781fcf786c47ed8a6be9df3ff724dc8f06b1
Instruction Fuzzy Hash: 90810669B28746A1FF59AF2198163B9A790FF05B90FC44174CA2E467D8EF3DE444E320

Function 00007FF73ACFA4BB Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF73ACFACE4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFADC4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFADF2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFAE00
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFAE3B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFAE7A

Strings

array, xrefs: 00007FF73ACFAEFA
number overflow parsing ', xrefs: 00007FF73ACFAD00
object, xrefs: 00007FF73ACFB089

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: 5d6cd3a409471a1faf37548ba221951dc722727f8913c0f1fea7796612f7cc4e
Instruction ID: 898b6a7a71cce825c77572522138da9b7b89ccf825226232b6595e604629d5ab
Opcode Fuzzy Hash: 5d6cd3a409471a1faf37548ba221951dc722727f8913c0f1fea7796612f7cc4e
Instruction Fuzzy Hash: 6C32D176A19B87A6FF10AB68D4513EDA361FB417A4F804231DA9D07AD9DF7CE180E310

Function 00007FF73AD2BDA5 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD2BE38
strchr.VCRUNTIME140 ref: 00007FF73AD2BE64
strchr.VCRUNTIME140 ref: 00007FF73AD2BE9E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BEC2
strchr.VCRUNTIME140 ref: 00007FF73AD2BFD2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2BFEA
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD2C115
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD2C141

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF73AD2C279
CurrentUser, xrefs: 00007FF73AD2BEB2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: fa1a1195df9ec8da713b047f1f74c259d12eb95e106b43fec5dd2698c8803e51
Instruction ID: c1df68e87cd9de18f7964e7710b3d1e3dbb10cc1daad66dda5feafe05742d8f8
Opcode Fuzzy Hash: fa1a1195df9ec8da713b047f1f74c259d12eb95e106b43fec5dd2698c8803e51
Instruction Fuzzy Hash: 84811769B28746A1FF59AF2198163B9A790FF05790FC44174CA2E467D8EF3DE444E320

Function 00007FF73AD42320 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF73AD423B3
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD423DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD424A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD424AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD42512
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4251E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD42621
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4262F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD4263A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4268F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD426AE

Strings

, xrefs: 00007FF73AD423F1, 00007FF73AD425F2
password, xrefs: 00007FF73AD42559
login, xrefs: 00007FF73AD4253E
machine, xrefs: 00007FF73AD42571, 00007FF73AD425B2
default, xrefs: 00007FF73AD425CD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 4fff364203ea5e108a1ac3e9f9e2fb84d9b83cc2516c880108be4061567b611b
Instruction ID: 5d3eed7dbe3156a037b255150225123154287c7dcc4153070da99b6d9a6ce906
Opcode Fuzzy Hash: 4fff364203ea5e108a1ac3e9f9e2fb84d9b83cc2516c880108be4061567b611b
Instruction Fuzzy Hash: 34A1D82992C69265FB69BF21941237AE790FF94794F8840F1DD8D0669CDE3CE444E730

Function 00007FF73AD29A60 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29CDE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29CE6
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD29CFC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29D05
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29D0D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29D17

Strings

%02d:%02d%n, xrefs: 00007FF73AD29CBD
GMT, xrefs: 00007FF73AD29BD7
%02d:%02d:%02d%n, xrefs: 00007FF73AD29C89
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF73AD29B1E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 1a7e61c25a85243ec6ea3018c962de282b9d4355c4c1153fab2b406bca1d17d2
Instruction ID: 1e7a8bd9897d96420a65fcbdcc1c33b6fe1d6c7be7b0f05e548575026881b180
Opcode Fuzzy Hash: 1a7e61c25a85243ec6ea3018c962de282b9d4355c4c1153fab2b406bca1d17d2
Instruction Fuzzy Hash: ACF1147AF28615AAFB24AB28C4421BCB3A1EB44758F900275DE1F577DCDF38A805E750

Function 00007FF73AD2B0A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD2B0E0
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B0FF
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B129
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B141
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B166
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B192
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B1A2
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF73AD2B069), ref: 00007FF73AD2B1B4

Strings

@, xrefs: 00007FF73AD2B0F5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 4133925f26772bb60a5421b75906ac9122fd7e129f0c6c6a6a1ca186eceaa35b
Instruction ID: a71ce1f0d3ddad3cf30fa4e1c1c302a30f5b589f04bedb821b82a10b9ed5f4b9
Opcode Fuzzy Hash: 4133925f26772bb60a5421b75906ac9122fd7e129f0c6c6a6a1ca186eceaa35b
Instruction Fuzzy Hash: 1B316D7A628B8296FB61DF15E855A6AB7A0FBC4B80F844035EE8D53B18CF3CD445DB10

Function 00007FF73AD03BEE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_BAD_PKGID, xrefs: 00007FF73AD03BEE
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 869513566c08340eb8104fe3214b77cbae14751abf0f8e147a617354d4ac6d22
Instruction ID: 743f82f121aeca164c91302eecc3061ce969c9a89cdae18353cf1154308bfea6
Opcode Fuzzy Hash: 869513566c08340eb8104fe3214b77cbae14751abf0f8e147a617354d4ac6d22
Instruction Fuzzy Hash: 5E3185AAA1C6C1A5FA61EB20E4163AEF7A1FB84740FC00076DA8D02A99CF3CD544D721

Function 00007FF73AD123A0 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Found bundle for host %s: %p [%s], xrefs: 00007FF73AD124B9
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF73AD125E1
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF73AD12606
Could multiplex, but not asked to!, xrefs: 00007FF73AD1253C
can multiplex, xrefs: 00007FF73AD124A2
serially, xrefs: 00007FF73AD124AE
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF73AD12C6A
Server doesn't support multiplex yet, wait, xrefs: 00007FF73AD124EB
Server doesn't support multiplex (yet), xrefs: 00007FF73AD1250F
Can not multiplex, even if we wanted to!, xrefs: 00007FF73AD1255A
Multiplexed connection found!, xrefs: 00007FF73AD12C11

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 8b0f8a989666360a3a3a78e04154ed77bd1a1cc6402fab15bd18b5bf28d2d67f
Instruction ID: 6e3bacfacda60aeb1b41da03a1a0d2c59c05b4392a6f243a52141e3d13d9b11b
Opcode Fuzzy Hash: 8b0f8a989666360a3a3a78e04154ed77bd1a1cc6402fab15bd18b5bf28d2d67f
Instruction Fuzzy Hash: 8442F769A2C7C265FBEDAE3585523B9B7D1EB41748F8840B5CE5C0728DDF2EA450E320

Function 00007FF73AD50CD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF73AD50D16
CryptCreateHash.ADVAPI32 ref: 00007FF73AD50D3A
CryptHashData.ADVAPI32 ref: 00007FF73AD50D56
CryptGetHashParam.ADVAPI32 ref: 00007FF73AD50D75
CryptGetHashParam.ADVAPI32 ref: 00007FF73AD50D98
CryptDestroyHash.ADVAPI32 ref: 00007FF73AD50DA8
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD50DBA

Strings

@, xrefs: 00007FF73AD50CED

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 13d332818e2f811715d9f9e209b21b4e589ecd4c505965960861851f90cba6d2
Instruction ID: 0c31880f073567aa30a0917f87e5d660d0e0b8ab6b36a6b7cd8264d48d6ddbb1
Opcode Fuzzy Hash: 13d332818e2f811715d9f9e209b21b4e589ecd4c505965960861851f90cba6d2
Instruction Fuzzy Hash: FB219176628B8196FB609F25F45266AB7A0FBC9B84F804135EA8E03E1CCF3CD5449B10

Function 00007FF73AD51C30 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF73AD51C4C
memset.VCRUNTIME140 ref: 00007FF73AD51C70
RtlCaptureContext.KERNEL32 ref: 00007FF73AD51C79
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73AD51C93
RtlVirtualUnwind.KERNEL32 ref: 00007FF73AD51CD4
memset.VCRUNTIME140 ref: 00007FF73AD51D07
IsDebuggerPresent.KERNEL32 ref: 00007FF73AD51D28
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73AD51D45
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73AD51D50

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 2817642b79443c0a5ef4dfb04aa502709a74585c27d39edd6239e395c2667643
Instruction ID: 1cf7344dddeb6d6e00c8c4229bc9381c89b9487a15d8ca160124ff56289a22e5
Opcode Fuzzy Hash: 2817642b79443c0a5ef4dfb04aa502709a74585c27d39edd6239e395c2667643
Instruction Fuzzy Hash: CC3181B6619B8196FB60AF60E8517FDB360FB85704F84443ADA4D47B98EF38D548C720

Function 00007FF73AD4EBE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF73AD4EC27
CryptImportKey.ADVAPI32 ref: 00007FF73AD4ECF9
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD4ED11
CryptEncrypt.ADVAPI32 ref: 00007FF73AD4ED42
CryptDestroyKey.ADVAPI32 ref: 00007FF73AD4ED4C
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD4ED58

Strings

@, xrefs: 00007FF73AD4EC0D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: bdeb4a614d7e723bc909c715f6cda38daf1ad5301f0aa0ed7b84976966961ef2
Instruction ID: cd293b3022e8b011488e0cc63014c0162d04ce6c08dc4eda091c45e40275a7de
Opcode Fuzzy Hash: bdeb4a614d7e723bc909c715f6cda38daf1ad5301f0aa0ed7b84976966961ef2
Instruction Fuzzy Hash: 6041D066B14AA09EFB108BB5E4513EE7BB0FB4A748F444061DE8C13A49CF3CC11AE710

Function 00007FF73AD2E370 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF73AD2E368,?,?,?,?,?,?,00007FF73AD455AE), ref: 00007FF73AD2E3E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF73AD2E368,?,?,?,?,?,?,00007FF73AD455AE), ref: 00007FF73AD2E54D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2E6AC

Strings

%c%c%c%c, xrefs: 00007FF73AD2E4A3
%c%c==, xrefs: 00007FF73AD2E513
%c%c%c=, xrefs: 00007FF73AD2E4E1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: e05d4d8a4c6fc84fe1cd053079c3dd5ebb97807d0b7160f07d873dab8a2f3773
Instruction ID: 83703ac2cef6744ee481f900da1997ac7e45b0286a7676cafe431c3cffb1c37b
Opcode Fuzzy Hash: e05d4d8a4c6fc84fe1cd053079c3dd5ebb97807d0b7160f07d873dab8a2f3773
Instruction Fuzzy Hash: 41915A36A2C6C555FB21AB25A4013BEBFA0EB89790F884671DAAD077CADF3CD401D710

Function 00007FF73AD3D4F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D53F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D59C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D5C0
bind.WS2_32 ref: 00007FF73AD3D63B
WSAGetLastError.WS2_32 ref: 00007FF73AD3D645

Strings

bind() failed; %s, xrefs: 00007FF73AD3D660

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: cd253e5438f491a74154c9e640c3cd6978355dfa3751ad09cad76179119f3d51
Instruction ID: 2d21a5c1110c179f0b0c6cfafb0e71a85c0906034014af4b0426de511c407da0
Opcode Fuzzy Hash: cd253e5438f491a74154c9e640c3cd6978355dfa3751ad09cad76179119f3d51
Instruction Fuzzy Hash: 58510139A18B86A2FB15AF22C4513B8A3A0FB05B84F844974CA9D077DDDF3DE450DB20

Function 00007FF73AD3D2BE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 112networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D30E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D36B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3D393
bind.WS2_32 ref: 00007FF73AD3D412
WSAGetLastError.WS2_32 ref: 00007FF73AD3D41C

Strings

bind() failed; %s, xrefs: 00007FF73AD3D437

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 62f3814ab072319b4b32476f9713f81e90644331c3b35f721498b43526bc8a9d
Instruction ID: aaf07d81aa551ef9e4e1af45bf0e5f1d850e5c0eefdd18532e90c0564889ccab
Opcode Fuzzy Hash: 62f3814ab072319b4b32476f9713f81e90644331c3b35f721498b43526bc8a9d
Instruction Fuzzy Hash: 6F411F76B18B85A6FB14AB21D4413B8A3A0FB48B84F844575CE4D4B7C9DF3DE460DB20

Function 00007FF73AD27180 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dk, xrefs: 00007FF73AD271AE
%4I64dT, xrefs: 00007FF73AD27290
%4I64dG, xrefs: 00007FF73AD27274
%2I64d.%0I64dM, xrefs: 00007FF73AD271C9
%4I64dM, xrefs: 00007FF73AD2721C
%4I64dP, xrefs: 00007FF73AD2729D
%5I64d, xrefs: 00007FF73AD27195
%2I64d.%0I64dG, xrefs: 00007FF73AD2723A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 056a3a87ed820c39db5f7b1f4f57aecf46d6ea71dbc723de60fecf4560fbfaf3
Instruction ID: e909de17c0048373a75045a0c8aba6f8d4f756f0c9244ec3cc209305b290f511
Opcode Fuzzy Hash: 056a3a87ed820c39db5f7b1f4f57aecf46d6ea71dbc723de60fecf4560fbfaf3
Instruction Fuzzy Hash: 7721839DE2994E63FE24E796A4137F88231EF45780EC414F2EC0E067999FAD6541F120

Function 00007FF73AD51FC8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF73ACF173C), ref: 00007FF73AD51FDE
GetLastError.KERNEL32 ref: 00007FF73AD52029
IsDebuggerPresent.KERNEL32 ref: 00007FF73AD52041
OutputDebugStringW.KERNEL32 ref: 00007FF73AD52052

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF73AD5204B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 9366033f6902c7c1071b8873425f60a844e631ce242eefe73f0e5e0528f62cea
Instruction ID: 07b7c8614deb5acd8e065253429a924c713d2d4afe3773fa6c1996bb03f0421c
Opcode Fuzzy Hash: 9366033f6902c7c1071b8873425f60a844e631ce242eefe73f0e5e0528f62cea
Instruction Fuzzy Hash: 14114F76624B82A2FB44AB26D556379B2A0FB04345F808175C65D42A69EF3CE0A8D720

Function 00007FF73AD2AFD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF73AD2B001
CryptGenRandom.ADVAPI32 ref: 00007FF73AD2B015
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD2B026
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD2B03C

Strings

@, xrefs: 00007FF73AD2AFE9

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 3d6679f5d1a8bd536e5d3f9d326de689657df2fc498cf2213148d4a827f29bd3
Instruction ID: 5b62abc26201f4c2bb259fd1b1ef9f532a57370686956775ee053c9da347ccec
Opcode Fuzzy Hash: 3d6679f5d1a8bd536e5d3f9d326de689657df2fc498cf2213148d4a827f29bd3
Instruction Fuzzy Hash: 54F08169B18B8192FB109F25F95536BE3A0EF88BD4F844070DE8C46A6CDF7CC0858B10

Function 00007FF73ACF1000 Relevance: 7.9, Strings: 6, Instructions: 363COMMON

Download Yara Rule

Strings

6b36407be8dde999435ae16b983386e3be5bbed61532f6eb8e82edb4fe21b4ab, xrefs: 00007FF73ACF1314
1.0, xrefs: 00007FF73ACF1205
fivem, xrefs: 00007FF73ACF15BF
fivem, xrefs: 00007FF73ACF1021, 00007FF73ACF15FA
9WIvTVJa9m, xrefs: 00007FF73ACF155C
https://keyauth.win/api/1.2/, xrefs: 00007FF73ACF1037

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 1.0$6b36407be8dde999435ae16b983386e3be5bbed61532f6eb8e82edb4fe21b4ab$9WIvTVJa9m$fivem$fivem$https://keyauth.win/api/1.2/
API String ID: 0-1544451013
Opcode ID: 67221ff05def8fc3bc765e4f1f8554d147a11c6b0e4e22af859cb45be6267052
Instruction ID: c7f4d9b985061a66b80f980debbc4728d87e307901bbf79b477c392ba45f4aeb
Opcode Fuzzy Hash: 67221ff05def8fc3bc765e4f1f8554d147a11c6b0e4e22af859cb45be6267052
Instruction Fuzzy Hash: C1F16C69E3EB9269F703A735D8121A4E754EFA3384FC0C376ED4831966EF296285D304

Function 00007FF73AD51E44 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF73AD51E70
GetCurrentThreadId.KERNEL32 ref: 00007FF73AD51E7E
GetCurrentProcessId.KERNEL32 ref: 00007FF73AD51E8A
QueryPerformanceCounter.KERNEL32 ref: 00007FF73AD51E9A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 5b7df0b8cee6e7efd2ebdc7a4b6fe8109373dd1135617f400eda81176904df43
Instruction ID: ccfdcd9a114868ef85c8e6039726d781c6b56cbf902a13683c4807a4d2a0dd1c
Opcode Fuzzy Hash: 5b7df0b8cee6e7efd2ebdc7a4b6fe8109373dd1135617f400eda81176904df43
Instruction Fuzzy Hash: 5711706AB68F0599FF00DF60E8552B873A4FB19758F840E31DA2D82BA8EF38D1548350

Function 00007FF73AD2DFC0 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF73AD2DFF0
CryptGetHashParam.ADVAPI32 ref: 00007FF73AD2E016
CryptDestroyHash.ADVAPI32 ref: 00007FF73AD2E025
CryptReleaseContext.ADVAPI32 ref: 00007FF73AD2E035

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 96d512b1121ee9696c480b564d554f8895ac3911cab137d0dde9ff799dcff135
Instruction ID: 741793135dba8a7968951c3e8b9363cca92e1a2fae4943858afe33ce623b5bb1
Opcode Fuzzy Hash: 96d512b1121ee9696c480b564d554f8895ac3911cab137d0dde9ff799dcff135
Instruction Fuzzy Hash: DF01BC7A618641D2FB10DF24E06636AF770EB84B88F988031DB4D06A2CCF3DC489DB10

Function 00007FF73AD2DF60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF73AD2DF7C
CryptCreateHash.ADVAPI32 ref: 00007FF73AD2DF9D

Strings

@, xrefs: 00007FF73AD2DF6C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: f0b4b555460d3b3b1cd8dd556586a602bc4bc9f123f4cd3dc049f2e5c92a5d03
Instruction ID: 3795314a5175d1e0da3a8e7e770736f3a241b58140fa8288ae7ce2c38dcf67cd
Opcode Fuzzy Hash: f0b4b555460d3b3b1cd8dd556586a602bc4bc9f123f4cd3dc049f2e5c92a5d03
Instruction Fuzzy Hash: 6BE04865B3469253FB705F65E412B16A390EB94748F844170DF8C46E58DF3DC1558B14

Function 00007FF73ACFEB60 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF73ACFEC64

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 54efa5f2676a19d4adf10e1201545ef9559aef978ab5c5334c87b6b7a5b67db6
Instruction ID: d706dd07525ccf860b99d75787afc8acea737a698de3e6725727ec139eab5738
Opcode Fuzzy Hash: 54efa5f2676a19d4adf10e1201545ef9559aef978ab5c5334c87b6b7a5b67db6
Instruction Fuzzy Hash: E781E066B0ABAA98FB00DB69D4A53AC7770E715B88F944072DF4E47795DF38D080D310

Function 00007FF73ACFDFD0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction ID: 9e08b9c794225870cdf9ce1d069deb45a5feabccf584372fd522b7a3d537d72b
Opcode Fuzzy Hash: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction Fuzzy Hash: 09612576B0AB8A92FB10CB29E456279A3A1EB49BD0F519231DF5D47B84EF3DE041D300

Function 00007FF73AD50C60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: 94816c6376bf1fdcfb86197ef80826a23593f3880ab5cd1aa5bace72057f3a37
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 75F08C69325767BEFE00853B5624FBD5E409BC2700FB368748C80020CB8A9E5493D714

Function 00007FF73AD2DFB0 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae014308f0b8bb8d01c505bd5ad95d5d34cd340cf9dea9f03567bc79e687216f
Instruction ID: c25c57e8a568d6e78672d321b4be6cc81cdaf93bbfb5f4884e43e772954d1ff0
Opcode Fuzzy Hash: ae014308f0b8bb8d01c505bd5ad95d5d34cd340cf9dea9f03567bc79e687216f
Instruction Fuzzy Hash: 6FA011A2A0AA0A80AA008B08E2A2E22A2A0FB88B083808030880C028288E2880028200

Function 00007FF73AD51DD8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df5dd26acc25ab4cb6a93150873b31a805fbcbb2c6ae98191b93a643ee72901
Instruction ID: 621734b985a2167d1b941fc6a7d611e37e95ec5bfb60990e3f66622f6bd3c7e9
Opcode Fuzzy Hash: 0df5dd26acc25ab4cb6a93150873b31a805fbcbb2c6ae98191b93a643ee72901
Instruction Fuzzy Hash: 1FA002A9E2CD42F0FF05BB50E866430B330FF90701BC001B2D00D41968AF3CA480EB20

Function 00007FF73AD2B1D0 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF73AD2B203
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B253
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B274
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B28A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B2A8
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B2C6
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B2E4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B2FC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD2B314

Strings

CALG_AES_128, xrefs: 00007FF73AD2B6AF
CALG_TEK, xrefs: 00007FF73AD2B50B
CALG_ECMQV, xrefs: 00007FF73AD2B799
CALG_SKIPJACK, xrefs: 00007FF73AD2B4ED
CALG_ECDSA, xrefs: 00007FF73AD2B7B4
CALG_ECDH, xrefs: 00007FF73AD2B77E
CALG_RC4, xrefs: 00007FF73AD2B439
CALG_AES, xrefs: 00007FF73AD2B709
CALG_MD4, xrefs: 00007FF73AD2B2A1
CALG_CYLINK_MEK, xrefs: 00007FF73AD2B529
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF73AD2B5BF
CALG_MD5, xrefs: 00007FF73AD2B2BF
CALG_RSA_KEYX, xrefs: 00007FF73AD2B385
CALG_ECDH_EPHEM, xrefs: 00007FF73AD2B7CF
CALG_DSS_SIGN, xrefs: 00007FF73AD2B349
CALG_RC5, xrefs: 00007FF73AD2B637
CALG_NO_SIGN, xrefs: 00007FF73AD2B367
CALG_SHA_256, xrefs: 00007FF73AD2B727
CALG_SHA_512, xrefs: 00007FF73AD2B763
CALG_3DES_112, xrefs: 00007FF73AD2B3C1
CALG_DH_EPHEM, xrefs: 00007FF73AD2B493
CALG_3DES, xrefs: 00007FF73AD2B3DF
CALG_RC2, xrefs: 00007FF73AD2B41B
CALG_SEAL, xrefs: 00007FF73AD2B457
CALG_SSL3_MASTER, xrefs: 00007FF73AD2B565
CALG_AES_256, xrefs: 00007FF73AD2B6EB
CALG_MD2, xrefs: 00007FF73AD2B283
CALG_DH_SF, xrefs: 00007FF73AD2B475
CALG_AES_192, xrefs: 00007FF73AD2B6CD
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF73AD2B583
CALG_HUGHES_MD5, xrefs: 00007FF73AD2B4CF
CALG_TLS1_MASTER, xrefs: 00007FF73AD2B619
CALG_SSL2_MASTER, xrefs: 00007FF73AD2B5FB
CALG_TLS1PRF, xrefs: 00007FF73AD2B673
CALG_RSA_SIGN, xrefs: 00007FF73AD2B32B
CALG_HASH_REPLACE_OWF, xrefs: 00007FF73AD2B691
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF73AD2B5A1
CALG_SHA1, xrefs: 00007FF73AD2B2F5
CALG_SHA, xrefs: 00007FF73AD2B2DD
CALG_HMAC, xrefs: 00007FF73AD2B655
CALG_SSL3_SHAMD5, xrefs: 00007FF73AD2B547
CALG_MAC, xrefs: 00007FF73AD2B30D
CALG_DESX, xrefs: 00007FF73AD2B3FD
CALG_SHA_384, xrefs: 00007FF73AD2B745
CALG_DES, xrefs: 00007FF73AD2B3A3
CALG_AGREEDKEY_ANY, xrefs: 00007FF73AD2B4B1
CALG_PCT1_MASTER, xrefs: 00007FF73AD2B5DD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: fa9e62b0b939ff09948195c474fc8e9f909ac0562f4f0d96492c6b0c6b34c294
Instruction ID: 90b9844526c0e6188ce51e84fbc617fc63228f8958bb3feda44ed3dfb5459555
Opcode Fuzzy Hash: fa9e62b0b939ff09948195c474fc8e9f909ac0562f4f0d96492c6b0c6b34c294
Instruction Fuzzy Hash: 2B02FD58E3C61BB4FF10BB25D8525BD9665EF60348FC040B1E90E8A59DEF5CE90AE360

Function 00007FF73AD38C30 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD38D2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD38E2E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD38EA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD38F1B

Strings

CSeq cannot be set as a custom header., xrefs: 00007FF73AD38F60
Content-Type, xrefs: 00007FF73AD391B3, 00007FF73AD391E9
Referer, xrefs: 00007FF73AD38EB7
Content-Type: application/sdp, xrefs: 00007FF73AD391FD
Accept, xrefs: 00007FF73AD38D88
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF73AD38CB3
Accept-Encoding: %s, xrefs: 00007FF73AD38DD9
Session ID cannot be set as a custom header., xrefs: 00007FF73AD38F8D
Range: %s, xrefs: 00007FF73AD38F23
Transport: %s, xrefs: 00007FF73AD38D3A
Content-Length: %I64d, xrefs: 00007FF73AD39187
CSeq, xrefs: 00007FF73AD38F4C
%s%s%s%s%s%s%s%s, xrefs: 00007FF73AD39086
Accept: application/sdp, xrefs: 00007FF73AD38D9A
OPTIONS, xrefs: 00007FF73AD38C30
Failed sending RTSP request, xrefs: 00007FF73AD39291
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF73AD38FC7
User-Agent, xrefs: 00007FF73AD38E0E, 00007FF73AD38E3D
Transport, xrefs: 00007FF73AD38CDE
Content-Length, xrefs: 00007FF73AD3916C
Accept-Encoding, xrefs: 00007FF73AD38DA4
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF73AD38D65
Session, xrefs: 00007FF73AD38F79
Content-Type: text/parameters, xrefs: 00007FF73AD391C7
Range, xrefs: 00007FF73AD38EF7
Session: %s, xrefs: 00007FF73AD38FFD
Referer: %s, xrefs: 00007FF73AD38ED2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 70b1589892abf31abc647d5b3cef7e10e26665819bad749bae25edf0bf5e1fc8
Instruction ID: 92e932205d5b66e458d13b8fc092a810aad82079c6d324ce7ce51073e67aa69d
Opcode Fuzzy Hash: 70b1589892abf31abc647d5b3cef7e10e26665819bad749bae25edf0bf5e1fc8
Instruction Fuzzy Hash: 0502936DA19B82A1FE60BB21A4523BAA391EF44784FC440B1CE4D4779DEF3DE445E320

Function 00007FF73AD4FBB0 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FC96
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FD3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FD92
htonl.WS2_32 ref: 00007FF73AD4FDBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FDD1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FE00
htonl.WS2_32 ref: 00007FF73AD4FE15
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FE42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FEC9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FED2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FEDB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF24
memcpy.VCRUNTIME140 ref: 00007FF73AD4FF3F
memcpy.VCRUNTIME140 ref: 00007FF73AD4FF53
memcpy.VCRUNTIME140 ref: 00007FF73AD4FF69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF90
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FF99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FFA2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4FFAB

Strings

GSSAPI handshake failure (invalid security data), xrefs: 00007FF73AD4FD27
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF73AD4FDA6
GSSAPI handshake failure (empty security message), xrefs: 00007FF73AD4FD17, 00007FF73AD4FFB8

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 38cb1c6ba4c226e3ac26dfdf1f68597fb04718f5678c7ac4d275bde0c8a8fbfe
Instruction ID: 9d1a7a472aec9fca6af345a11640950162d99421d37af33d63aa9608001a7869
Opcode Fuzzy Hash: 38cb1c6ba4c226e3ac26dfdf1f68597fb04718f5678c7ac4d275bde0c8a8fbfe
Instruction Fuzzy Hash: 46C18F3AA28B5296FB00EB65E4412BDB7A0FB49B94F804075DE8D47B68DF3CD449DB10

Function 00007FF73AD14350 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1436D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14383
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14397
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD143AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD143BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD143D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD143E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD143FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1440F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14423
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14437
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1444B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1445F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14473
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14487
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1449B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD144AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD144C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD144D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD144EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD144FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14513
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14527
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1453B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1454F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14563
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14577
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1458B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1459F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD145B3

Part of subcall function 00007FF73AD14640: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145C8), ref: 00007FF73AD1465B
Part of subcall function 00007FF73AD14640: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145C8), ref: 00007FF73AD14689

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD145DD

Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E01
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E11
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E1F
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E2D
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E3B
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E49
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E57
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD14609
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1461D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1462D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4889d94d5c5b74382897776f6df99c350cdccf4b5dfb6516fd6745a93b313fdb
Instruction ID: 03a963c2dcc8743e7e17b5b40ed2124652c814f0a678c1e59b1fc39f1ddd70af
Opcode Fuzzy Hash: 4889d94d5c5b74382897776f6df99c350cdccf4b5dfb6516fd6745a93b313fdb
Instruction Fuzzy Hash: BA71EF39558F8191E740AF31E4952BC73A8FB89F99F884075CE9D4B728CF389199D321

Function 00007FF73ACF3980 Relevance: 39.0, APIs: 18, Strings: 4, Instructions: 486windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2BD7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2C47
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CA7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2CF7
Part of subcall function 00007FF73ACF2B70: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2D47

Part of subcall function 00007FF73AD01790: GetCurrentProcess.KERNEL32 ref: 00007FF73AD0189E
Part of subcall function 00007FF73AD01790: OpenProcessToken.ADVAPI32 ref: 00007FF73AD018B0

Part of subcall function 00007FF73ACF4150: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF425F
Part of subcall function 00007FF73ACF4150: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF42A0

Part of subcall function 00007FF73ACF49A0: memcpy.VCRUNTIME140 ref: 00007FF73ACF49F3

Part of subcall function 00007FF73ACF3600: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF36E0

Part of subcall function 00007FF73ACF3880: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3960

Part of subcall function 00007FF73ACF3700: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF37E0

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3BE1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3C30
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3C6F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3CC0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3CFF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3D53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3D92
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3DE0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3E1F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3EDA

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

memcpy.VCRUNTIME140 ref: 00007FF73ACF3EFE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF3FE3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF4033
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF407B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF40F8

Part of subcall function 00007FF73ACF5640: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF5700

MessageBoxA.USER32 ref: 00007FF73ACF412E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF413F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF4146

Part of subcall function 00007FF73ACF18C0: __std_exception_copy.VCRUNTIME140 ref: 00007FF73ACF1904

Strings

Failure, xrefs: 00007FF73ACF4125
info, xrefs: 00007FF73ACF3F73
message, xrefs: 00007FF73ACF40FF
success, xrefs: 00007FF73ACF3F46

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$Processmemcpy$Concurrency::cancel_current_taskCurrentMessageOpenToken__std_exception_copyexitmalloc
String ID: Failure$info$message$success
API String ID: 2728552624-4226675393
Opcode ID: cbb21ccffa80fcf26fa22f6abc24908564eb7831665ef719a18e249cea6223f9
Instruction ID: d6fc28afc862bb6efc44922c8f98a02800de59a762047b64dd4161aed8695166
Opcode Fuzzy Hash: cbb21ccffa80fcf26fa22f6abc24908564eb7831665ef719a18e249cea6223f9
Instruction Fuzzy Hash: 9B2204A6A19B8265FB00EF28D8553ED6761FB407A8F804671D66C07BDADF7CD084E310

Function 00007FF73ACFBB8F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF73ACFBB97
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC653
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC681
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFC68F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC6CA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFC709

Strings

array, xrefs: 00007FF73ACFC789
number overflow parsing ', xrefs: 00007FF73ACFC58F
object, xrefs: 00007FF73ACFC918

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: ddb3d61301d0e1ed8d0e5f0bcdc69018728351f7acaa656f6d9ebfc75dea4813
Instruction ID: a15044045dff49634ebc75b1adde8ae7fbc3fc5fa60d2ac5ac134cdaf6c4d0c8
Opcode Fuzzy Hash: ddb3d61301d0e1ed8d0e5f0bcdc69018728351f7acaa656f6d9ebfc75dea4813
Instruction Fuzzy Hash: BB22F576B19B86A6FB10EB78D8553ADA321FB417A4F800271DA6D07AD9DF7CD081E310

Function 00007FF73AD44950 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD44A39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD44A80
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD44CD6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD44CED
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD44D08
htons.WS2_32 ref: 00007FF73AD44D67

Strings

TTL: %u seconds, xrefs: 00007FF73AD44B15
DOH A: %u.%u.%u.%u, xrefs: 00007FF73AD44B4E
%s, xrefs: 00007FF73AD44C23
CNAME: %s, xrefs: 00007FF73AD44C63
AAAA, xrefs: 00007FF73AD44AA6
DOH: %s type %s for %s, xrefs: 00007FF73AD44AB4
DOH Host name: %s, xrefs: 00007FF73AD44B01
bad error code, xrefs: 00007FF73AD44A98
DOH AAAA: , xrefs: 00007FF73AD44B82
Could not DOH-resolve: %s, xrefs: 00007FF73AD449A6
%s%02x%02x, xrefs: 00007FF73AD44BCE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 2e67faace451f066cac9b423d8b0440723d48db48c46238b03c9fdce2cc41085
Instruction ID: ac5d637cf2bcd628ba8ae0cba16a8bc012b143fae4312a7c9745a42a7205d52d
Opcode Fuzzy Hash: 2e67faace451f066cac9b423d8b0440723d48db48c46238b03c9fdce2cc41085
Instruction Fuzzy Hash: 6AE1C27AA28A96A6FB60EF20D4023ADB7A0FB45B84F8440B1DA4D0775CDF3CE584D710

Function 00007FF73AD3DA80 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF73AD3DAE1
memchr.VCRUNTIME140 ref: 00007FF73AD3DB17
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD3DB9B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD3DC2B

Strings

server requested blksize larger than allocated, xrefs: 00007FF73AD3DC88
tsize parsed from OACK, xrefs: 00007FF73AD3DC34
%s (%ld), xrefs: 00007FF73AD3DC92
blksize is larger than max supported, xrefs: 00007FF73AD3DCD1
%s (%ld), xrefs: 00007FF73AD3DC3B
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF73AD3DD07
blksize is smaller than min supported, xrefs: 00007FF73AD3DCAE
%s (%d), xrefs: 00007FF73AD3DCB5, 00007FF73AD3DCD8
blksize, xrefs: 00007FF73AD3DB7F
tsize, xrefs: 00007FF73AD3DC0F
%s (%d) %s (%d), xrefs: 00007FF73AD3DBED
requested, xrefs: 00007FF73AD3DBDA
got option=(%s) value=(%s), xrefs: 00007FF73AD3DB5C
blksize parsed from OACK, xrefs: 00007FF73AD3DBD3
Malformed ACK packet, rejecting, xrefs: 00007FF73AD3DD1A
invalid blocksize value in OACK packet, xrefs: 00007FF73AD3DCEE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 303c895615b718c1204ea891a3a160cb41ca10eced6d83239f99ca68a4fb32ec
Instruction ID: 659026e15cfc45f6fc21536d482c71249301e295af65a23fa24566cf4dc43953
Opcode Fuzzy Hash: 303c895615b718c1204ea891a3a160cb41ca10eced6d83239f99ca68a4fb32ec
Instruction Fuzzy Hash: 8161C3A8F28642A1FA10FB25E4022B9A691EF45BD0FD04AB1D99D476DDCF3CE145E720

Function 00007FF73AD0DBA0 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD074F7
Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD07503

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DE34
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DE3C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DE63
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DE6C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DEF0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0DEF9

Strings

application/octet-stream, xrefs: 00007FF73AD0DCC6
multipart/mixed, xrefs: 00007FF73AD0DC95
Content-Type, xrefs: 00007FF73AD0DC28
multipart/, xrefs: 00007FF73AD0DDD7
text/plain, xrefs: 00007FF73AD0DD0C
Content-Transfer-Encoding, xrefs: 00007FF73AD0DF61
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF73AD0DEB9
attachment, xrefs: 00007FF73AD0DDEB, 00007FF73AD0DDF2
Content-Type: %s%s%s, xrefs: 00007FF73AD0DF1D
8bit, xrefs: 00007FF73AD0E07A
form-data, xrefs: 00007FF73AD0E0A6
multipart/form-data, xrefs: 00007FF73AD0DFF7
; name=", xrefs: 00007FF73AD0DE8F
Content-Transfer-Encoding: %s, xrefs: 00007FF73AD0E081
; filename=", xrefs: 00007FF73AD0DE81
; boundary=, xrefs: 00007FF73AD0DF13
Content-Disposition, xrefs: 00007FF73AD0DD61

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: 610fe3032d6bc82f861157c1fdad02ad1d5042499334d0e847163bbf69b495fb
Instruction ID: 0f4c0273290b85fe999b3b35956ab7a5abc28d4fac207c8876696bb93e1256fe
Opcode Fuzzy Hash: 610fe3032d6bc82f861157c1fdad02ad1d5042499334d0e847163bbf69b495fb
Instruction Fuzzy Hash: FBE1C629B2878271FA65EB1198022B9E790FF04B84FC845B6CE8D0768DDF3CE454E321

Function 00007FF73ACF7090 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

memcpy.VCRUNTIME140 ref: 00007FF73ACF7206
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73ACF7298
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73ACF72D9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7423
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7462
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF74B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF74F1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF754E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7608

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7649
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7716
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF7757
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF777A

Strings

; expected , xrefs: 00007FF73ACF76A0
unexpected , xrefs: 00007FF73ACF7593
; last read: ', xrefs: 00007FF73ACF735C
rsing , xrefs: 00007FF73ACF71E8
syntax error , xrefs: 00007FF73ACF70DD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 154e10118ac65d4ba06d727cc511c6c5a02f97ee87f0fe6b43262398b2398a81
Instruction ID: bc9a82880665328379e3f02917a1cc68285cdda378701a53181503c17e902895
Opcode Fuzzy Hash: 154e10118ac65d4ba06d727cc511c6c5a02f97ee87f0fe6b43262398b2398a81
Instruction Fuzzy Hash: 0B12156AF19A4291FB10EB68E4113ADA761EB457E8F804771DAAD03BD9DF7CD084E310

Function 00007FF73AD3FFE0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3FFF0
strstr.VCRUNTIME140 ref: 00007FF73AD4001F
strchr.VCRUNTIME140 ref: 00007FF73AD4004B
strrchr.VCRUNTIME140 ref: 00007FF73AD40065
strchr.VCRUNTIME140 ref: 00007FF73AD4007A
strrchr.VCRUNTIME140 ref: 00007FF73AD400DA

Strings

., xrefs: 00007FF73AD400BA
/, xrefs: 00007FF73AD40035
/, xrefs: 00007FF73AD400AE
/, xrefs: 00007FF73AD400F3
?, xrefs: 00007FF73AD40058

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: 6b28ee7bcbdab15995d06b5ce03319e057799f6fdbd4524478234f115d91a2e6
Instruction ID: 64dcce4aac346296af0cafe93bcf343904644c50d39f02c66cd2b97436107891
Opcode Fuzzy Hash: 6b28ee7bcbdab15995d06b5ce03319e057799f6fdbd4524478234f115d91a2e6
Instruction Fuzzy Hash: 8681C01AA1D2A265FB656A21A502379EBD1EF45780FC840F1DE8D077CAEE3CE445E321

Function 00007FF73AD3AEE0 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF73AD3AFB3
strchr.VCRUNTIME140 ref: 00007FF73AD3B00A
strchr.VCRUNTIME140 ref: 00007FF73AD3B022
strchr.VCRUNTIME140 ref: 00007FF73AD3B03D
strchr.VCRUNTIME140 ref: 00007FF73AD3B0B9
strchr.VCRUNTIME140 ref: 00007FF73AD3B0D1
strchr.VCRUNTIME140 ref: 00007FF73AD3B0EC
strchr.VCRUNTIME140 ref: 00007FF73AD3B107
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3B194

Strings

/MATCH:, xrefs: 00007FF73AD3AF1A
/FIND:, xrefs: 00007FF73AD3AF50
/D:, xrefs: 00007FF73AD3AF86
lookup word is missing, xrefs: 00007FF73AD3B054, 00007FF73AD3B11E
/M:, xrefs: 00007FF73AD3AF35
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF73AD3AFEA
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF73AD3B09A
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF73AD3B175
/LOOKUP:, xrefs: 00007FF73AD3AF9D
default, xrefs: 00007FF73AD3B063, 00007FF73AD3B12D
/DEFINE:, xrefs: 00007FF73AD3AF6B
Failed sending DICT request, xrefs: 00007FF73AD3B1A1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 4d8a0cb5b250a8f6dc45fe641b72d2b1af6ad8dfec1ff8f093a845bc13a4b92d
Instruction ID: 7f5516c4613986c17eb66725c2e3275fb006277a0b6d9ea77a6a147ddd4cfbca
Opcode Fuzzy Hash: 4d8a0cb5b250a8f6dc45fe641b72d2b1af6ad8dfec1ff8f093a845bc13a4b92d
Instruction Fuzzy Hash: 4981BC59F2968260FF51AB2199022B9E281EF45BC4FC881B1DA8C077DDEF2DE445E231

Function 00007FF73AD16F10 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16F2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16F42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16F56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16F63

Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E01
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E11
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E1F
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E2D
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E3B
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E49
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E57
Part of subcall function 00007FF73AD10DF0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E65

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16F9F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16FB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17006
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1701A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1702E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17042
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD170AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD170BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD170D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD170E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1714A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1718A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1719E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD171B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD171C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD171DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD171EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17202
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17216
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17238

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 97829e33dc5bb7926e0fb57e14c2ccf90653775270aaccbadb8f27eed4e50b39
Instruction ID: eae60e1c11ef12b62e79b23d46158b7bda9b9d944bda62653afe2452aca97907
Opcode Fuzzy Hash: 97829e33dc5bb7926e0fb57e14c2ccf90653775270aaccbadb8f27eed4e50b39
Instruction Fuzzy Hash: F191D63A614F81A3E7499F31E9912ACB368F749F48F444175EFAD47369CF34A2A58320

Function 00007FF73AD20370 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 312stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD20465
strchr.VCRUNTIME140 ref: 00007FF73AD20505
memcpy.VCRUNTIME140 ref: 00007FF73AD20535
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD20561
strchr.VCRUNTIME140 ref: 00007FF73AD205AC
memcpy.VCRUNTIME140 ref: 00007FF73AD2060B

Part of subcall function 00007FF73AD0C8C0: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0C904

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD20724

Strings

:%u, xrefs: 00007FF73AD20479, 00007FF73AD20738
Resolve address '%s' found illegal!, xrefs: 00007FF73AD2068B
%255[^:]:%d, xrefs: 00007FF73AD203F1
@, xrefs: 00007FF73AD205F6
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF73AD207AB
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF73AD2069A
], xrefs: 00007FF73AD205E5
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF73AD2084E
Added %s:%d:%s to DNS cache, xrefs: 00007FF73AD2081D
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF73AD20407

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpystrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 1094891576-1753329177
Opcode ID: 098fd66521105fe60521f42df3e8fbc25a4f0bdb7e95ef50ae0321cb69c7fa03
Instruction ID: 54249f34401a5ee633328ae932d3f41f5a5317ef1b4ce53f0956d96cfac4d01b
Opcode Fuzzy Hash: 098fd66521105fe60521f42df3e8fbc25a4f0bdb7e95ef50ae0321cb69c7fa03
Instruction Fuzzy Hash: 9DD1062AA2C68AA5FF50AB20E4013F9A7A0FB44798FC44572DA1D07ACDDF3CD801D720

Function 00007FF73AD15FE0 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD16302

Strings

socks5, xrefs: 00007FF73AD160A0
Unsupported proxy syntax in '%s', xrefs: 00007FF73AD162EA
https, xrefs: 00007FF73AD16064
Unsupported proxy scheme for '%s', xrefs: 00007FF73AD16111
socks5h, xrefs: 00007FF73AD16082
socks4a, xrefs: 00007FF73AD160BB
socks, xrefs: 00007FF73AD160EA
http, xrefs: 00007FF73AD160FE
socks4, xrefs: 00007FF73AD160D6
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF73AD16144

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: b96cb19b3cfa9ea5ff55e13c82a5b406affe547f457c7338a0defd97fc7f88b8
Instruction ID: d19e7bff8d63eb30cd36ddac69a3f26009f61419f83facab72e9f781e17220b7
Opcode Fuzzy Hash: b96cb19b3cfa9ea5ff55e13c82a5b406affe547f457c7338a0defd97fc7f88b8
Instruction Fuzzy Hash: 8CA1E12AF28702A5FB90EB61E8426BDA7A4FB44794F8444B1CE0D1769DDF3CE544E320

Function 00007FF73AD34C00 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD2DE20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF73AD151AF), ref: 00007FF73AD2DE4E

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34CD6
strchr.VCRUNTIME140 ref: 00007FF73AD34CF4
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34D24
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD34D3F
strchr.VCRUNTIME140 ref: 00007FF73AD34D69
strrchr.VCRUNTIME140 ref: 00007FF73AD34D85
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34DAF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34DCA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34DEE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD34E06
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD34E45
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34E80
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD34F1C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34F41

Strings

Request has same path as previous transfer, xrefs: 00007FF73AD34F26
Uploading to a URL without a file name!, xrefs: 00007FF73AD34E6C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: e5f5215b6adfe5c2c5920e471789dfd3af1765d330e4d1fc8f87f2dd106cd71f
Instruction ID: a0ae6063383b52fd0a37252a66f7ed14e6d81b5eac7106469e28711080882f4f
Opcode Fuzzy Hash: e5f5215b6adfe5c2c5920e471789dfd3af1765d330e4d1fc8f87f2dd106cd71f
Instruction Fuzzy Hash: B291F36AF2CB82A2FB54AB25A411279A7E0FF55B81F8840B1DA4E037D8DF3DE445D710

Function 00007FF73AD0C140 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C1A3
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C21D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C241
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C290
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C2CA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C2DC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C2EF
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C30A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C320
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0C329

Strings

%s.%s.tmp, xrefs: 00007FF73AD0C1DA
%s, xrefs: 00007FF73AD0C2BB
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF73AD0C216
## Fatal libcurl error, xrefs: 00007FF73AD0C357

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 6009f20b34a05d1dd3bb9b4faa6d0a83b2fc5cf93fa4d208a15db822bffecfa8
Instruction ID: 85035b9dff75390864299cacbd88510cb03eda35f7f04d47e2840666b1150646
Opcode Fuzzy Hash: 6009f20b34a05d1dd3bb9b4faa6d0a83b2fc5cf93fa4d208a15db822bffecfa8
Instruction Fuzzy Hash: 0D51B36DA3D64265FE65FB21981A27AA3A0FF45BC4FC444B1CD4E07768EF3CE444A221

Function 00007FF73AD03AB0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73AD03AD8
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD03AE0

Strings

Unknown error, xrefs: 00007FF73AD03FD0
No error, xrefs: 00007FF73AD03F30
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF73AD03F3C
CRYPT_E_REVOKED, xrefs: 00007FF73AD03F12
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF73AD03FE9
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 3f59502599f9fe4b36af2ca8a19788e5d051e754496cbe36b5c47fe41c4b52c1
Instruction ID: c50ca52a80527d22ffa4a4b968b46f6b1e865dcb22f992f5159da82f26a44eb3
Opcode Fuzzy Hash: 3f59502599f9fe4b36af2ca8a19788e5d051e754496cbe36b5c47fe41c4b52c1
Instruction Fuzzy Hash: 2951D969A2CA82A5FB21EB20E4563B9B7A1FF44740FC040B5DA4D03A9DDF3CE504E721

Function 00007FF73AD281E0 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 communication to %s:%d, xrefs: 00007FF73AD282BF
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF73AD2844A
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF73AD2874D
SOCKS4: too long host name, xrefs: 00007FF73AD285A6
SOCKS4 connection to %s not supported, xrefs: 00007FF73AD284AC
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF73AD28713
Too long SOCKS proxy name, can't use!, xrefs: 00007FF73AD283A7
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF73AD284CB
[, xrefs: 00007FF73AD28774
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF73AD2834B
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF73AD282A6
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF73AD2863A
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF73AD286E6
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF73AD28681
SOCKS4%s request granted., xrefs: 00007FF73AD287A6
Failed to send SOCKS4 connect request., xrefs: 00007FF73AD2858D
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF73AD28784

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 26d194b8cc82fb13ed84a8c92531479d55a30ccc1a2d005a4b75650419007094
Instruction ID: 9eed888cc7f4e813958a39a639add6963cf782e40632b8717716d9886e0a9f2b
Opcode Fuzzy Hash: 26d194b8cc82fb13ed84a8c92531479d55a30ccc1a2d005a4b75650419007094
Instruction Fuzzy Hash: 78E1E2B9A1C685A6FB54AF25D04137DB790FB46B84F8481B5DA4E47799CF3CE040D720

Function 00007FF73ACF61F0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF634E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACF637C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACF638A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF63C4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF6415
memset.VCRUNTIME140 ref: 00007FF73ACF6243

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

Part of subcall function 00007FF73ACF7090: memcpy.VCRUNTIME140 ref: 00007FF73ACF7206

Part of subcall function 00007FF73ACF1E80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1FF1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF6582
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACF65AE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACF65BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF65F7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF664A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF6731
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF73ACF6749
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF73ACF6756

Strings

value, xrefs: 00007FF73ACF62B6, 00007FF73ACF64EE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: ee0779249a2292a91785ccc2791af818acd1a168ebfab1a7e7b88034a6c403b2
Instruction ID: bf3f34c60944c5b4070589a82f6906c584383818108feae99b09fd20ffd9f741
Opcode Fuzzy Hash: ee0779249a2292a91785ccc2791af818acd1a168ebfab1a7e7b88034a6c403b2
Instruction Fuzzy Hash: EDF11A66A19AC295FF10EB74D4513ADA760FB857A4F804271EAAD03AE9DF3CD084E310

Function 00007FF73AD2CF80 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF73AD2D267
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF73AD2D2D7
CertFreeCertificateContext.CRYPT32 ref: 00007FF73AD2D315
CertFreeCertificateContext.CRYPT32 ref: 00007FF73AD2D328

Strings

schannel: failed to retrieve remote cert context, xrefs: 00007FF73AD2D347
http/1.1, xrefs: 00007FF73AD2D0DB
schannel: failed to setup memory allocation, xrefs: 00007FF73AD2D031
ALPN, server did not agree to a protocol, xrefs: 00007FF73AD2D0F5
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF73AD2D0C8
schannel: failed to setup stream orientation, xrefs: 00007FF73AD2D050
schannel: failed to setup confidentiality, xrefs: 00007FF73AD2D012
schannel: failed to setup sequence detection, xrefs: 00007FF73AD2CFDA
schannel: failed to retrieve ALPN result, xrefs: 00007FF73AD2D09B
schannel: failed to setup replay detection, xrefs: 00007FF73AD2CFF6
schannel: failed to store credential handle, xrefs: 00007FF73AD2D1CC

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 0665b64c7b824c9d1b82f0c8097f4837004a7d675fd593bf18144da4f45bb90f
Instruction ID: d9e132f10097c24052e3847994973f1ab5e8666f6383299a9949d313ba04e589
Opcode Fuzzy Hash: 0665b64c7b824c9d1b82f0c8097f4837004a7d675fd593bf18144da4f45bb90f
Instruction Fuzzy Hash: 3FB12669A28A86A5FB60BB24D8123B9A391FF84B84FC441B1CD4D477ACCF3CD441E720

Function 00007FF73AD4EDA0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF73AD41ACF), ref: 00007FF73AD4EDCD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF73AD41ACF), ref: 00007FF73AD4EDEF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF73AD41ACF), ref: 00007FF73AD4EE00
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF73AD41ACF), ref: 00007FF73AD4EE2E

Strings

/../, xrefs: 00007FF73AD4EEFB
/.., xrefs: 00007FF73AD4EF32
../, xrefs: 00007FF73AD4EE99
/./, xrefs: 00007FF73AD4EEBC

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: a9dca8a485aeb8ad91a1b015f0defd015c32b6be5d2baf9d61c7b18537e8c8ad
Instruction ID: a54fc56f4f36347affe96b0dc034abefc9420244a29d2d717c9e7965819b767b
Opcode Fuzzy Hash: a9dca8a485aeb8ad91a1b015f0defd015c32b6be5d2baf9d61c7b18537e8c8ad
Instruction Fuzzy Hash: 97710C29E2CAE275FB226B1191012B9EF90EF55B90FC441F1CA9D06AD8DF3CE451E321

Function 00007FF73AD499A1 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD499D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4A04A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4A088

Strings

TRUE, xrefs: 00007FF73AD499C4
%s, xrefs: 00007FF73AD4A076
Signature: %s, xrefs: 00007FF73AD49E87
FALSE, xrefs: 00007FF73AD499BD
Signature, xrefs: 00007FF73AD49E6F
-----END CERTIFICATE-----, xrefs: 00007FF73AD49FD7
Cert, xrefs: 00007FF73AD4A05E
-----BEGIN CERTIFICATE-----, xrefs: 00007FF73AD49F2C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 0d4af557daef4db8173579bf327fd205810d04735fbb8b2f00107e5cb014bbe7
Instruction ID: eb579b5d66e11b227375ac6cb13b49fa5b5349180971b5af0ca40bb98e2b5f23
Opcode Fuzzy Hash: 0d4af557daef4db8173579bf327fd205810d04735fbb8b2f00107e5cb014bbe7
Instruction Fuzzy Hash: 4A71EA5AA1D7D165FB11EB2594022B9FBA0EF46748FD880F2CA8E0336DDE2DD045D720

Function 00007FF73AD43A10 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43AD2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43B0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43B1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43B51
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43B5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43C12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43C1B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43C26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43D11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43D1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43D25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43D9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43DA4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43DAF

Part of subcall function 00007FF73AD441A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD4608A,?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD441B0
Part of subcall function 00007FF73AD441A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD4608A,?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD441C1
Part of subcall function 00007FF73AD441A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD4608A,?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD441D3

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF73AD43DBC
WDigest, xrefs: 00007FF73AD43ABC, 00007FF73AD43BD4

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: d38bc17ba37a5e20258fb7a5043cfff22c46e0f17f0983cf5e3afbb73f545bf1
Instruction ID: 59872250b356fc5066a0b45c4a7711617e45b73c8e4cd09b99a0d01e04c69921
Opcode Fuzzy Hash: d38bc17ba37a5e20258fb7a5043cfff22c46e0f17f0983cf5e3afbb73f545bf1
Instruction Fuzzy Hash: D8B18F3AA18B56A6FB10AF25E8452ADB7A0FB48B94FC000B5DE8D47B68DF3CD544D710

Function 00007FF73AD40B3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40DA8
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40E00
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40E0D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F76

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: 3bdad931286a79f9bcd2262c4ad410947ef22487b7b4dddfe3a9759e3ab808ee
Instruction ID: 8f1b8712b7517539d64466966e1cc6f03c2ee87859905c6c3cd17ac49ff66539
Opcode Fuzzy Hash: 3bdad931286a79f9bcd2262c4ad410947ef22487b7b4dddfe3a9759e3ab808ee
Instruction Fuzzy Hash: BFA1051D92C6A265FF61AB21B012379ABD0DF02B84F8844F1DE9D076DDDE2CE449A330

Function 00007FF73AD2EE20 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF73AD2EE78

Strings

LIST, xrefs: 00007FF73AD2F05C
CAPABILITY, xrefs: 00007FF73AD2F240
SELECT, xrefs: 00007FF73AD2F12F
EXPUNGE, xrefs: 00007FF73AD2F177
UID, xrefs: 00007FF73AD2F1A7
LSUB, xrefs: 00007FF73AD2F18F
SEARCH, xrefs: 00007FF73AD2EF8C, 00007FF73AD2F15F
PREA, xrefs: 00007FF73AD2EEB4
NOOP, xrefs: 00007FF73AD2F1BF
STORE, xrefs: 00007FF73AD2F0AA
, xrefs: 00007FF73AD2EE81
Unexpected continuation response, xrefs: 00007FF73AD2F2BE
EXAMINE, xrefs: 00007FF73AD2F147
FETCH, xrefs: 00007FF73AD2EFEC, 00007FF73AD2F102

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 2f448b81eb3546c84f0e6d75ccd4d2bf6fd10b5e6fcdd86e07e5e76f45fbdbb4
Instruction ID: 67685cdf39676c0ebc0f1bc1654c097feaf04005d81ff75b8925712152c987ef
Opcode Fuzzy Hash: 2f448b81eb3546c84f0e6d75ccd4d2bf6fd10b5e6fcdd86e07e5e76f45fbdbb4
Instruction Fuzzy Hash: 3ED1F12DE2C25B61FB25BA20C5073B9E690EF05B98FC444F1DA1D5A58DEF6CE811E321

Function 00007FF73ACFCDB1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

Part of subcall function 00007FF73ACF7090: memcpy.VCRUNTIME140 ref: 00007FF73ACF7206

Part of subcall function 00007FF73ACF1E80: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1FF1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFCE60
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFCE8E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFCE9C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFCED6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFCF33
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFCFEC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFD01A
__std_exception_destroy.VCRUNTIME140 ref: 00007FF73ACFD028
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFD062
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFD0B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFD0FD

Strings

value, xrefs: 00007FF73ACFCDCF, 00007FF73ACFCF58

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 6cb73f9417d2065379fa999359f5016c908fdb7db6f6caf688fd1ccc3f1633f3
Instruction ID: f919d0bba8cc3b938f7c79f7e2809085d169388a7328296e715899dd762be0b3
Opcode Fuzzy Hash: 6cb73f9417d2065379fa999359f5016c908fdb7db6f6caf688fd1ccc3f1633f3
Instruction Fuzzy Hash: 1CA1B666A28A8655FF00EB68E4553ADA361FB417A4F800371EA6D03ADDDF7CD081E310

Function 00007FF73AD0BDB0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BE1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0BE3D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BE71
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BE92
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BEB5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BEC6
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BEE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BF9F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BFB4

Strings

none, xrefs: 00007FF73AD0BE32
ignoring failed cookie_init for %s, xrefs: 00007FF73AD0BEF2
Set-Cookie:, xrefs: 00007FF73AD0BF26

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: d5e54a99e0cd11fccfe99adac01e35e1acda1147c8233b058bd2287fa8caed3f
Instruction ID: d5ca118337bcf15cd0e448d81b249822f5376e9a48845e7f066f795f1a2dce41
Opcode Fuzzy Hash: d5e54a99e0cd11fccfe99adac01e35e1acda1147c8233b058bd2287fa8caed3f
Instruction Fuzzy Hash: B361F829A2C782A1FB55EB2194063B9AB94FF45B88FC440B4DE8D03799DF3DE441E721

Function 00007FF73AD042A0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73AD042C2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042CA
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042E9
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042F5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD04304
strrchr.VCRUNTIME140 ref: 00007FF73AD04355
strrchr.VCRUNTIME140 ref: 00007FF73AD04376
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0438F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0439A
GetLastError.KERNEL32 ref: 00007FF73AD043A3
SetLastError.KERNEL32 ref: 00007FF73AD043AF

Strings

Unknown error %d (%#x), xrefs: 00007FF73AD04337

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 8d7e7020460919c8f61814623c91a0f37eae63a37e14096fc4799b14e847d405
Instruction ID: aeef7b4473b3bbde218a6e89f89f26b83528c2bc4c7fb53003c22ecf891a5616
Opcode Fuzzy Hash: 8d7e7020460919c8f61814623c91a0f37eae63a37e14096fc4799b14e847d405
Instruction Fuzzy Hash: 3431A5A9A38742A1FE15BF21A41227DE691EF94F80F8850B5DE4E07B99DF3CE4019721

Function 00007FF73AD02010 Relevance: 19.7, APIs: 13, Instructions: 159COMMON

Download Yara Rule

APIs

?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD02052
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z.MSVCP140 ref: 00007FF73AD0206C
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ.MSVCP140 ref: 00007FF73AD0208D
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD020DF
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD020F4
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF73AD02113
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD02132
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF73AD0213B
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD021B8
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF73AD021C1
?width@ios_base@std@@QEAA_J_J@Z.MSVCP140 ref: 00007FF73AD021EC
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF73AD02209
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF73AD0221B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?rdbuf@?$basic_ios@?width@ios_base@std@@D@std@@@2@V?$basic_streambuf@$?getloc@ios_base@std@@?setstate@?$basic_ios@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@Vlocale@2@
String ID:
API String ID: 3119022203-0
Opcode ID: 7997aaaaf6a9cef25ea57c0221f9e44d5a9e3393a0893fdbf90fe20a1dedcddb
Instruction ID: 899a8aaf18d21bd898e03bb8e8ea6f8b95d8717ab38742b08d3c942c888575bb
Opcode Fuzzy Hash: 7997aaaaf6a9cef25ea57c0221f9e44d5a9e3393a0893fdbf90fe20a1dedcddb
Instruction Fuzzy Hash: 7061AB26A1AB41A1FF18EB15E5A123DA7A0EF85F95B448571DF2E037A8CF3CD054E311

Function 00007FF73AD3BAC0 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD3BB2B
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3BC55

Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD074F7
Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD07503

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3BC0F

Part of subcall function 00007FF73AD07430: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD07440

Strings

NEW_ENV, xrefs: 00007FF73AD3BC71
Unknown telnet option %s, xrefs: 00007FF73AD3BD4D
TTYPE, xrefs: 00007FF73AD3BBE5
Syntax error in telnet option: %s, xrefs: 00007FF73AD3BD66
USER,%s, xrefs: 00007FF73AD3BB50
BINARY, xrefs: 00007FF73AD3BCFE
XDISPLOC, xrefs: 00007FF73AD3BC2B
%hu%*[xX]%hu, xrefs: 00007FF73AD3BCD9
%127[^= ]%*[ =]%255s, xrefs: 00007FF73AD3BBD0

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: cc4282c4532705da13aa1f080671e8d77a3adb1e460cbf12d24aadad5463764a
Instruction ID: d11036c432d17f95300a343bcd5dffb5f5c6ceb20a0403e3b3b6b7914da80dc6
Opcode Fuzzy Hash: cc4282c4532705da13aa1f080671e8d77a3adb1e460cbf12d24aadad5463764a
Instruction Fuzzy Hash: 53717E7AA28AC2A4FB21EF24D4423E9A361FF84784FC40172DA8D4B29DDF39D545D760

Function 00007FF73AD3E343 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3E443

Strings

%I64d, xrefs: 00007FF73AD3E4D6
tsize, xrefs: 00007FF73AD3E552
blksize, xrefs: 00007FF73AD3E618
%s%c%s%c, xrefs: 00007FF73AD3E45A
TFTP buffer too small for options, xrefs: 00007FF73AD3E53F, 00007FF73AD3E688
timeout, xrefs: 00007FF73AD3E705
TFTP file name too long, xrefs: 00007FF73AD3E42F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: 99464ddc6018426e03093cd7b496b01c2234dd420febebe29c8f08f7ecf7ba4c
Instruction ID: e4dee705db580b1535e22647a369ab2292b0d995b569c6ba2da154ef92747863
Opcode Fuzzy Hash: 99464ddc6018426e03093cd7b496b01c2234dd420febebe29c8f08f7ecf7ba4c
Instruction Fuzzy Hash: E7D1BFA6A18A82A5FF11EF24D0413B9A7A1FB85B88FC481B2CA4D477C9DF3DD505D320

Function 00007FF73AD3EBC0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF73AD3ED33
sendto.WS2_32 ref: 00007FF73AD3EDEC
WSAGetLastError.WS2_32 ref: 00007FF73AD3EDFA

Strings

tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF73AD3EDA4
tftp_tx: internal error, event: %i, xrefs: 00007FF73AD3EC18
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF73AD3EC2D
Received ACK for block %d, expecting %d, xrefs: 00007FF73AD3ED85

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 0186047e93cd686184c325dd4522b1b8e4e4e6e58ae25586a71d20bcbbf36f2c
Instruction ID: 9ef47ba28f5ae3a2ce6f3066dd945cd2b864ced70c3bc4dbe850d3aba437c3b1
Opcode Fuzzy Hash: 0186047e93cd686184c325dd4522b1b8e4e4e6e58ae25586a71d20bcbbf36f2c
Instruction Fuzzy Hash: 9BB19E7AA28682D6FB61AF25D4412AD77A0FB88B88F844172DE4D4B79CDF39D401D720

Function 00007FF73AD3DFA0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF73AD3E118
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF73AD3E133
sendto.WS2_32 ref: 00007FF73AD3E19A
sendto.WS2_32 ref: 00007FF73AD3E251
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF73AD3E289

Strings

Received last DATA packet block %d again., xrefs: 00007FF73AD3E1E5
tftp_rx: internal error, xrefs: 00007FF73AD3DFEE
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF73AD3E291
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF73AD3E012

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 1ed2518f07949002f0cd12f2da94e08ae8fb468d53f05a6ce703aa36ab7b21fb
Instruction ID: 447cbf1eb403d6377b1e59fad0f8e37293d99b38e556fb6b5358559ef91adb19
Opcode Fuzzy Hash: 1ed2518f07949002f0cd12f2da94e08ae8fb468d53f05a6ce703aa36ab7b21fb
Instruction Fuzzy Hash: 6A91BF7AA28781D5EB51DF29D4413A97BA0FB88F88F848172DE4C4B798DF39D406D720

Function 00007FF73AD15B90 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15BCD
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15C4F
strchr.VCRUNTIME140 ref: 00007FF73AD15CCE
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD15CFC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15D1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15D2F

Strings

%25, xrefs: 00007FF73AD15C45
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF73AD15C59
No valid port number in connect to host string (%s), xrefs: 00007FF73AD15D5B
Invalid IPv6 address format, xrefs: 00007FF73AD15CB7

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: b80deec93e00715ce0e7d2eb68160d3c3720eaece003735fd971f9c055ba8dbe
Instruction ID: 2c84ec68be489e27d6d449b972ec4c150ccfaada2178cf8d6eb923ccfb005805
Opcode Fuzzy Hash: b80deec93e00715ce0e7d2eb68160d3c3720eaece003735fd971f9c055ba8dbe
Instruction Fuzzy Hash: 21513969E2CA8761FB95AF359462375E7D1DF41B94FC840B1CA4D0638CEE2CE486E320

Function 00007FF73AD0BBA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BBDE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0BBFE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BC30
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BC4D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BC6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0BC7C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD0BC9C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73AD05DF0), ref: 00007FF73AD0BD4F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73AD05DF0), ref: 00007FF73AD0BD65

Strings

none, xrefs: 00007FF73AD0BBF3
Set-Cookie:, xrefs: 00007FF73AD0BCD6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: d1ef4587f7dd34f7415cf20c2dfd9bb53afe93b95252a87030d17f339b04c656
Instruction ID: 14a335c202ac9da2523e3d0b25bfc150b168a3ec543c3d48e0c1358a6da953b5
Opcode Fuzzy Hash: d1ef4587f7dd34f7415cf20c2dfd9bb53afe93b95252a87030d17f339b04c656
Instruction Fuzzy Hash: 6B51E929A2C78261FB55EB2154122B9E7D0EF45B88FC844B4CD8E07799DF3CE445A331

Function 00007FF73AD16330 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17324
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1733A
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1734E
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17362
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17376
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1738A
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1739E
Part of subcall function 00007FF73AD17310: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD173B2

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD163B2

Part of subcall function 00007FF73AD402E0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD402F5
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4030F
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4032A
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40346
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40362
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4037A
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40392
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403AA
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403C2
Part of subcall function 00007FF73AD402E0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403DA
Part of subcall function 00007FF73AD402E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403F4

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD165B6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD165F9
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD1673E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD167BB

Strings

%s://%s, xrefs: 00007FF73AD163BF
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF73AD164FF
file, xrefs: 00007FF73AD166A3, 00007FF73AD1671C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 6772e96c6ccc77662937e5d3b728ad8c4f6999f8d66b77373c9182979c59d43f
Instruction ID: f9cc121e36beb6df672583ba0725e45f5635988b6d27132255ec306569d4f46b
Opcode Fuzzy Hash: 6772e96c6ccc77662937e5d3b728ad8c4f6999f8d66b77373c9182979c59d43f
Instruction Fuzzy Hash: 16C1B439B18A82A6FBA9AB35D5423F9A390FB41744F8440B5CB1D4768DEF3CE554E320

Function 00007FF73ACF1E80 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF2240: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2339
Part of subcall function 00007FF73ACF2240: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2378

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

Part of subcall function 00007FF73ACF4920: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF4966

Part of subcall function 00007FF73ACF6B50: memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6BE1

Part of subcall function 00007FF73ACF49A0: memcpy.VCRUNTIME140 ref: 00007FF73ACF49F3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1FF1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2092
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF20D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2124
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2163
__std_exception_copy.VCRUNTIME140 ref: 00007FF73ACF21B6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2207

Strings

parse_error, xrefs: 00007FF73ACF1EE1
parse error, xrefs: 00007FF73ACF1F0B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 79fa430c4efad6a2d76c2d148721811b644a3bc994eb7f1053710d3a8b8b6071
Instruction ID: 3831e0bc26950ccd3a71e7f1cfc040a9ff8849dcffb0c5603be446146f0170f4
Opcode Fuzzy Hash: 79fa430c4efad6a2d76c2d148721811b644a3bc994eb7f1053710d3a8b8b6071
Instruction Fuzzy Hash: F1B1C272E14B4695FB04EB64E4513AD7761EB447A8F904631EAAD03AE9DF7CD0C0E310

Function 00007FF73AD1FF00 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1FF91
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1FFD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD20074
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2008A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD200AB
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD200FA
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF73AD2014A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2017F

Strings

:%u, xrefs: 00007FF73AD2010E
Shuffling %i addresses, xrefs: 00007FF73AD1FF7A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: 7b8ed0ef4925efe9b6cc4f7d15d6d1533159af19d37a9f432c107f1578ee6360
Instruction ID: ba31bf69e7cca46be99adf3f2cbf82db128e736f5e28c63064d3c433075e7e05
Opcode Fuzzy Hash: 7b8ed0ef4925efe9b6cc4f7d15d6d1533159af19d37a9f432c107f1578ee6360
Instruction Fuzzy Hash: 6871F67AA28B86A1FB55AF11E5017B9B7A1FB48B94F844171CE4E07798EF3CD844D320

Function 00007FF73AD1DB70 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1DBEA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1DC05
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1DC82
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1DD0C

Strings

Maximum (%ld) redirects followed, xrefs: 00007FF73AD1DCD7
HEAD, xrefs: 00007FF73AD1DD77
Switch to %s, xrefs: 00007FF73AD1DD97
Switch from POST to GET, xrefs: 00007FF73AD1DDD6
GET, xrefs: 00007FF73AD1DD7E
Issue another request to this URL: '%s', xrefs: 00007FF73AD1DD17

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: 8ff86076a6a66d75232e8427d88cb20d6e1d215c91c9a4be1bcb8247b6697f5a
Instruction ID: f996b8696190adb5f898cfb18e2300c693576a3c7fbe0638a0a0522ce968c11b
Opcode Fuzzy Hash: 8ff86076a6a66d75232e8427d88cb20d6e1d215c91c9a4be1bcb8247b6697f5a
Instruction Fuzzy Hash: AA71D769A1878390F7A0AF34D4423BDA7A1EB45B44F9809B1DE8D476ADCF3DD441E320

Function 00007FF73AD12D10 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12D8D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DBE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12DF7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E1A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E42
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E7C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12E90
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12EDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12EEC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD13395), ref: 00007FF73AD12F15

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cebf4daa39e9ef3070e5533762b0c45d7f12dae150eb8221eecad598c6e96e4a
Instruction ID: ad44c9f0fdd2d947db1c788974b0d49ea83d25e2ca0c04158c5f81776c51e84d
Opcode Fuzzy Hash: cebf4daa39e9ef3070e5533762b0c45d7f12dae150eb8221eecad598c6e96e4a
Instruction Fuzzy Hash: AB512E39968B8291FB44EF31D4522FDA7A0FF85F84F884071DE5E4B659CE3990859330

Function 00007FF73AD4D420 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4D8EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4D943

Strings

XOAUTH2, xrefs: 00007FF73AD4D7A5
LOGIN, xrefs: 00007FF73AD4D863
GSSAPI, xrefs: 00007FF73AD4D5B6
DIGEST-MD5, xrefs: 00007FF73AD4D653
EXTERNAL, xrefs: 00007FF73AD4D53B
CRAM-MD5, xrefs: 00007FF73AD4D672
NTLM, xrefs: 00007FF73AD4D6A9
PLAIN, xrefs: 00007FF73AD4D7FA
OAUTHBEARER, xrefs: 00007FF73AD4D732

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 3aee149c2699db90a2b432282fa80b87111d201466db1c3471af34fe7a16c3ae
Instruction ID: 842d4a9fff7de4f4a5f9aab62823a13cb771ba50050c4734a899ad6ba4c7f55c
Opcode Fuzzy Hash: 3aee149c2699db90a2b432282fa80b87111d201466db1c3471af34fe7a16c3ae
Instruction Fuzzy Hash: C8D17C7A919B9295FB60AF10E4013A9B7A0FB84B58F8502B6DE8D0779CDF3CD445D720

Function 00007FF73AD2F450 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD2DE20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF73AD151AF), ref: 00007FF73AD2DE4E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2F6EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2F6F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2F753
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2F75D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2F76A

Strings

MAILINDEX, xrefs: 00007FF73AD2F627
UIDVALIDITY, xrefs: 00007FF73AD2F5A5
PARTIAL, xrefs: 00007FF73AD2F6A6
UID, xrefs: 00007FF73AD2F5E6
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF73AD2F458
SECTION, xrefs: 00007FF73AD2F668

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: aaee8b4824d9325fed52f29a49084a14fde8caec5c456af2adca197dc23dfbc8
Instruction ID: fab523a7804281b1325647220dff25400f202a6e904e55d7ab29e9632d81967b
Opcode Fuzzy Hash: aaee8b4824d9325fed52f29a49084a14fde8caec5c456af2adca197dc23dfbc8
Instruction Fuzzy Hash: B3A1EB1A92878AA5FB50EF21D5023B8A790FF48788F8404B5EA5E4B69DDF3DD491D320

Function 00007FF73AD40F91 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40F0F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4100D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD41076
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4108E

Part of subcall function 00007FF73AD3FFE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3FFF0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD410B6
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD410CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD410F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4113F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD41154

Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD4129C
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412A6
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412B0
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412BA
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412C4
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412CE
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412D8
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412E2
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412EC
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD412F6
Part of subcall function 00007FF73AD41290: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD402C2,?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD41300

Strings

,, xrefs: 00007FF73AD40FD4
:, xrefs: 00007FF73AD40FB7

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 434c8d58af6e5700761e0d470ef93e0cf25a3180c57d24ab253308cc3fd4d694
Instruction ID: 6f8f0dc017b6d7208371ed11ebf6210588c06f27a48992b9bd1c62a665d071fa
Opcode Fuzzy Hash: 434c8d58af6e5700761e0d470ef93e0cf25a3180c57d24ab253308cc3fd4d694
Instruction Fuzzy Hash: 4551B616E2CB9653F721EB35A5122B9A350FF55B84F8492B0DF8D0265AEF2CF1C5A310

Function 00007FF73AD402E0 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD402F5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4030F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4032A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40346
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40362
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD4037A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD40392
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403AA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403C2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16355,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD403F4

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: 884f2448193a9adb7b170b09a06f4957f657c1d6519fdb0ff3282332b281cfaf
Instruction ID: 8440366a5b619f868f282f5fe460e7d714d1ed9f2c99ac0c672200c98a5905a9
Opcode Fuzzy Hash: 884f2448193a9adb7b170b09a06f4957f657c1d6519fdb0ff3282332b281cfaf
Instruction Fuzzy Hash: 02318029A26F02A6FF59EB91F05623867A0FF44B04B8845B5CA0D42758EF3CE564E360

Function 00007FF73AD13A00 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF73AD13A38
strchr.VCRUNTIME140 ref: 00007FF73AD13A5F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13B14
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13B3A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13B5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13B6C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13B75
memcpy.VCRUNTIME140 ref: 00007FF73AD13B93
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13BA7
memcpy.VCRUNTIME140 ref: 00007FF73AD13BC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13BD9
memcpy.VCRUNTIME140 ref: 00007FF73AD13BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD13C06

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 7dfc5812d5a88c4bde41487b62d5c1665578af98dddacaff8cc22133f62a1adc
Instruction ID: ead35c14e0a8919a5b8864542bb6875684933815afca550f3f1a8455b03b6ba5
Opcode Fuzzy Hash: 7dfc5812d5a88c4bde41487b62d5c1665578af98dddacaff8cc22133f62a1adc
Instruction Fuzzy Hash: 6D519F2972DB85A5FEE4AF25E505279E291FB44B80F8840B0DE8D47B48EF3CE405D320

Function 00007FF73AD15920 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15964
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15978
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1599C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD159A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD159D2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD159DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15A10
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD15A1D

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF73AD15AA9

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 2ffbd0a82cf340faf792485215ff3584dbde2df33107f45736162e578dc8f89a
Instruction ID: 52a1e4ca43a6da28525e008637d901c56601d028da3c80ef55f12da20679ed1a
Opcode Fuzzy Hash: 2ffbd0a82cf340faf792485215ff3584dbde2df33107f45736162e578dc8f89a
Instruction Fuzzy Hash: D2712729A18B82A6FBA4AB35D496379A7A0FB44744F8400B1CB9D47398DF3DF554E320

Function 00007FF73AD36330 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

LIST, xrefs: 00007FF73AD36432
Couldn't set desired mode, xrefs: 00007FF73AD3634E
Got a %03d response code instead of the assumed 200, xrefs: 00007FF73AD36370
NLST, xrefs: 00007FF73AD3642B
%s%s%s, xrefs: 00007FF73AD36455

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 84c53d472fdf5f393aea367dc30ba8a194e8fa93cfe1338e983f53e97e9bdbfd
Instruction ID: 6ea8957f759431fecb557a89706e32cc87fb670f770c32715710136891d35b1f
Opcode Fuzzy Hash: 84c53d472fdf5f393aea367dc30ba8a194e8fa93cfe1338e983f53e97e9bdbfd
Instruction Fuzzy Hash: B841F529F2C652B6FB94AB15E4421BAE360EF41B80FC440B5DA4D0769DEF7DE448E320

Function 00007FF73AD4936E Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD493A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Strings

TRUE, xrefs: 00007FF73AD49390
Expire Date: %s, xrefs: 00007FF73AD49887
FALSE, xrefs: 00007FF73AD49397
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdup
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$FALSE$Public Key Algorithm$TRUE
API String ID: 2653869212-571364039
Opcode ID: 2721684524e036b017217f472e7fc305398b3faf96d1030816dad9b2c1d64f58
Instruction ID: 7dbf32de9880f05f5ac65ef1716c727154cb4bb42a37809fcb26795976b55740
Opcode Fuzzy Hash: 2721684524e036b017217f472e7fc305398b3faf96d1030816dad9b2c1d64f58
Instruction Fuzzy Hash: 3441D369B1DB9264FB21AB66A4461F9A760FB05784FC404B2CE4E0775EDF3CE144E320

Function 00007FF73AD043E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73AD043FC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04404
FormatMessageA.KERNEL32 ref: 00007FF73AD0443E
strchr.VCRUNTIME140 ref: 00007FF73AD04453
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0449C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD044A6
GetLastError.KERNEL32 ref: 00007FF73AD044AE
SetLastError.KERNEL32 ref: 00007FF73AD044BA

Strings

Unknown error %u (0x%08X), xrefs: 00007FF73AD0448A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: e96e33a1e5f4e0560df3159e1368d2a383f50685c12c34e08158cc9b204e6fb3
Instruction ID: 7512898ad7231ae1416156f040ee28d34a02262c8625fb31e80adcbf6f8a0c63
Opcode Fuzzy Hash: e96e33a1e5f4e0560df3159e1368d2a383f50685c12c34e08158cc9b204e6fb3
Instruction Fuzzy Hash: 8621A7AAA1C781A2FB11AF21A40562AFAD1FF94BD0F884074DE4E03B5DCF7CD4419722

Function 00007FF73AD03BE2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35
SEC_E_BAD_BINDINGS, xrefs: 00007FF73AD03BE2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 144d15412fd5dbb420f3337d8fae68674c69010fd051b7522233ba084ab607b8
Instruction ID: 946d058e02527d0f267573ac1fd6e880fbef81c38cb004a85d5f11be014c067f
Opcode Fuzzy Hash: 144d15412fd5dbb420f3337d8fae68674c69010fd051b7522233ba084ab607b8
Instruction Fuzzy Hash: 99318766A1C6C1A5FA61EB20E4163AEB7A1FB84740FC00075DA8D02A99CF3CD544D721

Function 00007FF73AD03C12 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_CANNOT_PACK, xrefs: 00007FF73AD03C12
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 8c50a8c693a37bfe4934866722795b9350daec6cf5273cf935bf0cc0efeb17b6
Instruction ID: 0251c3b805355d27dfc2760c4b2df38f25215c7c8ceb56e0d4dfdd94f3211f3c
Opcode Fuzzy Hash: 8c50a8c693a37bfe4934866722795b9350daec6cf5273cf935bf0cc0efeb17b6
Instruction Fuzzy Hash: 9F3185AAA1C6C1A5FA61EB20E4163AEB7A1FB84740FC00076DA8D02A99CF3CD544D721

Function 00007FF73AD03C06 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_CANNOT_INSTALL, xrefs: 00007FF73AD03C06
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: d0b436e43d75bf821002b78e2faeb4285766b6ee182af6f66c40bbd49654f42c
Instruction ID: 35ff4bbbb3fc66eec3432a62228c8e1047b3c83b892739dfc37edd8b4f275b63
Opcode Fuzzy Hash: d0b436e43d75bf821002b78e2faeb4285766b6ee182af6f66c40bbd49654f42c
Instruction Fuzzy Hash: 253185AAA1C6C1A5FA61EB20E4163AEB7A1FB84740FC00076DA8D02A99CF3CD544D721

Function 00007FF73AD03BFA Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF73AD03BFA
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 24cfbc4bbd55e04eb686c9679fb5b47b238d752fd86eb04b9a038fb2f70f3349
Instruction ID: abc0bb84eff25deb215737dbffb8bdbbfe9b3df9561d307974d2bc618f8e7ff7
Opcode Fuzzy Hash: 24cfbc4bbd55e04eb686c9679fb5b47b238d752fd86eb04b9a038fb2f70f3349
Instruction Fuzzy Hash: 163185AAA1C6C1A5FA61EB20E4163AEB7A1FB84740FC00076DA8D02A99CF3CD544D721

Function 00007FF73AD03C2A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_CERT_UNKNOWN, xrefs: 00007FF73AD03C2A
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 67f281f48c0713fb8a407eac5047f533afa47a277d73dc2073de8ec8e3a93a9e
Instruction ID: 2d54381806a6f042775d48466855fc2c0affc2a6b7cd9d263b40d6debf501b7c
Opcode Fuzzy Hash: 67f281f48c0713fb8a407eac5047f533afa47a277d73dc2073de8ec8e3a93a9e
Instruction Fuzzy Hash: 363185AAA1C6C1A5FA61EB20E4163AEB7A1FB84740FC00176DA8D02A99CF3CD544D721

Function 00007FF73AD03C1E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35
SEC_E_CERT_EXPIRED, xrefs: 00007FF73AD03C1E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: b28015ecdf1afb8791396c1b23dbd8ec432626920cf3f296fe1b83e61fb16438
Instruction ID: cda2475fcbbab67dae8b987352daaec0a949adc5459a4fb7498f7c58155d92ed
Opcode Fuzzy Hash: b28015ecdf1afb8791396c1b23dbd8ec432626920cf3f296fe1b83e61fb16438
Instruction Fuzzy Hash: 033185AAA1D6C1A5FA61EB20E4163AEB7A1FB84740FC00076DA8D02A99CF3CD544D721

Function 00007FF73AD03B2E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF73AD03B89
strchr.VCRUNTIME140 ref: 00007FF73AD03BB0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0404F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD0405A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD04065
GetLastError.KERNEL32 ref: 00007FF73AD0406E
SetLastError.KERNEL32 ref: 00007FF73AD0407A

Strings

SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF73AD03B2E
%s - %s, xrefs: 00007FF73AD04039
%s (0x%08X), xrefs: 00007FF73AD03B35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: ee7f2f00767fdccae19966825e0293ce2e1ab8c7bb055c1d4858e65ed6542b9d
Instruction ID: 5d8161ecb75409e91779eda85baca7d1fa13b780f6a8da87ea4aa578f14200e6
Opcode Fuzzy Hash: ee7f2f00767fdccae19966825e0293ce2e1ab8c7bb055c1d4858e65ed6542b9d
Instruction Fuzzy Hash: 963194AAA1C7C1A5FB61EB20E4123AEB7A1FB84740F800076DA8D02A99DF3CD544D721

Function 00007FF73AD014D0 Relevance: 15.1, APIs: 10, Instructions: 128COMMON

Download Yara Rule

APIs

ConvertSidToStringSidA.ADVAPI32 ref: 00007FF73AD01517
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01599
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD015AC
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD015C2
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01601
LocalFree.KERNEL32(?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01629

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno$ConvertFreeLocalString_invalid_parameter_noinfomemcpy
String ID:
API String ID: 3026804155-0
Opcode ID: 5067fa0b729cc3a821af6192570fd25bca47b8d198587100e5ebe5b114bb222c
Instruction ID: 6ffc53bd5d069bce8879b94014726a5105933fc8a3f8e9e30b2d51f339fb2d4a
Opcode Fuzzy Hash: 5067fa0b729cc3a821af6192570fd25bca47b8d198587100e5ebe5b114bb222c
Instruction Fuzzy Hash: DE51C169E29A42A2FA10FB15D94627DA3A0EF44BD0FC441B5EB1E07799CF3CE441A721

Function 00007FF73AD4FFE0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD500AA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD500F8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD5015B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD50299

Part of subcall function 00007FF73AD44040: strchr.VCRUNTIME140(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD44086
Part of subcall function 00007FF73AD44040: strchr.VCRUNTIME140(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD44096
Part of subcall function 00007FF73AD44040: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD440C0
Part of subcall function 00007FF73AD44040: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD440F5
Part of subcall function 00007FF73AD44040: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4411A
Part of subcall function 00007FF73AD44040: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4413C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD50324

Strings

Kerberos, xrefs: 00007FF73AD50073, 00007FF73AD50115
GSSAPI, xrefs: 00007FF73AD4FFE3
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF73AD501A3

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 06cf65cb48fcc62a73f4519b18ab06edea668728f2c237f4d831486e50d66c64
Instruction ID: 89f3be29196233aa19a2b2dfcef597ef306164317708fb21454bf40531b2e91e
Opcode Fuzzy Hash: 06cf65cb48fcc62a73f4519b18ab06edea668728f2c237f4d831486e50d66c64
Instruction Fuzzy Hash: DDA1CE76A28B459AFB10EF65E4422ADB7A5FB48B88F800075DE4C43B68DF38E405D750

Function 00007FF73ACF8179 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF73ACF8517
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF73ACF86C7

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 2730ef35087c3055d687314332988b2300484bbdf2223a9d955a81849e3a20ae
Instruction ID: f00ae467dc429c9415c8cd3c4a0cd7fd4d157d1e50b57f56faf278e529eff126
Opcode Fuzzy Hash: 2730ef35087c3055d687314332988b2300484bbdf2223a9d955a81849e3a20ae
Instruction Fuzzy Hash: 4BB1C66A90AA42E5FB249F28D46123CB771FB15B48FE44571C64E032D8DF3CE9A5E360

Function 00007FF73AD0AF55 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0AF9A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0AFBA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B00B

Part of subcall function 00007FF73AD0C820: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0C826

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: dc84e155dc241e09814003e24814fc38a355019b45f7879705a367772fe99cf2
Instruction ID: e18bd953c0ba7cc648be98bb85e50e47192c62c3606a56879c6021e5433767c2
Opcode Fuzzy Hash: dc84e155dc241e09814003e24814fc38a355019b45f7879705a367772fe99cf2
Instruction Fuzzy Hash: 6E91B569E2D786A5FF71E721904637DE7E0EF05748F8440B5DA8E026A9DF2CE444E322

Function 00007FF73AD0B063 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B066
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
__Host-, xrefs: 00007FF73AD0B09D
__Secure-, xrefs: 00007FF73AD0B080
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 6a214aede563abdf51c806016b737c4014c2b8ef0741d02c7797d6f2985e48e9
Instruction ID: c5b5740304ef8cd202a0736826ccf47d723e75cc9789d46c97fd31fb8fb3214c
Opcode Fuzzy Hash: 6a214aede563abdf51c806016b737c4014c2b8ef0741d02c7797d6f2985e48e9
Instruction Fuzzy Hash: A5719769E2C786A5FF71EB21D04637DE7A0EF05748F8440B5DA8D026A9DF2CE444E322

Function 00007FF73AD15D90 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15E6C
strchr.VCRUNTIME140 ref: 00007FF73AD15EA0
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD15EC0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD15F44

Strings

Connecting to hostname: %s, xrefs: 00007FF73AD15F1B
Connecting to port: %d, xrefs: 00007FF73AD15F60
anonymous, xrefs: 00007FF73AD15DA0
%s%s%s, xrefs: 00007FF73AD15E2F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: 7f6fdc57b1334bcb494de6a3b9f7668b16a16b3993ad0d53ae28ca23d5eb346a
Instruction ID: da5961af4859e863a8af6b49fd5bcc70596f3ea18b2365455fb0ad53a59debe7
Opcode Fuzzy Hash: 7f6fdc57b1334bcb494de6a3b9f7668b16a16b3993ad0d53ae28ca23d5eb346a
Instruction Fuzzy Hash: 1551E46AA18BC2A4FBB1AB25A4017A9A790FB41B98FC44175DE9C07B98CF3CE145D310

Function 00007FF73AD32440 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD324FF
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD32544
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD32600

Strings

VRFY %s%s%s%s, xrefs: 00007FF73AD325CE
%s %s%s, xrefs: 00007FF73AD324C9
HELP, xrefs: 00007FF73AD32635
SMTPUTF8, xrefs: 00007FF73AD324AD, 00007FF73AD325B5
EXPN, xrefs: 00007FF73AD32487

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: 566584c11fa187fd2401cab74c7bb7e6a8bdb988c7b5281e1456010e8ba665c5
Instruction ID: a0265a4bea8e1f972cd2a5c3f1c40c5e84bae765f68f81975cab93ddab5b8d23
Opcode Fuzzy Hash: 566584c11fa187fd2401cab74c7bb7e6a8bdb988c7b5281e1456010e8ba665c5
Instruction Fuzzy Hash: 9E51016AE2CB81A1FB15EB11E4117B9B7A0EBA6B80FC441B1DA5D037D9DF2DE940D310

Function 00007FF73AD05E07 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

ALL, xrefs: 00007FF73AD05E13
SESS, xrefs: 00007FF73AD05E53
FLUSH, xrefs: 00007FF73AD05E93
Set-Cookie:, xrefs: 00007FF73AD05F28
RELOAD, xrefs: 00007FF73AD05EB5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: a650a8fe3cf8e73c1d907564eaf4a8554080a90537af4c2029c0f7119efed06d
Instruction ID: 03d2ecb49c33392aedf172221efb115ffeea15363d030b073fb189f906f51e5f
Opcode Fuzzy Hash: a650a8fe3cf8e73c1d907564eaf4a8554080a90537af4c2029c0f7119efed06d
Instruction Fuzzy Hash: FA41C329B3C60261FA54FB2595532B9E391EF84BC0FC840B1CD1E4769ADF6CE441B361

Function 00007FF73AD38111 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF73AD38123
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3813E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3816A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3818F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3826C

Strings

Wildcard - Parsing started, xrefs: 00007FF73AD38207

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: bd563e7eaca9d91348b2c8c617b805c8482c6179d8a3fccd36fc338857a39012
Instruction ID: e87030515edbecb303a50739bb26ad73e2271b4d8d3ba5894cb053973382698a
Opcode Fuzzy Hash: bd563e7eaca9d91348b2c8c617b805c8482c6179d8a3fccd36fc338857a39012
Instruction Fuzzy Hash: 01517A3AE18F42A1FB14EB51E4451BCB7A1FB84B40F8984B5CA4D0B398EF39E444E320

Function 00007FF73AD0B440 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B46D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B497
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4A1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4AB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4B5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4C9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4D3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4DD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B4E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF73AD12E59,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD0B501

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 98fb8155c5919fcb2b8347195ab805f8991de630cad49c66134ebc09135a7350
Instruction ID: a7763268a9bf4e5ee05a70ad6f555de1cb458502db7ced136276d6c2259fae8f
Opcode Fuzzy Hash: 98fb8155c5919fcb2b8347195ab805f8991de630cad49c66134ebc09135a7350
Instruction Fuzzy Hash: 2921E93AA68F4192EB10AF22E855139A770FB89F95F845071DE9E43728CF3CD8899710

Function 00007FF73AD4C2A0 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73AD4C348
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4C359
memcpy.VCRUNTIME140 ref: 00007FF73AD4C499
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4C4F4
memcpy.VCRUNTIME140 ref: 00007FF73AD4C511

Strings

response reading failed, xrefs: 00007FF73AD4C531
8, xrefs: 00007FF73AD4C543
Excessive server response line length received, %zd bytes. Stripping, xrefs: 00007FF73AD4C471
cached response data too big to handle, xrefs: 00007FF73AD4C591

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: 8$Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3313557100-1003742340
Opcode ID: 4e359e170ab32e800d0ccb3f5392e78954b0e8754758fc0311aa994245ec9f95
Instruction ID: 0c59c31a4e7ab08e97a2f008073f17910c282b98ad51abfbf09aca75faf077dd
Opcode Fuzzy Hash: 4e359e170ab32e800d0ccb3f5392e78954b0e8754758fc0311aa994245ec9f95
Instruction Fuzzy Hash: 5281D66A628B91A2FB54AB26D0453BEA7A0FB457C0F8444B2DF4E47749DF3CE490D360

Function 00007FF73AD48B76 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48BAF
memcpy.VCRUNTIME140 ref: 00007FF73AD48BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: a13194ffae0eb89d6ad2ea92297a342947c16202ee97818982dd7a7039e8ed22
Instruction ID: b53213c8d062c6ce0d3f8a5825f4f70404dc331bb8e49c24dc4ee5f7517c4358
Opcode Fuzzy Hash: a13194ffae0eb89d6ad2ea92297a342947c16202ee97818982dd7a7039e8ed22
Instruction Fuzzy Hash: BB613659A2EBA265FB18A72180162BDA791EF127C4F8845F5CE4F0779DDF3CA044A320

Function 00007FF73AD42C20 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF73AD26288), ref: 00007FF73AD42DB0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF73AD26288), ref: 00007FF73AD42DE7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF73AD26288), ref: 00007FF73AD42E0E

Strings

Proxy-, xrefs: 00007FF73AD42DBE, 00007FF73AD42E6A
HTTP, xrefs: 00007FF73AD42C36
NTLM, xrefs: 00007FF73AD42C26
%sAuthorization: NTLM %s, xrefs: 00007FF73AD42DC8, 00007FF73AD42E74

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: d95155901938bb7511f70225ec7af3e83e3a8d69d7789567dbbbfd7e2de18010
Instruction ID: 06d2ff9e35264de2df3ce0ae2e154a7f9cff6cfc541cfaa3c4f6321fb4be30cc
Opcode Fuzzy Hash: d95155901938bb7511f70225ec7af3e83e3a8d69d7789567dbbbfd7e2de18010
Instruction Fuzzy Hash: D0618D3AA18F8191FB64EF05E8493AAB7A8FB44B84F8040B6DA8D47768DF3CD545D710

Function 00007FF73AD3832E Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF73AD383B7

Part of subcall function 00007FF73AD38960: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD38996
Part of subcall function 00007FF73AD38960: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD389EB

Strings

Can't get the size of file., xrefs: 00007FF73AD38599
Accept-ranges: bytes, xrefs: 00007FF73AD3844E
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF73AD3851B
failed to resume file:// transfer, xrefs: 00007FF73AD38716
Content-Length: %I64d, xrefs: 00007FF73AD38413

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: c609bc26b9459c105d47de048388bc637963765226ad3c1a17c91b0aba2a2ea8
Instruction ID: 74edd9c46ab4ca137fde3c81ef8c8d773d0157a688dee502a885145c3acdc1c3
Opcode Fuzzy Hash: c609bc26b9459c105d47de048388bc637963765226ad3c1a17c91b0aba2a2ea8
Instruction Fuzzy Hash: E6B1B47AE28682A5FB60AB25D4023BEA391FB847C4F944071DE4D4779DEF3DE401A760

Function 00007FF73AD4D9C0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4DA58
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4DAB4
strchr.VCRUNTIME140 ref: 00007FF73AD4DC9C
strchr.VCRUNTIME140 ref: 00007FF73AD4DD0A

Strings

<DIR>, xrefs: 00007FF73AD4DBE0
0123456789-, xrefs: 00007FF73AD4DD03
APM0123456789:, xrefs: 00007FF73AD4DC95

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 3737657a1a96ca69f642d9da4703c11575f635bf74fd63f22841ddb1ceb300bd
Instruction ID: 3e729a2c804adc907bd708fcfccef5cf6055c7753a54b29b09938422494fc11f
Opcode Fuzzy Hash: 3737657a1a96ca69f642d9da4703c11575f635bf74fd63f22841ddb1ceb300bd
Instruction Fuzzy Hash: 6AB1833AA18B51AAFB24AF25D052379A7A0FB44B48F5541B5CB8E0739CDF7CE440E760

Function 00007FF73AD1F110 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1F16A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1F26E
WSAIoctl.WS2_32 ref: 00007FF73AD1F3C7
setsockopt.WS2_32 ref: 00007FF73AD1F3EF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1F4E6

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF73AD1F280
We are completely uploaded and fine, xrefs: 00007FF73AD1F45A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: 35d748f3144527b4fac2f6cb60dbb7eda79c5931ef00ef931f4b0b9e98d19bba
Instruction ID: fd100545d59ed3f4f8822dc55b73e8a0a2ff0aa2d0cadf355b9c9f7be966fc77
Opcode Fuzzy Hash: 35d748f3144527b4fac2f6cb60dbb7eda79c5931ef00ef931f4b0b9e98d19bba
Instruction Fuzzy Hash: 3EB18436A18BC291FBA5AF34D0053F96390EB48B58F884176CE4D4A79EDF3C9495D320

Function 00007FF73AD3FC90 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD3FCD7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3FD3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3FE6F

Part of subcall function 00007FF73AD2DE20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF73AD151AF), ref: 00007FF73AD2DE4E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3FD6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3FEAD

Strings

Failed sending Gopher request, xrefs: 00007FF73AD3FE75
%s?%s, xrefs: 00007FF73AD3FCC9

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 820173812c7a69f04b9f641ad3ecca06867c4ba109d629a424f597f913a138a2
Instruction ID: ad342637a336af45aba368b975a3146064e80eb2f5b4638f21a972ab1a63b318
Opcode Fuzzy Hash: 820173812c7a69f04b9f641ad3ecca06867c4ba109d629a424f597f913a138a2
Instruction Fuzzy Hash: 3851D829E28B8691F750AB29A4021BAE390FF49BE4F840271DE6D4B7EDDF3CD4419710

Function 00007FF73AD38960 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD38996
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD389EB
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD38A5C
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD38A69
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF73AD38B7B

Strings

Can't open %s for writing, xrefs: 00007FF73AD389FB
Can't get the size of %s, xrefs: 00007FF73AD38A72

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 5ca74dbb9ed0fb52d929849601a3ce6bbc36ca070a3e16c07a3dd9386ec84f54
Instruction ID: e2e07fd3a3812bd9acd279c39d2665606c293cc4197b84b4321ac3d9db238e50
Opcode Fuzzy Hash: 5ca74dbb9ed0fb52d929849601a3ce6bbc36ca070a3e16c07a3dd9386ec84f54
Instruction Fuzzy Hash: FB51E66AB28A82A1FF18AB25D4123BDA391FF84BD0F844075DA4E477D9DF3DE445A310

Function 00007FF73AD40BD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF73AD40BE0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 77bd54700a3c8aabd0dd977745ab72a3ce850616908835048469eb695edd24aa
Instruction ID: 940b9cf4dd1d61ec53d1a395f393a68657997e4c33405c88db0dd2899cd6343b
Opcode Fuzzy Hash: 77bd54700a3c8aabd0dd977745ab72a3ce850616908835048469eb695edd24aa
Instruction Fuzzy Hash: C051181D92D7A265FB61AB21B011379AB91DF42B80F8801F1DE9E077C9DE2DF449E320

Function 00007FF73AD40BA6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40BB3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 971357583ab86598d8bbbadc777bbb4f2e558671ca3c2c86ee842f367469145c
Instruction ID: 8faca5c59e7a4adfc44c309f33c2f2cbae3e6e733c518da004126c8c76890ba8
Opcode Fuzzy Hash: 971357583ab86598d8bbbadc777bbb4f2e558671ca3c2c86ee842f367469145c
Instruction Fuzzy Hash: AE41F51D92D7A265FB62AB217012379AB91DF46B50F8801F1CEDE077C9DE2DF449A320

Function 00007FF73AD3C440 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF73AD3C4AC
htons.WS2_32 ref: 00007FF73AD3C4C2
send.WS2_32 ref: 00007FF73AD3C568
WSAGetLastError.WS2_32 ref: 00007FF73AD3C57C
send.WS2_32 ref: 00007FF73AD3C5BE
WSAGetLastError.WS2_32 ref: 00007FF73AD3C5C8

Strings

Sending data failed (%d), xrefs: 00007FF73AD3C582, 00007FF73AD3C5CE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: 132091cfaa1fa980ce3cd912a0750d1ac0ca4a0013ac6898047b3f892f610244
Instruction ID: 36403780318e3e1eab63dd0e2bc17447c9832950bd60253669ff588c83ec7fce
Opcode Fuzzy Hash: 132091cfaa1fa980ce3cd912a0750d1ac0ca4a0013ac6898047b3f892f610244
Instruction Fuzzy Hash: 3741D23BB18A85A1FB00AF35D4156A8B720F750F89F844972DB9903798DF7DE00AD320

Function 00007FF73AD4945E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD49468
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 885e964eaa3e5b5c8ad5449d8412af57d3f4c941fef73c9629f6b4fff520151f
Instruction ID: 10497043addbbcf91921006c7ddb7f33e95183549c4ab44dea9f7d5e5e3b5905
Opcode Fuzzy Hash: 885e964eaa3e5b5c8ad5449d8412af57d3f4c941fef73c9629f6b4fff520151f
Instruction Fuzzy Hash: 1E31B16DA1DB9265FB10AB6694020F9A7A1FF45784FC448B5CE4E077AEDF3CE004A320

Function 00007FF73ACF1A70 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73ACF1C3A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1CFD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1D4B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1D8B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF1DDA

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: e342187c8cd1f161ef373432542ac71534a2e68551c2f7cf2310fbd6c26b5289
Instruction ID: 1d84492cd4f0709832207e92c3b0e6592cee0c2697f44f64549767f13b5cd3f1
Opcode Fuzzy Hash: e342187c8cd1f161ef373432542ac71534a2e68551c2f7cf2310fbd6c26b5289
Instruction Fuzzy Hash: 11B1026AB19B4295FB00EB64E4113ADA361EB447A8F804670DF6C17BDADF3CE095E350

Function 00007FF73AD489FD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
GMT, xrefs: 00007FF73AD48AAE
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD48B21
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 35fd25f4752ff7cd04d77df3f9f99e62ef18a235aca9cebc2ac59021716ab536
Instruction ID: e9019e2673f387eb4ed6e51f55d970520a3fd06d8ebea2f1b7fd6d4b0ebd98d4
Opcode Fuzzy Hash: 35fd25f4752ff7cd04d77df3f9f99e62ef18a235aca9cebc2ac59021716ab536
Instruction Fuzzy Hash: 6161D369A29BA264FB10AB6594061BCA7A0FB017C4FC844F6CA4D17B5DCF7CE544E320

Function 00007FF73AD49CF5 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49D38
memcpy.VCRUNTIME140 ref: 00007FF73AD49D5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: f88e71eb1214b260cc3688f4f29c23b61b26d1e5c691a59e4fe9907adf74fe9f
Instruction ID: ac6361257cd19a9b0b0bb356dc9576350335693a856b295b4fd040aa96eb8f21
Opcode Fuzzy Hash: f88e71eb1214b260cc3688f4f29c23b61b26d1e5c691a59e4fe9907adf74fe9f
Instruction Fuzzy Hash: 1B518A29B1DAD251FF28A71690162B9AB90FB45BD0F8441B6CA5F077DDEF3CD005A320

Function 00007FF73AD01E30 Relevance: 12.1, APIs: 8, Instructions: 144COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01E7A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01E80
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01EDF
GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01F1F
IsValidSid.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01F6D
GetLengthSid.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01F7A
CopySid.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01F92
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD018DE), ref: 00007FF73AD01FB6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: InformationToken$CopyErrorLastLengthValidfreemalloc
String ID:
API String ID: 2357097940-0
Opcode ID: a2034901629b5a59706147417ca7dd00e2cfc9c934a5c144acf82cc918b244d0
Instruction ID: f6547a467c02bde39ecb6becf865e1ecfae4aff6f9676e4e35e7b4863ca1db57
Opcode Fuzzy Hash: a2034901629b5a59706147417ca7dd00e2cfc9c934a5c144acf82cc918b244d0
Instruction Fuzzy Hash: 6051A12AA28682A6FB14FF31C4112ACA790FB44B94FC445B4FA1D47BC9DF3CE515A321

Function 00007FF73AD49494 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Strings

GMT, xrefs: 00007FF73AD494F6
Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD49549

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 8adae43b5498fac82874378023eb0ba67fd859b21670b4a2a3a49f57112b7f90
Instruction ID: 5a5ea32cfc752ba0712c9db7b42cb9970056cf5e58fab2e3544008f18153fa51
Opcode Fuzzy Hash: 8adae43b5498fac82874378023eb0ba67fd859b21670b4a2a3a49f57112b7f90
Instruction Fuzzy Hash: 5851D569A2DB9264FB10AB65D4021F9A761FB05784FC844F6CA4E1779EDF3CE104E320

Function 00007FF73AD10C40 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD10C86
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD10CB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD10CDE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 4a2ea08fc3b1671cc0284ef113618cb274ebf2c0dc882fb53bdbd85c52bc4aa3
Instruction ID: 4e09a886f7faa77c898bb25100bef67a7d709bd68e343090fe562d4541d07054
Opcode Fuzzy Hash: 4a2ea08fc3b1671cc0284ef113618cb274ebf2c0dc882fb53bdbd85c52bc4aa3
Instruction Fuzzy Hash: 2951932AA2AB4091FB95DF66F041128B7A0FB48F84B481575EF5E03B5CDF38E4E19750

Function 00007FF73AD48937 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
GMT, xrefs: 00007FF73AD48996
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD489E9
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 001a1f094c72a99abfd70e5170dcf2c1ef20d368d05bcdafc3cfb13358300591
Instruction ID: 98e94a685a4868bd93e61281785b67055c88f74a258596e41980ad16c09634de
Opcode Fuzzy Hash: 001a1f094c72a99abfd70e5170dcf2c1ef20d368d05bcdafc3cfb13358300591
Instruction Fuzzy Hash: BC51B269A2DB92A4FB10AB6194421FDA7A1FB05BC4FC844B2CA4E1735DCF3CE504E321

Function 00007FF73AD45440 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF73AD44853), ref: 00007FF73AD454E8
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF73AD44853), ref: 00007FF73AD4552A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF73AD44853), ref: 00007FF73AD455CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF73AD44853), ref: 00007FF73AD455E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD45AC7

Strings

%s?dns=%s, xrefs: 00007FF73AD455B8
Failed to encode DOH packet [%d], xrefs: 00007FF73AD45621

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: b06c9a6cfe1491c243e93c60a718ad3b283934f75040aaf234fb7884b306a887
Instruction ID: 330098a304c78682e6e5aa747f70b3365105e08c66485ff328de2d1b424491a3
Opcode Fuzzy Hash: b06c9a6cfe1491c243e93c60a718ad3b283934f75040aaf234fb7884b306a887
Instruction Fuzzy Hash: 9002E55AB28BD3A6F710EB6194423B9A7D6EF45788F8440F1DE0D4778ADE68DC44A320

Function 00007FF73AD45CC0 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD0D9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9D6
Part of subcall function 00007FF73AD0D9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9E6
Part of subcall function 00007FF73AD0D9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9F4
Part of subcall function 00007FF73AD0D9A0: memset.VCRUNTIME140 ref: 00007FF73AD0DA2F

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD45D89
memcpy.VCRUNTIME140 ref: 00007FF73AD45DA4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD45DBE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 7e475e322eddb99df151d630e5f87abef7c9661a52240266933bb5358584fedb
Instruction ID: 88ee0bb525f03ee558da3f48403b4e6893d834aadb6d238a1c68229ac726887a
Opcode Fuzzy Hash: 7e475e322eddb99df151d630e5f87abef7c9661a52240266933bb5358584fedb
Instruction Fuzzy Hash: 4591B529B29B9262FA54FA1694563799390FF44BC0FC844F4DE4D4BB89DF2CE811A321

Function 00007FF73AD1AD80 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AE95
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AEAF

Strings

I32, xrefs: 00007FF73AD1AE85, 00007FF73AD1AEE5
Internal error removing splay node = %d, xrefs: 00007FF73AD1AD92
I64, xrefs: 00007FF73AD1AEA5, 00007FF73AD1AF0F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: bcb9afba8b02ce2e90d2221cddd3025082d5648365cfb6c57962aad3975302a6
Instruction ID: 3f5aab29a606960afd572223bef0111ebdda05b1ad0be5711e1ea079fbc15314
Opcode Fuzzy Hash: bcb9afba8b02ce2e90d2221cddd3025082d5648365cfb6c57962aad3975302a6
Instruction Fuzzy Hash: D9A1183BA18A4296FB20AF24E45177DBBA4FB48B58F854175CA9D43269DF3CD208D720

Function 00007FF73AD2AC50 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2AE7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2AEBF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2AEE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2AF29

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF73AD2AD58
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF73AD2ACCE
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF73AD2AE43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: e07f30e6e911af03d6728ef26db86dfc36681ec76705de0f768b2dfeeadd1410
Instruction ID: e6841ea785926ef79de0f93ca0940a5baeca8aa809328afae8a6d908d6ea02da
Opcode Fuzzy Hash: e07f30e6e911af03d6728ef26db86dfc36681ec76705de0f768b2dfeeadd1410
Instruction Fuzzy Hash: B7918A3A618F8596FB10EF25E8416AEB7A4FB84B88F840175DE4C477A8DF38D445DB10

Function 00007FF73AD0AF1C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0AF22
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 90f2f023cdc8a42e1b97df494a0f67eb88b29e38e58e4ee7ae2bfcc5365c8488
Instruction ID: 66f67d21cab6e2c122fc0f6d990e3d51a934776deec17bf2b5c1f884f4cb5784
Opcode Fuzzy Hash: 90f2f023cdc8a42e1b97df494a0f67eb88b29e38e58e4ee7ae2bfcc5365c8488
Instruction Fuzzy Hash: 6C618469E2C786A5FF71EB25D04637DA7E0EF05748F8400B5CA8D066A9DF2CE445E322

Function 00007FF73AD4B3CA Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6D3
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4B74E

Strings

TRUE, xrefs: 00007FF73AD4B6AD
GMT, xrefs: 00007FF73AD4B47E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD4B4F1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 76f7e2f7a542dd5e178dc2e147491f4daaec7db6251286cccd6da4263d1f286c
Instruction ID: b6447d62b036a7bbf1b6e169aa341c764fb71b038de3e5300d5e40f9abdff8d3
Opcode Fuzzy Hash: 76f7e2f7a542dd5e178dc2e147491f4daaec7db6251286cccd6da4263d1f286c
Instruction Fuzzy Hash: E8611869E2CAF664FB11AB249506279FBA4EB21784FD441F1C68D02A9CCF3CE545E320

Function 00007FF73AD0B0B9 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B0BC

Part of subcall function 00007FF73AD29490: strchr.VCRUNTIME140 ref: 00007FF73AD294C6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: 77c179985ae447a57cbc94f77982c5170b4ea6271e23b75ded7eff817584a596
Instruction ID: 71d3d2f76aa7e965e0d6ad4560dcb97869b8d98c2ab5d468243cb60d85f05297
Opcode Fuzzy Hash: 77c179985ae447a57cbc94f77982c5170b4ea6271e23b75ded7eff817584a596
Instruction Fuzzy Hash: 0E619769E2C786A5FF71EB25D04637DA7E0EF05748F8400B5CA8D066A9DF2CE445E321

Function 00007FF73ACF6B50 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6BE1
memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6C25
memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6C3D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6CC2

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6CF4
memcpy.VCRUNTIME140(?,?,?,00007FF73ACF1C8A), ref: 00007FF73ACF6D0F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF6D2C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: c7dc035757dcf0361bdb054ed86f9bf99010773e0e1c5867e139e1e8151fa7c3
Instruction ID: 969aaa69db987c6a9d5122cd93a3bdd8bf621103adc32c1d51bcd4606b158660
Opcode Fuzzy Hash: c7dc035757dcf0361bdb054ed86f9bf99010773e0e1c5867e139e1e8151fa7c3
Instruction Fuzzy Hash: B6510F26A0ABC2A2FA04EF25D516268A360FB14BD4F940A31CF6D173C6CF7CE195E350

Function 00007FF73AD32060 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD320AA
memcpy.VCRUNTIME140 ref: 00007FF73AD321C1
memcpy.VCRUNTIME140 ref: 00007FF73AD32232
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3225E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD32270

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF73AD320C0

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 47cdbe7cfbe3fcc66ff5ac541bccbd226539920edc277e813766e8a85038453f
Instruction ID: 31858a71e4d44ce664fa9c0d39eb89e63b7962a2659ffc57740ec5e5daeaab9d
Opcode Fuzzy Hash: 47cdbe7cfbe3fcc66ff5ac541bccbd226539920edc277e813766e8a85038453f
Instruction Fuzzy Hash: C951C07AA29781A6FB28DF65E5012AAB7A0FB19784F840075DF8D03799DF3CE154D320

Function 00007FF73AD351A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF73AD35263

Strings

, xrefs: 00007FF73AD35207
Getting file with size: %I64d, xrefs: 00007FF73AD35315
RETR response: %03d, xrefs: 00007FF73AD351F8
Data conn was not available immediately, xrefs: 00007FF73AD35357
bytes, xrefs: 00007FF73AD35259
Maxdownload = %I64d, xrefs: 00007FF73AD352FC, 00007FF73AD3539B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: 98b2d3edbda60c63995f711dd09914671eb63e825f28722de7741b0afe97d6d0
Instruction ID: c56b6e7a784e908cca82e3159176a6ee9690619ceb8b1c48b52df025c0704b17
Opcode Fuzzy Hash: 98b2d3edbda60c63995f711dd09914671eb63e825f28722de7741b0afe97d6d0
Instruction Fuzzy Hash: DE515B6BE1C78269FB25A724A4462B8E390FB45370FC442B1DE5C02AD9DF7DD486E310

Function 00007FF73AD49B6B Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

GMT, xrefs: 00007FF73AD49C1E
Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD49C8F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: f85c9e28b2b5febf6cebab1dd90ad1df248e9e9a6124e94aabf58f745a77f415
Instruction ID: 7d63153381b2d14fe882e408054f53032bc0a081a5abe7541bb37c2692d80b2d
Opcode Fuzzy Hash: f85c9e28b2b5febf6cebab1dd90ad1df248e9e9a6124e94aabf58f745a77f415
Instruction Fuzzy Hash: C751D669A2CAD2A5FB219B26A4451B9E7A4FB45B90FC444B2CA8E03B5CCF3CD145D710

Function 00007FF73AD34F70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF73AD35116

Part of subcall function 00007FF73AD4C2A0: memcpy.VCRUNTIME140 ref: 00007FF73AD4C348
Part of subcall function 00007FF73AD4C2A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4C359

Strings

QUOT string not accepted: %s, xrefs: 00007FF73AD3513F
FTP response timeout, xrefs: 00007FF73AD35183
We got a 421 - timeout!, xrefs: 00007FF73AD35155
FTP response aborted due to select/poll error: %d, xrefs: 00007FF73AD35124
*, xrefs: 00007FF73AD350E4

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: bcf282b738d7f34674c234a60b2517492483dc6bde4c0b00df4c61de9bc63897
Instruction ID: 66a83824a58f8ce4c0b49cac7839f58ead8b22fd2fb764f6c96e81c08c68778e
Opcode Fuzzy Hash: bcf282b738d7f34674c234a60b2517492483dc6bde4c0b00df4c61de9bc63897
Instruction Fuzzy Hash: D751F769F28683A9FB65BA25D8023B9A390EF45784F8441B1DE0D872DDEF2DE445E310

Function 00007FF73AD1A1C0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43EE4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43F0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD43F18

Strings

true, xrefs: 00007FF73AD43E84
stale, xrefs: 00007FF73AD43E6F
Digest, xrefs: 00007FF73AD1A1E8

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 6f0475974efa24e8fbc3d73b36d4f1d25cadbdca7060c5874d9ab79cb964ce76
Instruction ID: 8866955d854c6045d6bccccc875ab4d49510e9543788119bb382f7c6161801c0
Opcode Fuzzy Hash: 6f0475974efa24e8fbc3d73b36d4f1d25cadbdca7060c5874d9ab79cb964ce76
Instruction Fuzzy Hash: AF51C529A2CA9261FF20AF25E4523B9B3A0FF44B84FC441B1EA9D476C9DF2CD515D720

Function 00007FF73AD3DD50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF73AD3DDB0
memcpy.VCRUNTIME140 ref: 00007FF73AD3DDD6
memchr.VCRUNTIME140 ref: 00007FF73AD3DED3

Strings

TFTP error: %s, xrefs: 00007FF73AD3DEF0
Received too short packet, xrefs: 00007FF73AD3DE02
Internal error: Unexpected packet, xrefs: 00007FF73AD3DE78

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: a39ce3c30d563b271151488736fa91590d51a6ba364d5fb86d046a907728c25b
Instruction ID: 3e93cb0b670d4c0965761024e01ad2ec9b10b56df0ab9e83bd695d166c97f517
Opcode Fuzzy Hash: a39ce3c30d563b271151488736fa91590d51a6ba364d5fb86d046a907728c25b
Instruction Fuzzy Hash: 225105B9A186C295FB64AF24C4523BDA790FB45B84F884271DA8D4778CDE3DE405EB20

Function 00007FF73AD40C27 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: fed69df65176b25d433b0a66ea512be180adda36587a7fabe9ca90d33ea6589c
Instruction ID: 9fe630ef461c92b25c4f5f8a91dc172fe00f2cb4009b2a7ef39877e9b00378fd
Opcode Fuzzy Hash: fed69df65176b25d433b0a66ea512be180adda36587a7fabe9ca90d33ea6589c
Instruction Fuzzy Hash: F941261D92D6A165FB62AB217012379AB90EF42B44F8805F1CEDE077C9DF2DE449E320

Function 00007FF73AD40C17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: cfb5b72897b3640e3ddf32e1117a6d838b57e4d7e7d215cf4dd607628183e546
Instruction ID: f5743ca6d7f5118d5c5eb2ac67f3f5a8e5cad14c0bdd99b0a326a4ec28f6201c
Opcode Fuzzy Hash: cfb5b72897b3640e3ddf32e1117a6d838b57e4d7e7d215cf4dd607628183e546
Instruction Fuzzy Hash: 7C41F51D92D6A265FB62AB217012378AB91DF46B50F8801F1CEDE077C9DE2DF448A320

Function 00007FF73AD40BC2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 2747d6bb2743ca7f1ca5ad6f99292fd065f44510c212ab333fd5ec055fbfad6d
Instruction ID: 38efa3cd2271e1d80549a0914158a86db6670d85e82b0bc34e831365c9b755cf
Opcode Fuzzy Hash: 2747d6bb2743ca7f1ca5ad6f99292fd065f44510c212ab333fd5ec055fbfad6d
Instruction Fuzzy Hash: 3741F61D92D6A265FB62AB217012378AB91DF46B50F8801F1CE9E077C9DE2DE445A320

Function 00007FF73AD40B98 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: f0a5dec7a6829da9e658e8a9fe293304ca0b81dfb7ceab350bc5f67ffcca4bfb
Instruction ID: 8b9c92da384153d788de2911f53eadc1a50beddd9c2de02539f73bfed2d35bf5
Opcode Fuzzy Hash: f0a5dec7a6829da9e658e8a9fe293304ca0b81dfb7ceab350bc5f67ffcca4bfb
Instruction Fuzzy Hash: CB41F61D92D6A265FB62AB217012378AB91DF46B50F8801F1CE9E077C9DE2DE445A320

Function 00007FF73AD40B7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 186fee5687931d40b4c2ef807a5696b0b782695a1db0f7de82079c91e4d66bf2
Instruction ID: 8bdf50871449e3d8d34b75692c4968d12f0386c415d6fd72be266023ec3a8b82
Opcode Fuzzy Hash: 186fee5687931d40b4c2ef807a5696b0b782695a1db0f7de82079c91e4d66bf2
Instruction Fuzzy Hash: 7241F71D92D7A265FB62AB217012378AB91DF46B50F8801F1CEDE077C9DE2DF445A320

Function 00007FF73AD40B8A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: afb2ffb4746d36919b7f1e0b29476894b60c45c25966f89c212e037f0804b22e
Instruction ID: 4cd4879b86ae0e992d3ea8cb013adf6f27c322bc777d07c311cec05e1dbbe90f
Opcode Fuzzy Hash: afb2ffb4746d36919b7f1e0b29476894b60c45c25966f89c212e037f0804b22e
Instruction Fuzzy Hash: 4E41F61D92D7A265FB62AB217012378AB91DF46B50F8805F1CE9E077C9DE2DE445A320

Function 00007FF73AD40C4D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40C8D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD40CDE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40D9A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E8A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40E9B

Strings

%%%02x, xrefs: 00007FF73AD40D43

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 7527fdf159f91d98e67d27b3f59d83357e3df51c920be20e9954b610b0e9a087
Instruction ID: 8163bc35536f3d443cdac4be7a3d3296984d1221db90b184c0223b813ae694b3
Opcode Fuzzy Hash: 7527fdf159f91d98e67d27b3f59d83357e3df51c920be20e9954b610b0e9a087
Instruction Fuzzy Hash: 0941E51D92D7A265FB62AB217012378AB91DF46B50F8801F1DEDE077C9DE2DE449A320

Function 00007FF73AD25D30 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF73AD25E16
strchr.VCRUNTIME140 ref: 00007FF73AD25E29
strchr.VCRUNTIME140 ref: 00007FF73AD25E3B

Strings

Expect, xrefs: 00007FF73AD25D97
Expect: 100-continue, xrefs: 00007FF73AD25E98
100-continue, xrefs: 00007FF73AD25E56
Expect:, xrefs: 00007FF73AD25DBE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 949646363b574d71c49e1552ae6e1dfe917057c9dc396973c77786bab85b85c1
Instruction ID: 376d236877d90ab32e05afc6e3ca655e64f168f5513046f14250ce5635da6dd8
Opcode Fuzzy Hash: 949646363b574d71c49e1552ae6e1dfe917057c9dc396973c77786bab85b85c1
Instruction Fuzzy Hash: 6241D93DB2D68691FE54BB1AA4025B9E791EF45784FC800B4DA4D0778EEE2CE441E720

Function 00007FF73AD1E100 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD1E24A

Strings

necessary data rewind wasn't possible, xrefs: 00007FF73AD1E255
ioctl callback returned error %d, xrefs: 00007FF73AD1E20F
Cannot rewind mime/post data, xrefs: 00007FF73AD1E280
the ioctl callback returned %d, xrefs: 00007FF73AD1E1F5
seek callback returned error %d, xrefs: 00007FF73AD1E19E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 50bd09d713134e0da44288561a765d96ac21585d93d49751b534ea4254a34593
Instruction ID: 8c1e8163a97010ec91f8f1d4314c44683834e86487866df59622d6f004b5bfdf
Opcode Fuzzy Hash: 50bd09d713134e0da44288561a765d96ac21585d93d49751b534ea4254a34593
Instruction Fuzzy Hash: 8441C66AB24A4251FB94EB3594523B96392FF85B84F882071DD0E4B39DDF3DD480D720

Function 00007FF73AD493B0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Strings

Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D
%s%lx, xrefs: 00007FF73AD4940D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: e435ceb1295a207ca531d4d1bd71585a74677e19f70f4eccf9ff7b7bb0609de3
Instruction ID: 0b8f2d3245e66b28811a2ce33a3d1c53c90e86231eb8a77bfdd30469d636291b
Opcode Fuzzy Hash: e435ceb1295a207ca531d4d1bd71585a74677e19f70f4eccf9ff7b7bb0609de3
Instruction Fuzzy Hash: 93419369A2DBA264FB20AB6694461F9A761FB05784FC444F5CE4E0779EDF3CE104A320

Function 00007FF73AD49AAE Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

GMT, xrefs: 00007FF73AD49B04
Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD49B44

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 1d8a3240ce61001dc99aa1db0dcfac25c8b2628c6441f6d53234acd081df675b
Instruction ID: 0d76eb6dfb8e09bfb0908b6f677781480ff67fcbabb44c5430c3d2173bb8cea6
Opcode Fuzzy Hash: 1d8a3240ce61001dc99aa1db0dcfac25c8b2628c6441f6d53234acd081df675b
Instruction Fuzzy Hash: 0241B72AA1CB96A1FB20EB26E4461E9E3A0FB45B84FC840B2DA4E0775DDF3CD545D710

Function 00007FF73AD31BB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD31BED
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD31C5E

Strings

., xrefs: 00007FF73AD31C57

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: f1ab1ca59cd73ae94121d53b2a3f43b2756969529a46232909368021d89237a3
Instruction ID: 5d291e21c5375ba5e2a8d6b26dae3b4bee500e590c80d49f9665337fb1ffeb04
Opcode Fuzzy Hash: f1ab1ca59cd73ae94121d53b2a3f43b2756969529a46232909368021d89237a3
Instruction Fuzzy Hash: F441B526E18B86A2FB50EF21E401279F7A0FB49F80F854071EA4D47698DF7DE491D760

Function 00007FF73AD48B7E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48BAF
memcpy.VCRUNTIME140 ref: 00007FF73AD48BDA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 68a868a3f9c436f8e85ff2fda507b46bd44467c89c647bf6f96657e5d5d78264
Instruction ID: 50bd40cfcc503f44d55924f2071aa0cd1f62bd0a1602a7e5849a6639174e5bcb
Opcode Fuzzy Hash: 68a868a3f9c436f8e85ff2fda507b46bd44467c89c647bf6f96657e5d5d78264
Instruction Fuzzy Hash: DC41D35DB2AB9265FB10AB6294061F8A791FF55BC4FC844B5CD0E1775DDF3CA4049320

Function 00007FF73AD421D0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD2DCE0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD08
Part of subcall function 00007FF73AD2DCE0: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD2E
Part of subcall function 00007FF73AD2DCE0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD4F
Part of subcall function 00007FF73AD2DCE0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD60

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4226F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD422B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD422C1

Strings

%s%s.netrc, xrefs: 00007FF73AD4222F
%s%s_netrc, xrefs: 00007FF73AD42284
HOME, xrefs: 00007FF73AD42209

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 1b35adc42e643c2407c75afb52d1076ad4e106ff5b4138c3a2336353e2ca422f
Instruction ID: 1e68a903a597b88938e5e185baa2568ad2b47b768b9ace275e05a3bcc3f38599
Opcode Fuzzy Hash: 1b35adc42e643c2407c75afb52d1076ad4e106ff5b4138c3a2336353e2ca422f
Instruction Fuzzy Hash: 9B31C629A18B51A1FA14FB12B8421AAE7A0FF84BD0FC444B5DD8D0776CDF3CE005A724

Function 00007FF73AD49CFD Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49D38
memcpy.VCRUNTIME140 ref: 00007FF73AD49D5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: e023c3ad630c6134aeb32b7d011cf589474a6336939163e49ac3f316fd1cec93
Instruction ID: 2c4e65bf7fadce5b3ffb02e8ed10da64dd8f41ecbd23c07f44433028a6b480f7
Opcode Fuzzy Hash: e023c3ad630c6134aeb32b7d011cf589474a6336939163e49ac3f316fd1cec93
Instruction Fuzzy Hash: 5531C629B19B8251FE24EB16A4052B9A390FF85BD4F8445B2CD5E077A9EF3CD0059310

Function 00007FF73AD024B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73AD024DD
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73AD024F7
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73AD02529
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73AD02553
std::_Facet_Register.LIBCPMT ref: 00007FF73AD0256C
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF73AD0258B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73AD025B6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskD@std@@Facet_Getcat@?$ctype@Getgloballocale@locale@std@@Locimp@12@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 3790006010-0
Opcode ID: 3d4c21c179987fecba757e9d1ddbb6a5e06c291919011fb33e3d343bb1df7a16
Instruction ID: 3ee1e1a8f5109a69c847991c04d91959f36e99b78ca3b0a14ca2ad00953865a8
Opcode Fuzzy Hash: 3d4c21c179987fecba757e9d1ddbb6a5e06c291919011fb33e3d343bb1df7a16
Instruction Fuzzy Hash: 4D31D229619B42A1FF14EF11E455169B360FB88B94F880671EB8D07BACCF3CE440D710

Function 00007FF73AD48E08 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD48E3C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

TRUE, xrefs: 00007FF73AD48E2A
Start Date, xrefs: 00007FF73AD492FD
FALSE, xrefs: 00007FF73AD48E31
Start Date: %s, xrefs: 00007FF73AD49317

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 2562c43ade72985ab40276ff8f07cfc0aa0dc1fb67b228d8f09af814158ce288
Instruction ID: 4cd646c873e45d7f446c689f75ac3a4d7f1d34ab0a7e5d3ab83e87385cff6a1c
Opcode Fuzzy Hash: 2562c43ade72985ab40276ff8f07cfc0aa0dc1fb67b228d8f09af814158ce288
Instruction Fuzzy Hash: E921F569B1DBD265FB21AB25A4852F9B750FB06788FC840B2CA4E0776DCF2CE145D320

Function 00007FF73AD49A85 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD49A88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: 6f8954757622b8ea05fe5c6ec76894bbbf769488daecf0bd9159efc2cf47188e
Instruction ID: a8a4e2e336f6c51bcad395bd6fcdae31988f3f85a92b6aad3cc7cffb10c25865
Opcode Fuzzy Hash: 6f8954757622b8ea05fe5c6ec76894bbbf769488daecf0bd9159efc2cf47188e
Instruction Fuzzy Hash: CB21656AA19B82A1FB60EB56E4452F9A390FF85784F840472DE4E0772DDF3CD045D710

Function 00007FF73AD173E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD17415
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD17441
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD17449
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD1746B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF73AD1475C), ref: 00007FF73AD17482

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF73AD17454

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 1f3b9447c6035e11cc22b055810892dee074b698cac5a45710cf028bc5c21e0c
Instruction ID: 7298d4979d2016c27e69f7fa00899d3324f6e2018c98be18853b56cc54f0d06c
Opcode Fuzzy Hash: 1f3b9447c6035e11cc22b055810892dee074b698cac5a45710cf028bc5c21e0c
Instruction Fuzzy Hash: DA11867AB28A42A2FF50EB61E451178A7B0EF86B84FD44071DA5D43678DF2CD845DB20

Function 00007FF73AD17310 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17324
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1733A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1734E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17362
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD17376
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1738A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1739E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD173B2

Part of subcall function 00007FF73AD402B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD173CB,?,?,00000000,00007FF73AD12E13,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD402C5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 688671a343e0bd118dc6fd9af653c32ff16310287b6f5f93e47a1f593174d7cb
Instruction ID: 8bcbbb4f9eda879a26e6e322816c7d368a812eec1c445f0bda5e705b740e0a68
Opcode Fuzzy Hash: 688671a343e0bd118dc6fd9af653c32ff16310287b6f5f93e47a1f593174d7cb
Instruction Fuzzy Hash: C811943A518F81D1E700AF21E9950EC73A4FBC9FDAB984075DE9E4F768DF3880958220

Function 00007FF73AD10DF0 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E01
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E11
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E1F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E2D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E3B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E49
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E57
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD145F6), ref: 00007FF73AD10E65

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f21c44d06512a6ebe019ce33eb4fb3121d333ff9d31fc09cbc773e96172c0f0f
Instruction ID: 701f9b9ee231ee9e5290186657a395a3bac041099c5916807129b149fabf557d
Opcode Fuzzy Hash: f21c44d06512a6ebe019ce33eb4fb3121d333ff9d31fc09cbc773e96172c0f0f
Instruction Fuzzy Hash: 9A01B33A518F01D2E700AF21E58503CB7B4FB89F987905165CE9E42728CF38C4A9C250

Function 00007FF73AD13EC0 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF73AD1473B), ref: 00007FF73AD13ED7
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF73AD1473B), ref: 00007FF73AD13F08

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: e693126a3825e5ead405ff9acfc9aa64935a849bb492540464474959ba8c6496
Instruction ID: 004806caae70127dfa4a054fb80d4f70d945717ae07448ea3374ac1b201e7e6e
Opcode Fuzzy Hash: e693126a3825e5ead405ff9acfc9aa64935a849bb492540464474959ba8c6496
Instruction Fuzzy Hash: 0391BF2A609BC199E7459F3894403ED7BA0F755B28F484276CFBC0B3DADF2991A4C721

Function 00007FF73AD4917C Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD491BF
memcpy.VCRUNTIME140 ref: 00007FF73AD491E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD492B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: 193f476417fba50e8a6c1ffd11df03c09d75bc8203ed1090ad101fba35108fd6
Instruction ID: 25ff96aed5a3ca7597c500cbee1c9bb2b14c8f576c14e114878b4d2d6bad8dcc
Opcode Fuzzy Hash: 193f476417fba50e8a6c1ffd11df03c09d75bc8203ed1090ad101fba35108fd6
Instruction Fuzzy Hash: 90417F59A1D6E226FF18A722405A2B8B791FF06790FC442F5C66F077DDDE2CA045A320

Function 00007FF73ACFD380 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73ACFD46A
memcpy.VCRUNTIME140 ref: 00007FF73ACFD479
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFD4AD
memcpy.VCRUNTIME140 ref: 00007FF73ACFD4B4
memcpy.VCRUNTIME140 ref: 00007FF73ACFD4C3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACFD4E8

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 5475502e648e30785465817cdc5c6ee60d669828067962c10bf7b12e21fccadb
Instruction ID: ab566f47ef5874b6042e81746aacc1413e8036d9ae26d55cacb8f5029b301f5b
Opcode Fuzzy Hash: 5475502e648e30785465817cdc5c6ee60d669828067962c10bf7b12e21fccadb
Instruction Fuzzy Hash: C131F26671A642A5FE15BB16A4261A8E361EB44BE4F840B71DE6D07BC9DF3CE081D320

Function 00007FF73ACF5C30 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF73ACF4995,?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF5D23
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF73ACF4995,?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF5D31
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF73ACF4995,?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF5D6A
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF73ACF4995,?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF5D74
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF73ACF4995,?,?,?,?,?,00007FF73ACF1C5B), ref: 00007FF73ACF5D82
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF5DB1

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a9eb11d8d8117c9354b0a377b7a1f2999a274e88e93302033774ebc5ecbeed83
Instruction ID: 42f31f00556734f72a7716734eea2d0c61d6f8d711a48aa77c2c7f507a26f427
Opcode Fuzzy Hash: a9eb11d8d8117c9354b0a377b7a1f2999a274e88e93302033774ebc5ecbeed83
Instruction Fuzzy Hash: 54412A6571B646A5FE24EB15A51526DE390FB04BD0F840630DFAD0BBCADF3CD041A320

Function 00007FF73AD44040 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD44086
strchr.VCRUNTIME140(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD44096
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF73AD435FF), ref: 00007FF73AD440C0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD440F5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4411A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4413C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 5d62b3837f066d61397288db362985870f9119d87ca65c280d65034f9eb39680
Instruction ID: 94c6892ba8ca1396c0dfafb1491c9c90112cd5f37bd6071adf1bbcfc04061026
Opcode Fuzzy Hash: 5d62b3837f066d61397288db362985870f9119d87ca65c280d65034f9eb39680
Instruction Fuzzy Hash: EF311765A19B9197FA54FF21A841236BBA0EF95B90F8846B4DE4D03799EF3CE0809310

Function 00007FF73AD48B3F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: b00ff19d728a505862d6724352d6f8a54f5636cb91fc230e2f50254375608459
Instruction ID: 8c20421969e5fd8b6b1aac96306e38f41fba662ee0b71a439948ddeb6f578092
Opcode Fuzzy Hash: b00ff19d728a505862d6724352d6f8a54f5636cb91fc230e2f50254375608459
Instruction Fuzzy Hash: FA41B469B19B9269FB10AB6194451F9A7A1FF05BC8F8844B6CE0E0779EDF3CE144D320

Function 00007FF73AD49425 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Strings

Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 6e052a58277e0f9d47c0b405635fcb18a605dfa7d0efdbe0dbbedaa4faf728e6
Instruction ID: d73be420ae9cf2261325c9d998792c3bef9df1c6fc447d51401a79188f9476e1
Opcode Fuzzy Hash: 6e052a58277e0f9d47c0b405635fcb18a605dfa7d0efdbe0dbbedaa4faf728e6
Instruction Fuzzy Hash: C1318269A1DB9265FB10AB6694021F9A761FF45788FC444B5CE4E0779EDF3CE104A320

Function 00007FF73AD49476 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD4A5A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4A5EC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 820a20d9b48d801fa2c1390dc93463265361c239ee7e788a834818dde5867bad
Instruction ID: 5469fe6b7c36e4aec3a5e9545002a0eaa8366304b9fc408282da1cfe518a64b2
Opcode Fuzzy Hash: 820a20d9b48d801fa2c1390dc93463265361c239ee7e788a834818dde5867bad
Instruction Fuzzy Hash: A931A26DA1DB9265FB10AB6694021F9A7A1FF45784FC444B5CE4E0B79EDF3CE104A320

Function 00007FF73AD49443 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD4C0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4C0E5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49962

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Expire Date: %s, xrefs: 00007FF73AD49887
Public Key Algorithm, xrefs: 00007FF73AD49918
Public Key Algorithm: %s, xrefs: 00007FF73AD49932
Expire Date, xrefs: 00007FF73AD4986D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: d949e5b4fa27f26d256aa9e5f72a9fa30b3c1d8486262602a9927bfb222196b8
Instruction ID: 060f849f736b35f00787a840177ee07a35360f6cd7577aa5e96abd81f4009971
Opcode Fuzzy Hash: d949e5b4fa27f26d256aa9e5f72a9fa30b3c1d8486262602a9927bfb222196b8
Instruction Fuzzy Hash: 3F31A269A1DB9265FB10AB6694021F9A7A1FF45784FC444B6CE4E0775EDF3CE104A320

Function 00007FF73AD499E0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F
%s%lx, xrefs: 00007FF73AD49A3D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: a046c591825318778792a4adfb20fcc05dff740a8c7684e1a187925fe64dd097
Instruction ID: bc704a0985ddcc1282c0c7121b18cc77480de1d471b6969b89352f2a5577ce6b
Opcode Fuzzy Hash: a046c591825318778792a4adfb20fcc05dff740a8c7684e1a187925fe64dd097
Instruction Fuzzy Hash: FE31B42AB2DA92A5FE20AB26E4452B9A790FB45B84FC444B2DE4E0775DDF3DD004D710

Function 00007FF73AD39A70 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD39A81
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD39AED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD39AFF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: 9798b4b2a5b5475cb8602e5a64c27a5e9ffe36cbfe2458f6a8f8a1688298187f
Instruction ID: 7d6e83ac9999b3faab3899c394a3bd1fbde46d9ee0828052eab7f1587eadaa06
Opcode Fuzzy Hash: 9798b4b2a5b5475cb8602e5a64c27a5e9ffe36cbfe2458f6a8f8a1688298187f
Instruction Fuzzy Hash: A031E636E18B8581FB40DB24D0653B9B7A0EB86B84F984070DE8D077D9DF3DD5859720

Function 00007FF73AD4891F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD4A5A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4A5EC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48D1E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD48DC3

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Signature Algorithm: %s, xrefs: 00007FF73AD48DB1
Signature Algorithm, xrefs: 00007FF73AD48D97
Serial Number, xrefs: 00007FF73AD48CF2
Serial Number: %s, xrefs: 00007FF73AD48D0C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 69f5010e2cb87970ea5665302aa2f7c673abecca91bc384bf6bebc297968b28b
Instruction ID: c2e81b8c1257843daefdc52535565e5f009b711d990431728d57e9fa09ea1dc2
Opcode Fuzzy Hash: 69f5010e2cb87970ea5665302aa2f7c673abecca91bc384bf6bebc297968b28b
Instruction Fuzzy Hash: B331815DA2AB9269FB10AB6194421F9A7A0FF457C8FC844B5CE0E0775EDF3CE044A320

Function 00007FF73AD0CE10 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF73AD0CE43
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF73AD0CE57
CloseHandle.KERNEL32 ref: 00007FF73AD0CE64
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF73AD0CE86
closesocket.WS2_32 ref: 00007FF73AD0CEA4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF73AD0CEBD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 42f99849b81ca2be3f30952e93cd363fd26a264c66b46ccd71e9ad8e9b1e78f6
Instruction ID: d8d3b789c707abfcf97ba8c8ecb1cba4b824ec0015313cd5c441a3e4ba613dcb
Opcode Fuzzy Hash: 42f99849b81ca2be3f30952e93cd363fd26a264c66b46ccd71e9ad8e9b1e78f6
Instruction Fuzzy Hash: 46213B7EA28A41A6F720EF12E555269B370FB89B90F844171CF8D03B59DF38E4A5D720

Function 00007FF73AD0B048 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD29540: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29561

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 471d100a441eb6db1a28c6e59c3c9224cb732e29a85ac6f64c24d6eb38c3bb07
Instruction ID: e993dd1c360c83d3a52bf775209feb7225d02dcd7be8284a9bb698f8d6c8947c
Opcode Fuzzy Hash: 471d100a441eb6db1a28c6e59c3c9224cb732e29a85ac6f64c24d6eb38c3bb07
Instruction Fuzzy Hash: 9F618669E2C786A5FF71EB25D04637DA7E0EF05748F8840B5CA8D066A9DF2CE444E321

Function 00007FF73AD0AF3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD29490: strchr.VCRUNTIME140 ref: 00007FF73AD294C6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD0B111

Strings

FALSE, xrefs: 00007FF73AD0B0EB
Replaced, xrefs: 00007FF73AD0B3A1
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF73AD0B3B7
Added, xrefs: 00007FF73AD0B3AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: 024716cdd2d984dc349697e1390d9c0640e3d967f017065c5a1dd4ee63caead3
Instruction ID: 667ee8fb6746a793c226409079e01d5cabe45bb7bc80328f03b9493615c8a1a4
Opcode Fuzzy Hash: 024716cdd2d984dc349697e1390d9c0640e3d967f017065c5a1dd4ee63caead3
Instruction Fuzzy Hash: 5D619869E2C786A5FF71EB25D04637DA7E0EF05748F8400B5CA8D066A9DF2CE445E321

Function 00007FF73AD23F40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD2414D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD24165

Strings

The requested URL returned error: %d, xrefs: 00007FF73AD240EE
Forcing HTTP/1.1 for NTLM, xrefs: 00007FF73AD24009

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 7c819a251becc5ad5d8b3fbbaf430680beabe1210d47572a46917de0d1242923
Instruction ID: 7425fb6aa2cb58e7fe5fc4a466dbb37138439061a600899d1e574b7362bedd2c
Opcode Fuzzy Hash: 7c819a251becc5ad5d8b3fbbaf430680beabe1210d47572a46917de0d1242923
Instruction Fuzzy Hash: 2E512A79A1CAC660FB61AB2491423F9B7A1EB65784F8800B5DE4D4B68DCF3DE490D331

Function 00007FF73ACF24E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ACF50A0: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1

Part of subcall function 00007FF73ACF49A0: memcpy.VCRUNTIME140 ref: 00007FF73ACF49F3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF25B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF2600
__std_exception_copy.VCRUNTIME140 ref: 00007FF73ACF2650
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF269D

Strings

out_of_range, xrefs: 00007FF73ACF2526

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: dee526ac08bdab1460d569e6e652dcb860ad7ea9f790511ede79b1eca54f5b30
Instruction ID: 8657ded1c011b3c94ae6f35a2ac6bff4744e563ec304867605abba654bb9f5eb
Opcode Fuzzy Hash: dee526ac08bdab1460d569e6e652dcb860ad7ea9f790511ede79b1eca54f5b30
Instruction Fuzzy Hash: 9151E076B29B42A9FB04EF64D8513AC7361FB54798F808271EA6C03AD9DF38D1A4D310

Function 00007FF73AD41320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD41398
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD413CA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4143A

Part of subcall function 00007FF73AD296A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF73AD0C6CA,?,?,?,?,?,?,?,00007FF73AD0C497), ref: 00007FF73AD296B1

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD414B5

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF73AD4138E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 1e38809e60a69ff38fc37f0eaf8c27f698d50976a376e211414230216df9dd2c
Instruction ID: e7faa7a401f8b421467786b1fd165b3b8a7669e988a391f274dae5c2748e0499
Opcode Fuzzy Hash: 1e38809e60a69ff38fc37f0eaf8c27f698d50976a376e211414230216df9dd2c
Instruction Fuzzy Hash: 2F415959A1CAD561FF21AB119406379BB90EB06794FC801F1EB9D03ACDDF2CE405E721

Function 00007FF73AD4B308 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6D3
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4B74E

Strings

GMT, xrefs: 00007FF73AD4B364
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD4B3B6

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 5d67476c0909cb3ba9a7f66691065ecbf708e0c157686aeaccf5758ef385bb49
Instruction ID: 336d77a0f240f72262e8c54a61a80abda948134b93e2553e6f41de8bd652eac3
Opcode Fuzzy Hash: 5d67476c0909cb3ba9a7f66691065ecbf708e0c157686aeaccf5758ef385bb49
Instruction Fuzzy Hash: 76412D2991CAE5A5FB11EB25914637CFBA1EB21780FC841F1C68E02A9CDF3CE541D320

Function 00007FF73AD20CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD20D5A
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD20DCB
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF73AD20E2B

Strings

:%u, xrefs: 00007FF73AD20D6E, 00007FF73AD20DD4
Hostname in DNS cache was stale, zapped, xrefs: 00007FF73AD20E52

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: aceda1046b60fa3e87b21c86f3e7c6855103a29c9fc3418c8ff459f9ceabfc60
Instruction ID: 5a71974f412592b71173cab16af6a0e1c4c77521db47fb74a79bbc9b3fbaffc8
Opcode Fuzzy Hash: aceda1046b60fa3e87b21c86f3e7c6855103a29c9fc3418c8ff459f9ceabfc60
Instruction Fuzzy Hash: 8941F76A629686A5FB20EB11F4013F9E760FB49B94F844272DE4D07B99DF3CE805D310

Function 00007FF73ACF50A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF50D1
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF5196
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73ACF51EA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF51F1

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF73ACF50A2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: a57a7afd730a427e2a8d015c7a2f57c355332821ffa3fb098b26d42bbb551727
Instruction ID: 6771f1dce3aeaaf11178426b89ee1d5934fbdfe7fcf161b150ee3d070747d588
Opcode Fuzzy Hash: a57a7afd730a427e2a8d015c7a2f57c355332821ffa3fb098b26d42bbb551727
Instruction Fuzzy Hash: 07311766B0668A69FE19EB5599252789391DB00FE4F884670DF2D07BC6DE7CF0829310

Function 00007FF73AD02350 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF73ACF11FC), ref: 00007FF73AD0242F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF73ACF11FC), ref: 00007FF73AD0246C
memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF73ACF11FC), ref: 00007FF73AD02476
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73AD024A9

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF73AD02352

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: https://keyauth.win/api/1.2/
API String ID: 1775671525-3933380396
Opcode ID: 7631a62d654057ec0b1cf769a7e0d366874ef7107a71ab9249c563aa71255ac2
Instruction ID: a9feb3044b44745c15d0df7d8af5b6abef30e74d074f405f214bdef709365ab9
Opcode Fuzzy Hash: 7631a62d654057ec0b1cf769a7e0d366874ef7107a71ab9249c563aa71255ac2
Instruction Fuzzy Hash: CA314266B1A741A4FE18EB11A4413ACE291EB04BD0F880675DF5D0BBC9CF3CE090E321

Function 00007FF73AD17B20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73AD17B9E

Part of subcall function 00007FF73AD042A0: GetLastError.KERNEL32 ref: 00007FF73AD042C2
Part of subcall function 00007FF73AD042A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD042CA

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD17BBC
recv.WS2_32 ref: 00007FF73AD17BE7
WSAGetLastError.WS2_32 ref: 00007FF73AD17BF9

Strings

Recv failure: %s, xrefs: 00007FF73AD17C25

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: b08348e961448b9a3b25bd2a5120d124dc907a97bec9f7df7f02126b8e2fe5d8
Instruction ID: f0671eaf2d66e0b6974e326159aedaacd7af6724f738d0581883482b4afa7b19
Opcode Fuzzy Hash: b08348e961448b9a3b25bd2a5120d124dc907a97bec9f7df7f02126b8e2fe5d8
Instruction Fuzzy Hash: DE31237AB15B4591FB50AF21E8822AAA3A0FB49FD8F804071DE1D07798DF3CD116D710

Function 00007FF73AD1C2B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1C339
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1C3CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1C3F7

Strings

Unrecognized content encoding type. libcurl understands %s content encodings., xrefs: 00007FF73AD1C3E5
identity, xrefs: 00007FF73AD1C2F3, 00007FF73AD1C363, 00007FF73AD1C3C8

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Unrecognized content encoding type. libcurl understands %s content encodings.$identity
API String ID: 3985033223-1703240927
Opcode ID: e74867a4b311d7321d6114bf66a983aca4c1b1ab487fe1a341befa565e3e5ac3
Instruction ID: a1a1f8aec064d9eaf4d27d97dd9f29bf3c7f36975389d154f87998b40a12d557
Opcode Fuzzy Hash: e74867a4b311d7321d6114bf66a983aca4c1b1ab487fe1a341befa565e3e5ac3
Instruction Fuzzy Hash: FA41E169A18A46A1FF41AB21E406379E7A0EF45BE4FC842B1CE2D037DCDF2CE5019320

Function 00007FF73AD4B1F9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B220
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6D3
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4B74E

Strings

FALSE, xrefs: 00007FF73AD4B215

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: dffe9c9edb1adfef6e34665ef29496d48f25e2344bd9925a93246a32197c5706
Instruction ID: 21352e97bfc4c99f6eea43817a39ee947fd6339c84887954fdc5554b5566a6f7
Opcode Fuzzy Hash: dffe9c9edb1adfef6e34665ef29496d48f25e2344bd9925a93246a32197c5706
Instruction Fuzzy Hash: E531085AE2C6B264FB12EB249456338AF90DB217A4FC446F1C59A05AD8DF2CD182E330

Function 00007FF73AD32B70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD32BAB
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD32BF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD32C56

Strings

RCPT TO:<%s@%s>, xrefs: 00007FF73AD32C2D
RCPT TO:<%s>, xrefs: 00007FF73AD32C3B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: bce391041d351114edf8f033b369b5d46eb8cacd26457ba0b0394aa6cd5b35a2
Instruction ID: 972bd59c38a0d116b8a9f8c8bb6d5b2442e45119cadfca6d76de9868a1893f07
Opcode Fuzzy Hash: bce391041d351114edf8f033b369b5d46eb8cacd26457ba0b0394aa6cd5b35a2
Instruction Fuzzy Hash: 0731E36AE28BC191FB05EB25E4412B9E3A0FB94B90F888271DA5E037D9DF7CD541D310

Function 00007FF73AD4AAA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4AACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Strings

TRUE, xrefs: 00007FF73AD4AABB
%s: %s, xrefs: 00007FF73AD4AF81
FALSE, xrefs: 00007FF73AD4AAC2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: eb7b13f9c99c73700b12856a73483d0661b95b3686ff9859e1780b88561ebb8f
Instruction ID: 0e45addc03b26d04a88ff85df3e1fee1a703634ea4ef5646e3d2a5e268d9b7e0
Opcode Fuzzy Hash: eb7b13f9c99c73700b12856a73483d0661b95b3686ff9859e1780b88561ebb8f
Instruction Fuzzy Hash: CF010499A1D792A5FF65AB15A4023B99390EB01B80FC840B1DE4D03369CF2CD185E320

Function 00007FF73AD460D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD46030: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46056
Part of subcall function 00007FF73AD46030: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46077
Part of subcall function 00007FF73AD46030: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46092
Part of subcall function 00007FF73AD46030: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD460A0
Part of subcall function 00007FF73AD46030: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD460B2

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD46156

Strings

HTTP, xrefs: 00007FF73AD460DA
NTLM, xrefs: 00007FF73AD4610E, 00007FF73AD461C0

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: aca89d71a1719aef2e7f177aa6a16ae667089ba8158daa7c0a326498ccca1476
Instruction ID: 19fb09e86805db0e09707b376bd88e8c1aff4dd34a4b3925d93dcc5fd283b096
Opcode Fuzzy Hash: aca89d71a1719aef2e7f177aa6a16ae667089ba8158daa7c0a326498ccca1476
Instruction Fuzzy Hash: 42616C3A628B8592EB60AF15E44126EB7A4FB88B84F944075DE8E43B6CDF3CD445DB10

Function 00007FF73AD4BAD5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BB18
memcpy.VCRUNTIME140 ref: 00007FF73AD4BB3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BC0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BC5F

Strings

TRUE, xrefs: 00007FF73AD4BC69

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 503df20941894dd05817090ea6110ecb8c0015b96493430b6075ddb7b97a7345
Instruction ID: 7ad8bee4b5f8503086c311603b7bade77978b378e9f952bad29f74779614162a
Opcode Fuzzy Hash: 503df20941894dd05817090ea6110ecb8c0015b96493430b6075ddb7b97a7345
Instruction Fuzzy Hash: CF419D29B2D6B111FF099A258556334AB52EB217E0F8446F1CA7E473CDDD6CD085E320

Function 00007FF73AD4F380 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF73AD4F340), ref: 00007FF73AD4F3EF

Part of subcall function 00007FF73AD296A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF73AD0C6CA,?,?,?,?,?,?,?,00007FF73AD0C497), ref: 00007FF73AD296B1

Part of subcall function 00007FF73AD296A0: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF73AD29853
Part of subcall function 00007FF73AD296A0: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF73AD29870

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF73AD4F340), ref: 00007FF73AD4F45E
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF73AD4F340), ref: 00007FF73AD4F478
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF73AD4F340), ref: 00007FF73AD4F4AE

Strings

xn--, xrefs: 00007FF73AD4F495

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: c79b631c925c8fed7e64f0654754f54019a6642498fb5314199a77bfbbff4ebe
Instruction ID: b8eb9d21a0f3412eefcd1fdd67ea11c308112bfd785de3fba82a7469530fcfd2
Opcode Fuzzy Hash: c79b631c925c8fed7e64f0654754f54019a6642498fb5314199a77bfbbff4ebe
Instruction Fuzzy Hash: A941B569B2D69265FA54BB259616379D281DF49FC0FC881B0DE0D8B7D9EE2CE0069320

Function 00007FF73AD1D470 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF73AD1D518
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1D598
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1D642

Strings

CONNECT phase completed!, xrefs: 00007FF73AD1D683
allocate connect buffer!, xrefs: 00007FF73AD1D5BF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 02122fb670f95e4680fa0b8412fc1b979c5b91a7cbdbfcd238f2d9e750053ce3
Instruction ID: 88173df69621501f4400b479802bd5443d7616acc9f9fe58f4ec136d0f9273d5
Opcode Fuzzy Hash: 02122fb670f95e4680fa0b8412fc1b979c5b91a7cbdbfcd238f2d9e750053ce3
Instruction Fuzzy Hash: A651F176B18A82A2FB98AB31D5453B9B790FB44B88F844175CB9C07298CF38E5A5D310

Function 00007FF73AD48FF3 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

GMT, xrefs: 00007FF73AD490AE
Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD49121

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: eacb30e3594ebde5f6590ea5a488e59deb89f246858472ac5d47ec3a8222ecce
Instruction ID: 423aad3155d53da07e3dc7f513f981a7fed36d4b1513581a545a232e11e27efa
Opcode Fuzzy Hash: eacb30e3594ebde5f6590ea5a488e59deb89f246858472ac5d47ec3a8222ecce
Instruction Fuzzy Hash: 74510A69A2D6E265FB20AB6695051B8FB95FB01780FC444F1CA8E07B9CCF3CE545D310

Function 00007FF73AD4ADE9 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AE2C
memcpy.VCRUNTIME140 ref: 00007FF73AD4AE52
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Strings

%s: %s, xrefs: 00007FF73AD4AF81

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: 33fe3cd53c052a8f52918f313d5978767c9ff85833e7f2896b176aac414e2e04
Instruction ID: d09155d4c19135c38ccf13ae0e09d0aace801c868fef4ac8e836e5677d8904fd
Opcode Fuzzy Hash: 33fe3cd53c052a8f52918f313d5978767c9ff85833e7f2896b176aac414e2e04
Instruction Fuzzy Hash: B5418059B1A2E115FB686A0550173B5E781EB01BE0F8442F9DE6F077EDDE1CD045A320

Function 00007FF73AD301F0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD29540: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73AD29561

memcpy.VCRUNTIME140 ref: 00007FF73AD30361
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD3036F

Strings

Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF73AD3032D
Failed to parse FETCH response., xrefs: 00007FF73AD3024E
Found %I64d bytes to download, xrefs: 00007FF73AD302C2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 4ae53719eda81be3619a15e5971cd4c86f31f99aa1279c2f122383002890b1e8
Instruction ID: 3d5110e970573126f36be395c9b6dd512a31ce0682c3e53de2007294c2c8ccf6
Opcode Fuzzy Hash: 4ae53719eda81be3619a15e5971cd4c86f31f99aa1279c2f122383002890b1e8
Instruction Fuzzy Hash: 1851036AA1CBC6A2FB14AF65E0012B9E390FB45B90F8480B1DB9C03A89DF7DE105D310

Function 00007FF73AD48F30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

GMT, xrefs: 00007FF73AD48F8C
Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD48FDF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 7536c33d4b664c36956b7512549dbe7af3e0457de8c3688253e52be0a1d78b24
Instruction ID: a4e94f204e21ef41febb3a1cf20bd4035b7c204ea0833657eae22f052c4927f4
Opcode Fuzzy Hash: 7536c33d4b664c36956b7512549dbe7af3e0457de8c3688253e52be0a1d78b24
Instruction Fuzzy Hash: AC318469A2DBD2A5FB20AB2194421F9F751FB01784FC844F2C64E166ADCF3CE545E320

Function 00007FF73AD49CBE Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 0ae7bc32dfde1e44976f247f69b262b3651234647b7ad7448afd5ca34fc4c152
Instruction ID: a40c135ed7bbaf2b9aeb5eb7492cea1759e7a80eef0aaf7406a42f51ca684e0c
Opcode Fuzzy Hash: 0ae7bc32dfde1e44976f247f69b262b3651234647b7ad7448afd5ca34fc4c152
Instruction Fuzzy Hash: 0221D42AB19AC295FB20DB26E4452E9B790FB49BD4F880172DE5D03799DF3CD101C710

Function 00007FF73AD33D30 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD33DFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD33E14
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD33E28

Strings

Failure sending QUIT command: %s, xrefs: 00007FF73AD33D83
QUIT, xrefs: 00007FF73AD33D5F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: a2dc73e1f7e223c13207ce6256c376ad950f39672d62e1f961c22585476f092a
Instruction ID: ba18663c0fd285b18321d2c9c8f57e83a3b20798b6e0fa511c4b9907cb39702f
Opcode Fuzzy Hash: a2dc73e1f7e223c13207ce6256c376ad950f39672d62e1f961c22585476f092a
Instruction Fuzzy Hash: 32319039B28782A1FB50EF25E5462B9B7A0FF45F84F8840B1DA4D07A99DF2CD045D321

Function 00007FF73AD2A930 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A965
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A97A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A98F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A9BC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A9C5
memcpy.VCRUNTIME140(?,?,?,00007FF73AD16D10), ref: 00007FF73AD2A9F9

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 0e05d63f43bc4aabd14c096ffe02587e52b5dd76bdd45876307a715eab033dfd
Instruction ID: fbf3ace9a02f6ec42476358bd41f34acefe1789ae6b4499b318852bdbb94b85f
Opcode Fuzzy Hash: 0e05d63f43bc4aabd14c096ffe02587e52b5dd76bdd45876307a715eab033dfd
Instruction Fuzzy Hash: 15210275A18B8696F710EF129411239B7A0FF49B90FC48271CA9D173A8EF3CD444D310

Function 00007FF73AD39BA0 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD39BD1
strchr.VCRUNTIME140 ref: 00007FF73AD39BFD
strchr.VCRUNTIME140 ref: 00007FF73AD39C14
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD39C33

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: 2fc5cf7da16eeb57b8c5a1c92921b51f7a5f6d48bfe00402c3925fb617c9476e
Instruction ID: ca761c4724801502e88f7519f2f8c643bb3782742ff9c2a31825fd424e6c5f02
Opcode Fuzzy Hash: 2fc5cf7da16eeb57b8c5a1c92921b51f7a5f6d48bfe00402c3925fb617c9476e
Instruction Fuzzy Hash: 27219D66A26B8581FF85DB2590523A9A3E0EB89B84F4C0174DE4E0B78CEF3DD490D320

Function 00007FF73AD49184 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD491BF
memcpy.VCRUNTIME140 ref: 00007FF73AD491E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 74d982c46b0fb71d9b9944cac7731b98f4219aa97643b58c5056d5cbc2121cbf
Instruction ID: 60863af05f9180fb57745cdaed73b0ca8192d64d90335ae41581c3df24019777
Opcode Fuzzy Hash: 74d982c46b0fb71d9b9944cac7731b98f4219aa97643b58c5056d5cbc2121cbf
Instruction Fuzzy Hash: 5921F49CA1D79225FE25AB2295052B4A791FF16BD4FC845B2CD1E077EDDF3CA0059320

Function 00007FF73AD49A58 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 9c76cbae48e3cc96b7d64792a01c02ff53c849fef6793e5b78573a6e3cb627b0
Instruction ID: 457553cbc4258754c95f886294703dec6b5854886bb185e0dadb84990a740611
Opcode Fuzzy Hash: 9c76cbae48e3cc96b7d64792a01c02ff53c849fef6793e5b78573a6e3cb627b0
Instruction Fuzzy Hash: 8921836AA1DA92A5FB60EB66E4452EAA350FB85784F8404B2DE4E0772DDF3CD041D710

Function 00007FF73AD49A96 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD4A5A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4A5EC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 01447bc762b5f057cc8802f27067c044a5880ce2bce5529b4648f1e552d4b95b
Instruction ID: d70c0118eb6f32d62a19e269a6d5acc13ae7c2f9eeedcf1640fdebf1261169d1
Opcode Fuzzy Hash: 01447bc762b5f057cc8802f27067c044a5880ce2bce5529b4648f1e552d4b95b
Instruction Fuzzy Hash: 9621566AA19A82A6FB60EB66E4452EAA350FF85784F840472DE4E0772DDF3CD045D710

Function 00007FF73AD49A70 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD4C0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4C0E5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49E99
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49ED9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49EEC

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Signature: %s, xrefs: 00007FF73AD49E87
Signature, xrefs: 00007FF73AD49E6F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: a7f44e3e96a7ad5015016feabe955c0d7dcfd0faaee6b7e82b2b5648de3ccba8
Instruction ID: 1dc6ddfd57cd4c8b64b123ab1c3b414da5513b336faa0a8206fe6f4e55d4e1ad
Opcode Fuzzy Hash: a7f44e3e96a7ad5015016feabe955c0d7dcfd0faaee6b7e82b2b5648de3ccba8
Instruction Fuzzy Hash: E621986AA19B82A5FB60EB66E4452EAA350FF857C4F840472DE4E0772DDF3CD005D710

Function 00007FF73AD049E0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF73AD04319), ref: 00007FF73AD04C7F

Strings

No data record of requested type, xrefs: 00007FF73AD04C63
Host not found, try again, xrefs: 00007FF73AD04C75
Host not found, xrefs: 00007FF73AD04C48
Unrecoverable error in call to nameserver, xrefs: 00007FF73AD04C6C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: fc3e0d2a966c5590e554ce929c9b04165eebd2722ea8005c66163da69181b5bf
Instruction ID: 822b110f39c3cb526b62ff52d85039ad07bb2c7a34990cf6b4480e3a7401a842
Opcode Fuzzy Hash: fc3e0d2a966c5590e554ce929c9b04165eebd2722ea8005c66163da69181b5bf
Instruction Fuzzy Hash: A7113AD9A2C24272FE5CE759E555678A250EF25740FCB80B0C60E07A5CCF6CE480A32A

Function 00007FF73AD0C9A0 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF73AD0CE43
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF73AD0CE57
CloseHandle.KERNEL32 ref: 00007FF73AD0CE64
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF73AD0CE86
closesocket.WS2_32 ref: 00007FF73AD0CEA4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF73AD0CEBD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 0c4de6103340c91aa5d79bf8c93c5b545b6861024ef3979e422a4b0b05426bbc
Instruction ID: e3a8e5fd707f92cfd0c496d0643a9f1167df7d281b7758d6510a9892181fdf52
Opcode Fuzzy Hash: 0c4de6103340c91aa5d79bf8c93c5b545b6861024ef3979e422a4b0b05426bbc
Instruction Fuzzy Hash: 96116A7EA18A41A6F720EF12E155229B370FB89B90F444075CF8E03B48CF39E4A4A720

Function 00007FF73AD4B50F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6D3
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4B74E

Strings

TRUE, xrefs: 00007FF73AD4B6AD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: ed558bd1317cd0217e9bf3e3aad0d43463dc720fdae0ee89c423ade7e9118a03
Instruction ID: 8840c42432ca6efd7f640c6d44e39acdb95bdd6b17b8c04809254e7cb39f917c
Opcode Fuzzy Hash: ed558bd1317cd0217e9bf3e3aad0d43463dc720fdae0ee89c423ade7e9118a03
Instruction Fuzzy Hash: 6A314A69A1C6A254FB01DB248455378BFA1EB21B94FC842F1CA9A42ACDDF2CD141D320

Function 00007FF73AD34330 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF73AD34382
accept.WS2_32 ref: 00007FF73AD343A1

Part of subcall function 00007FF73AD26A30: ioctlsocket.WS2_32 ref: 00007FF73AD26A49

Strings

Connection accepted from server, xrefs: 00007FF73AD343CF
Error accept()ing server connect, xrefs: 00007FF73AD343BE

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 62de29c2e25f6ebae38a3eaa55f6f9f7aab595138637e61e55fe0c510996d5b3
Instruction ID: 004d13c16bb8c0c54f1d4f30d9bb483667d0cbdd8c7919c4a69edc00ca7afdbf
Opcode Fuzzy Hash: 62de29c2e25f6ebae38a3eaa55f6f9f7aab595138637e61e55fe0c510996d5b3
Instruction Fuzzy Hash: D031D665A28A81A2FB54EB21E4453AEB390FB48BE4F844271DE6D077C9CF7DE105D710

Function 00007FF73AD25ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD25909), ref: 00007FF73AD25F5D

Strings

Rejected %zu bytes header (max is %d)!, xrefs: 00007FF73AD25EFB
Failed to alloc memory for big header!, xrefs: 00007FF73AD25F68

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: 9e01f8961ef5be40a1890896d528835c6e623e1d0a7c956b559c6d0c19572698
Instruction ID: 58b0b912c2c74a0cad7b31a47ccbdbb1da7e239b32a38bc1484f13cbcecd679a
Opcode Fuzzy Hash: 9e01f8961ef5be40a1890896d528835c6e623e1d0a7c956b559c6d0c19572698
Instruction Fuzzy Hash: BB218D36B18A8496EB04AB25E4412ADB7A1FB49FC4F844032EF4D07B59DF3CD4A1D700

Function 00007FF73AD060B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD06142
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0615E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0617B

Strings

:, xrefs: 00007FF73AD06136

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 27f373e76fe487eacdaf8c9d00deb372ed2a2e53d0d3cf8282777c8af0880508
Instruction ID: dca8ba4e31e5bcda2a8fe68cbc7bdf6378926012e49555279aa880f1c324218b
Opcode Fuzzy Hash: 27f373e76fe487eacdaf8c9d00deb372ed2a2e53d0d3cf8282777c8af0880508
Instruction Fuzzy Hash: 8E21AE3A608B8295FB61EF14A5413A9B7A0EB44B90FC84171CF9C43799EF3CD414A721

Function 00007FF73AD2FC80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

%s%s, xrefs: 00007FF73AD2FCB3
LIST "%s" *, xrefs: 00007FF73AD2FD07

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 948bbce8d14dfe89a09e90d542d3459616c12cbb4065bce92b9a4f3ea9b72cb0
Instruction ID: c53205bc5f2e9a1869192e6836aa9fded5d6066558ab291fba8688e4ee1866dd
Opcode Fuzzy Hash: 948bbce8d14dfe89a09e90d542d3459616c12cbb4065bce92b9a4f3ea9b72cb0
Instruction Fuzzy Hash: 9E11A229B28A46A1FB14EB55E4421B8A350EF48FC4FC84475DE0D0B75DDF2CE595E360

Function 00007FF73AD48F01 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD48F04
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 136e47e71169975f25c81fd149021705cba020a777d3ccb449e7d5a5ace93594
Instruction ID: 8618a039d4aa4a34edec7349e2eb663c6190b720bb3f5aaa3daf759384fdcc00
Opcode Fuzzy Hash: 136e47e71169975f25c81fd149021705cba020a777d3ccb449e7d5a5ace93594
Instruction Fuzzy Hash: 7501285DA1D7D235FB10A72254451F8B751EF02784FC844F1C50F0666ECF2CA044E321

Function 00007FF73AD23E30 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF73AD23E94
strchr.VCRUNTIME140 ref: 00007FF73AD23EA7
strchr.VCRUNTIME140 ref: 00007FF73AD23EB9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD23EEB
memcpy.VCRUNTIME140 ref: 00007FF73AD23F15

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: d9754526e8ec7729d08537bfd0fec0a7a66dea100b8898ab23bfcf2811e09562
Instruction ID: 7a10d799543ac218a056048726627187042ddaf126bd3573dcf9b4d2f30c40c7
Opcode Fuzzy Hash: d9754526e8ec7729d08537bfd0fec0a7a66dea100b8898ab23bfcf2811e09562
Instruction Fuzzy Hash: 30214819A2D69550FE49A71651122B8E7C1DF04BC4F8C41B1EE9C0BBCAEF1CD409D730

Function 00007FF73AD23340 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD23755), ref: 00007FF73AD23378
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD23755), ref: 00007FF73AD23381
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD23755), ref: 00007FF73AD233FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD23755), ref: 00007FF73AD2340B
memcpy.VCRUNTIME140(?,?,00000000,00007FF73AD23755), ref: 00007FF73AD23434

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 079045454393bd4436d714cab6de9035883289fe841c5bd94baab3580fbb733b
Instruction ID: 073e213d72a80cb2c32537e8c22363121c4305a1fb82c8bb463ce3c0ab4b16ed
Opcode Fuzzy Hash: 079045454393bd4436d714cab6de9035883289fe841c5bd94baab3580fbb733b
Instruction Fuzzy Hash: 8A317E3AA18B4991FB20AF12E441269E790EB45FE4F8452B1DE6D47BD8DF3CE541D310

Function 00007FF73AD46030 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46056
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46077
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD46092
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD460A0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD42AC5), ref: 00007FF73AD460B2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 918dd943ff8532622e0b077ffe73aa97a1a12716735c3b20e00f1d8ce67ee5b4
Instruction ID: 29cc7ed76ef02d37373de89d1b8fbc130ac114f272dd903d09c6dd526b9cc291
Opcode Fuzzy Hash: 918dd943ff8532622e0b077ffe73aa97a1a12716735c3b20e00f1d8ce67ee5b4
Instruction Fuzzy Hash: 7D11D33A628F4592EB04AF25E99113CB7A4FF94F88B8440B5CE9E07728CF38D895D350

Function 00007FF73AD4B94F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BC5F

Strings

TRUE, xrefs: 00007FF73AD4BC69
GMT, xrefs: 00007FF73AD4B9FE
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD4BA71

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: d706ce3eee7725947a570d34d782daa4728fafa7d37f5553dccaacf76f26a133
Instruction ID: 7187471da2aedd424143a415ee92cbc499044fdaf3485f6b3c3426c4f56f8955
Opcode Fuzzy Hash: d706ce3eee7725947a570d34d782daa4728fafa7d37f5553dccaacf76f26a133
Instruction Fuzzy Hash: FA512969B2C6A664FB119B24A506279FBA5EB21790FC480F2CA4D0379CCF3CE541D310

Function 00007FF73AD01C80 Relevance: 6.1, APIs: 4, Instructions: 131COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,0000000100000000,00007FF73AD01581,?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01DB5
memset.VCRUNTIME140(?,?,?,?,?,?,0000000100000000,00007FF73AD01581,?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01DBE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000000100000000,00007FF73AD01581,?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01DC3
_invalid_parameter_noinfo.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,0000000100000000,00007FF73AD01581,?,?,?,?,00000000,?,?,00007FF73AD018EF), ref: 00007FF73AD01DCF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfomemcpymemset
String ID:
API String ID: 187659361-0
Opcode ID: 1bc60ed9cbc554ddcf13200f1c4322be4e085bd72ef8049019ff1378857b2d41
Instruction ID: 8e783dd7a8fb80833e21a74d5eee40904778457c6a8e667e9d8dc973c39243fb
Opcode Fuzzy Hash: 1bc60ed9cbc554ddcf13200f1c4322be4e085bd72ef8049019ff1378857b2d41
Instruction Fuzzy Hash: 0A41157AB29A5192EB14EB1AA40557CF3A1FB84F80F958035EE1C83B88CF3DD4819721

Function 00007FF73AD4AC60 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Strings

GMT, xrefs: 00007FF73AD4AD1E
%s: %s, xrefs: 00007FF73AD4AF81
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF73AD4AD8A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: 13908b3e50d49d2d69390df7b3cbeadc92813e3a12137ca8b9e2b70f6f334e4b
Instruction ID: d927f35258afdd747c1b2d63043944549e077df7e81b96c708fa32c43931eefb
Opcode Fuzzy Hash: 13908b3e50d49d2d69390df7b3cbeadc92813e3a12137ca8b9e2b70f6f334e4b
Instruction Fuzzy Hash: D941D869A2CAA265FA619B11A5072B9E794FB41B90FC480F1DE8C0376CDF3CE445D710

Function 00007FF73ACFFBA0 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73ACFFCAF

Part of subcall function 00007FF73AD50FD4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF73ACF517E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF73ACF1A19), ref: 00007FF73AD50FEE

memcpy.VCRUNTIME140 ref: 00007FF73ACFFC9C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACFFD1D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACFFD2A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: f0e0b6e57dc9044e1787cda88c30a1aaab9991b858eb677f98df076c66d70e5f
Instruction ID: 4ba5608ec342fd4a93875404873b6fa147781a57c31d2c4f562ad71ccb444512
Opcode Fuzzy Hash: f0e0b6e57dc9044e1787cda88c30a1aaab9991b858eb677f98df076c66d70e5f
Instruction Fuzzy Hash: 6441DF66B16A8AA1FE14EF26D4552A8A360EB04BE0F948631DE6D077C8DF3CE091D350

Function 00007FF73AD4CA10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF73AD2FFC0,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF73AD4CA63
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4CAEC

Strings

%s, xrefs: 00007FF73AD4CA35

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: db79e29e0a8a6addec1acd2cfd9679d3c72370d78614f4c82530095888520be1
Instruction ID: d5785f709e5dbfd1039387fcec4ea9035cfae8b3c7fd1a2433cf57d474815a36
Opcode Fuzzy Hash: db79e29e0a8a6addec1acd2cfd9679d3c72370d78614f4c82530095888520be1
Instruction Fuzzy Hash: 5B41A436618B8592FB51DB2AF5451AAF3A0FB45B94F444174DF9E03BA9DF3CE0819310

Function 00007FF73ACF5AD0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF73ACF5BAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF73ACF5BEC
memcpy.VCRUNTIME140 ref: 00007FF73ACF5BF6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73ACF5C23

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 8cf4b4e336199e342cea90b092cf6a23320c781039690d49b146c6c16dc89e24
Instruction ID: 24bf94d748eb6df800508666e96cac52e8d4ff05091e1c7398a668ab5bd77289
Opcode Fuzzy Hash: 8cf4b4e336199e342cea90b092cf6a23320c781039690d49b146c6c16dc89e24
Instruction Fuzzy Hash: 0831086670A78A65FD14AB15A51526CE351FB04BE0F980770DF6D0B7CACF7CE051A310

Function 00007FF73AD37F6D Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD37FA4

Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179B5
Part of subcall function 00007FF73AD17890: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF73AD179D0

Strings

Wildcard - "%s" skipped by user, xrefs: 00007FF73AD3800D
%s%s, xrefs: 00007FF73AD37F74
Wildcard - START of "%s", xrefs: 00007FF73AD37FAD

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 23f949e1bac83c3977c68f5f7698d4e318435f3dbbb8aa99a60b1d5f21adfdac
Instruction ID: 5909ae6d08fd42da5fde9b70538ec112c633c07402dfbb002535849cf850b72d
Opcode Fuzzy Hash: 23f949e1bac83c3977c68f5f7698d4e318435f3dbbb8aa99a60b1d5f21adfdac
Instruction Fuzzy Hash: D041817AA18E82D0F710EF26E4451ADB3A0FB84B85F854072DE4D4B399DE3AD445D320

Function 00007FF73AD4ABA5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Strings

GMT, xrefs: 00007FF73AD4ABF9
%s: %s, xrefs: 00007FF73AD4AF81
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF73AD4AC49

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: acba063d456fd53cfbb1bc12989434ce91aea9a9303b6133fdc54564046a48c0
Instruction ID: ab37e6741f71fdc58b00443cb288c9751a35ff513554db03b779fcc032d54863
Opcode Fuzzy Hash: acba063d456fd53cfbb1bc12989434ce91aea9a9303b6133fdc54564046a48c0
Instruction Fuzzy Hash: 3331046AA1DB92A4FB60AB50E0066E9B3A1FB05780FC440F2DE4D0326DCF7CE549E310

Function 00007FF73AD4BADD Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BB18
memcpy.VCRUNTIME140 ref: 00007FF73AD4BB3E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4BC5F

Strings

TRUE, xrefs: 00007FF73AD4BC69

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: a6be11678876d8a0775db988cc1d43a9510aa85ed541163c077362283927d48a
Instruction ID: e208b11fc2f36ba6c317a1ff044cd18434862e44e273dd9f5441024a20a245b8
Opcode Fuzzy Hash: a6be11678876d8a0775db988cc1d43a9510aa85ed541163c077362283927d48a
Instruction Fuzzy Hash: 3821216AB1976610FF069B269515374A752FB25BE0F8885F2CD2D037CCEE3CE0819320

Function 00007FF73AD11FE0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032
memcpy.VCRUNTIME140 ref: 00007FF73AD1206D

Part of subcall function 00007FF73AD073C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD073D5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD120A2

Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD074F7
Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD07503

Strings

%s:, xrefs: 00007FF73AD1204C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: 6048c71ea6257bdc43a0bba89fc31871b9d5a1fd88ea2959e310517747b66f0b
Instruction ID: f91e6cc9a274f220024ebd845a1ab94b57a12ab607eee89099c272e455d2eb19
Opcode Fuzzy Hash: 6048c71ea6257bdc43a0bba89fc31871b9d5a1fd88ea2959e310517747b66f0b
Instruction Fuzzy Hash: CE21072AA18B85A1EB04DF12E84116AF3A4FB54FE4F880672DEAD073A9DF3CD441C350

Function 00007FF73AD4B2DA Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B2E1
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6D3
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4B6E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4B74E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: isupper$_strdupfree
String ID:
API String ID: 3359907120-0
Opcode ID: 0aae88a8b418aa0f19e41eaa1b69d34950181fec64235eaf72de8941643402e2
Instruction ID: 351444a2eb8cd996abdb0f8e49964d3c0c893bab57c20e261de4393b1c42417d
Opcode Fuzzy Hash: 0aae88a8b418aa0f19e41eaa1b69d34950181fec64235eaf72de8941643402e2
Instruction Fuzzy Hash: F221F759D2DAF265FB16EB248456338EFA0DB31B80FC845F1C58A05A99DF2C9541E330

Function 00007FF73AD4ADF1 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AE2C
memcpy.VCRUNTIME140 ref: 00007FF73AD4AE52
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Strings

%s: %s, xrefs: 00007FF73AD4AF81

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 58132a24d1db3b81fcdb7ee983368b60f5907245edec6adad14252c18534d2c4
Instruction ID: 0cd2d4253f538f15cd3160e8b95718905eadfbe72af39747164c060415a9cd82
Opcode Fuzzy Hash: 58132a24d1db3b81fcdb7ee983368b60f5907245edec6adad14252c18534d2c4
Instruction Fuzzy Hash: 31212699B1A79251FA65AB02A4023B5D391FF41FE0F8441B1DE6D03BE9EF3CD0459310

Function 00007FF73AD48E4A Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD49329

Strings

Start Date, xrefs: 00007FF73AD492FD
Start Date: %s, xrefs: 00007FF73AD49317
%s%lx, xrefs: 00007FF73AD48EA5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: a5497cacc0ead59f75fb1d1f7df1ac04cce61eb46eeb04d54d005a90402780e0
Instruction ID: 6c7ea458e6796344606db00df0d1bcd5cfa9d6044988d44a6b7784113e7b3afb
Opcode Fuzzy Hash: a5497cacc0ead59f75fb1d1f7df1ac04cce61eb46eeb04d54d005a90402780e0
Instruction Fuzzy Hash: C621B85DB2D6A265FE20B72594552B9B752EF067C4FC484F1CA0E0769EDF2DE004E320

Function 00007FF73AD1B07D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AE95
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AEAF

Strings

I32, xrefs: 00007FF73AD1AE85
I64, xrefs: 00007FF73AD1AEA5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 5ac4aff93cd9173e0b3c8dc82fc01bb30f4ddb3efa4cc0dcc3832ea56ba46bb6
Instruction ID: 7f76d1e075e32b5908076b11f0b1447c384931844fd388edf0744867d7c5a6f3
Opcode Fuzzy Hash: 5ac4aff93cd9173e0b3c8dc82fc01bb30f4ddb3efa4cc0dcc3832ea56ba46bb6
Instruction Fuzzy Hash: 7C21262AA1C55261FB65AB30D4517B8BF94DB09F88F8981B0DE69422D9DF1CE604E370

Function 00007FF73AD44ED0 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD45C39,00000000,?,?,00007FF73AD451F6), ref: 00007FF73AD44EF9
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD45C39,00000000,?,?,00007FF73AD451F6), ref: 00007FF73AD44F30
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD45C39,00000000,?,?,00007FF73AD451F6), ref: 00007FF73AD44F42
memcpy.VCRUNTIME140(?,?,?,00007FF73AD45C39,00000000,?,?,00007FF73AD451F6), ref: 00007FF73AD44F6A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: 409fb63f1dbabc7059c14c7ad51cbb97c6bd1d57c9e6da3c0836238f48eb24ee
Instruction ID: 5986fd8975da59c37bd0ffd2b490e9f4746d5dba335abf2fa9298a9fd6b92c7b
Opcode Fuzzy Hash: 409fb63f1dbabc7059c14c7ad51cbb97c6bd1d57c9e6da3c0836238f48eb24ee
Instruction Fuzzy Hash: 45215E7661AF8182EB44DF15E051229A3A0FB98FD8B888471EE5E4775DEF3CD492C710

Function 00007FF73AD2DCE0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD08
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD2E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD4F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD12259,?,?,?,?,00007FF73AD115FB), ref: 00007FF73AD2DD60

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 2f21f6e09c1fe2ecdb4125b404c2cd2583ae5b5b32c867e8dc97f938a78dfa98
Instruction ID: 592ac80c2b72e4489ee6ba8fb0fb34d19be32f438f528e63c15731dcd74fb423
Opcode Fuzzy Hash: 2f21f6e09c1fe2ecdb4125b404c2cd2583ae5b5b32c867e8dc97f938a78dfa98
Instruction Fuzzy Hash: 60110624B2CF4652FB21AB12684123AE291FF48FC0F984174DD8D43B5CDE3CE441A750

Function 00007FF73AD4F0C0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF73AD4F0FD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4F10D
WideCharToMultiByte.KERNEL32 ref: 00007FF73AD4F13C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4F149

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 576d94c567ea143205d5456bfd911414481cb44b69333d7e16038638280f938f
Instruction ID: 30d220c4131d3d7b8e5e51233c1c97b08c130d313b542608458b05a4774e16d7
Opcode Fuzzy Hash: 576d94c567ea143205d5456bfd911414481cb44b69333d7e16038638280f938f
Instruction Fuzzy Hash: EE115B39B19B4196F710AF66F801139BBA1FB88FC0B888078DB4D47B28DF38E5419750

Function 00007FF73AD4F2F0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4F316
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4F327
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4F356

Part of subcall function 00007FF73AD4F380: strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF73AD4F340), ref: 00007FF73AD4F3EF

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4F34D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 8f8c9b388968d59187acbf13e01ce192fc2d1f278f42d39f6c3032117d50db66
Instruction ID: af142cb17d4f30a4fe9c09c8df29977cd7aac6bd396b99aa7af07ee398925ebc
Opcode Fuzzy Hash: 8f8c9b388968d59187acbf13e01ce192fc2d1f278f42d39f6c3032117d50db66
Instruction Fuzzy Hash: 4A01C059B2DB9152FF6DAB16614A03C9390EF48FC0F8C40B0D95E4ABACDE1CD8899324

Function 00007FF73AD0CED0 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF73AD0CE82,?,?,?,00000000), ref: 00007FF73AD0CEE1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CE82,?,?,?,00000000), ref: 00007FF73AD0CEEA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD0CE82,?,?,?,00000000), ref: 00007FF73AD0CEF4
closesocket.WS2_32 ref: 00007FF73AD0CF12

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 9317843b204cf3aa27de858c7ce3ba9428558499e938221aca4af4a76e8cca6e
Instruction ID: 85864b063378980c118816c7393b1098a7f78e36b4dc34d83a82687c641d7b99
Opcode Fuzzy Hash: 9317843b204cf3aa27de858c7ce3ba9428558499e938221aca4af4a76e8cca6e
Instruction Fuzzy Hash: 7A015E16D29B8293FB04EF31C8251786320FFE9F2CB416375EE6D011E99F68A5D48211

Function 00007FF73AD1AF6A Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AE95
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AEAF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1AEF2

Strings

I32, xrefs: 00007FF73AD1AE85
I64, xrefs: 00007FF73AD1AEA5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: bfd9abe20c2194c7a547db7db60806149fd282d46a3ca008b148d2aa09f63ad8
Instruction ID: cb58c083f9b4a81c7363ffd6acebc75428e1948cccd80015d80d1cde307d88c8
Opcode Fuzzy Hash: bfd9abe20c2194c7a547db7db60806149fd282d46a3ca008b148d2aa09f63ad8
Instruction Fuzzy Hash: 12F0E91D72C54261FA15A735D891A74AF94DF05BA4F884175CD19412A8CF1CE200E330

Function 00007FF73AD1AF72 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AE95
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF73AD1AD48), ref: 00007FF73AD1AEAF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1AEF2

Strings

I32, xrefs: 00007FF73AD1AE85
I64, xrefs: 00007FF73AD1AEA5

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a20af989950f38f715416b43359656774cb27ca6125a4bd3b80a2c9c98538dc9
Instruction ID: e5d74ec8ab0a067569cf129b0d8b3a35f9fe9cdfe2af018ebd175d8d0147fdf0
Opcode Fuzzy Hash: a20af989950f38f715416b43359656774cb27ca6125a4bd3b80a2c9c98538dc9
Instruction Fuzzy Hash: 70F0E91D72854261FB15A735D891A75AF95DF05BA4F884175CD29412A8CF1CE200E330

Function 00007FF73AD42F60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF73AD18316), ref: 00007FF73AD42F74

Strings

%lx, xrefs: 00007FF73AD4325A

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: b3576095e6cbe19f00c1db53c3d3bf63dcd0032912793789c90c2e776903a214
Instruction ID: 37774deb4b53135c7853558b79d1541700458029a554c15767ab9ef76b2aa314
Opcode Fuzzy Hash: b3576095e6cbe19f00c1db53c3d3bf63dcd0032912793789c90c2e776903a214
Instruction Fuzzy Hash: 5F81BF26A2C1E155FB689728945123DFBD0FB85350FD442B6EAAF42AC8DE3CD440DB20

Function 00007FF73AD2EC80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF73AD2E663), ref: 00007FF73AD2ED52
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF73AD2E663), ref: 00007FF73AD2EDA3

Strings

(){ %*], xrefs: 00007FF73AD2EC9D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: 2c64296991aafd75ce64477886228899d052147cf239b4c66f338c7503e8426a
Instruction ID: 0a3a0dbe0378e838208701342ac3a3dbbddb46faeac7cff90238577bc79976d2
Opcode Fuzzy Hash: 2c64296991aafd75ce64477886228899d052147cf239b4c66f338c7503e8426a
Instruction Fuzzy Hash: 5831581992C68EA4FF616B159052378AFC1DF9AF54FC841F1D98E033CECE2DA905E220

Function 00007FF73AD404FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD405F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD40657

Strings

%ld, xrefs: 00007FF73AD4052C

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: 6fb6ba93543ac036398a7cf10b57c335e5774396d2bb3bf3bb3699da90a5cc20
Instruction ID: 2a19f13816ca5b8b54235dddcda504c2dfd00344ce22162c1590b59c036d80e8
Opcode Fuzzy Hash: 6fb6ba93543ac036398a7cf10b57c335e5774396d2bb3bf3bb3699da90a5cc20
Instruction Fuzzy Hash: D531C82AA1DA5252FB65EB54B162379A3A0EF84754F8800F1DE4E03699EF3CE445E720

Function 00007FF73AD1C420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1C499
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD1C532

Strings

identity, xrefs: 00007FF73AD1C454, 00007FF73AD1C4C3, 00007FF73AD1C52B

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: e3f824e5db481aaec559bdcc1b8a4c7e670b803b2b684f634ec680f15ffb3f4f
Instruction ID: 64e3ac55f6bdd1d8256094467c728da07171cd3e77e2afa490dd2cf2012fec8f
Opcode Fuzzy Hash: e3f824e5db481aaec559bdcc1b8a4c7e670b803b2b684f634ec680f15ffb3f4f
Instruction Fuzzy Hash: 1F31D269F19A46A1FB41AB25D446379E7A0EF45BE8F8852B1CE2D0339CDF2CE4419320

Function 00007FF73AD1AA90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1AAB0
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD1AB0B

Strings

, xrefs: 00007FF73AD1AAC3

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: 99e95ef9c0d79bada1b492d3325eacd8281b78ea4f026bfdb2577ecddf15ecfd
Instruction ID: ab886d71723197b39f3b1e1d33c4da46ef22c97ca45e86538c0034c13f2f5813
Opcode Fuzzy Hash: 99e95ef9c0d79bada1b492d3325eacd8281b78ea4f026bfdb2577ecddf15ecfd
Instruction Fuzzy Hash: 3511B176619B8181EB849F25F15022DB7A1FB08FD4F889176DA5E0779CEF38D990C350

Function 00007FF73AD18DB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF73AD18E2F
setsockopt.WS2_32 ref: 00007FF73AD18E5E

Strings

@, xrefs: 00007FF73AD18DBF

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 43af713e43ee33898e78cbb97f9ead40aeb9bb65a7c03a8105035dbe704cbb1e
Instruction ID: ca102d3379323458ca96ee203222dd8de1638340e270568fd643acc48e5d4790
Opcode Fuzzy Hash: 43af713e43ee33898e78cbb97f9ead40aeb9bb65a7c03a8105035dbe704cbb1e
Instruction Fuzzy Hash: 0F11AB7961864296F750DF10E44666AF7A0FB80348FD404B0DA4947B98DB7ED548DB10

Function 00007FF73AD0A2C0 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0A58A
memcpy.VCRUNTIME140 ref: 00007FF73AD0A6BC
memcpy.VCRUNTIME140 ref: 00007FF73AD0A6D8

Part of subcall function 00007FF73AD1FB70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD08493,?,?,00000000,00007FF73AD12D62,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD1FBAC

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: freememcpy
String ID:
API String ID: 3223336191-0
Opcode ID: e28d7ab1a66bd1c441e12a284493ed169fd3e96c034aafa9e4a13bcc798a2788
Instruction ID: 39b442b3883c37d9864e5a2155cd3c41425536439dd8df3e0f300aac45d3e767
Opcode Fuzzy Hash: e28d7ab1a66bd1c441e12a284493ed169fd3e96c034aafa9e4a13bcc798a2788
Instruction Fuzzy Hash: 7CC18D7AB24A029AFB14EB65D0012AC73B1FB49BA8F804275CE2D577D8DF38D40AD351

Function 00007FF73AD4AB78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF73AD4AB7F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD4AF96

Part of subcall function 00007FF73AD11FE0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD12032

Strings

%s: %s, xrefs: 00007FF73AD4AF81

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: 4fdb4a16937e58a4216fd58d0ba080712087579a3b19316dd641c9686de44ad4
Instruction ID: ad1b782bd70d98a9a83db3733746531881a4f80e154a1b368f02d1c632297e10
Opcode Fuzzy Hash: 4fdb4a16937e58a4216fd58d0ba080712087579a3b19316dd641c9686de44ad4
Instruction Fuzzy Hash: 82F08199A1DB9161FA65A712B4027E59350EB45BD0FC844B1DE4D0376A9F2CD185A320

Function 00007FF73AD4F010 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73AD42148), ref: 00007FF73AD4F041
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF73AD42148), ref: 00007FF73AD4F054
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73AD42148), ref: 00007FF73AD4F07B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF73AD42148), ref: 00007FF73AD4F088

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 183133224f0a0fd6c7434f8f6492c773fce796329d67c77eef161969da384f5b
Instruction ID: 71f586246fd182a326b50d70d1da5dd11125bd1ff3efbf37216304e255a00dd3
Opcode Fuzzy Hash: 183133224f0a0fd6c7434f8f6492c773fce796329d67c77eef161969da384f5b
Instruction Fuzzy Hash: 3E119136B28B5293FB209B1AF41112AABA0FF89B94B884275DB5C47B68DF3CD4409710

Function 00007FF73AD0D9A0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD074F7
Part of subcall function 00007FF73AD074D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD11AD0,?,?,?,?,?,?,?,?,?,?,00000000,00007FF73AD03901), ref: 00007FF73AD07503

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD0D9F4
memset.VCRUNTIME140 ref: 00007FF73AD0DA2F

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 999e9f889ad85bc3c8658c339eaac5db47bbd93aea279649c0d8283c2b411533
Instruction ID: 14fef5e02aba62ae47ba9bfeb511dae7d84d3718d1fc7e4ab97f203dd7ddb10d
Opcode Fuzzy Hash: 999e9f889ad85bc3c8658c339eaac5db47bbd93aea279649c0d8283c2b411533
Instruction Fuzzy Hash: 16210C36E28B81A3E704DB22D6412A8A760F799744F519236EB9C43A65DF74F1F5C300

Function 00007FF73AD4CBB0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD2EA33), ref: 00007FF73AD4FB46
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD2EA33), ref: 00007FF73AD4FB65
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD2EA33), ref: 00007FF73AD4FB7F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF73AD2EA33), ref: 00007FF73AD4FB8D

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2a76ef7fa5bd881fc1f4ad6f33c99be355a1e82a0e01096d0ea61af40f1052e5
Instruction ID: eebb9334a430f5a42b793ea563d66e52a9893e3150690ab0ca24d8cf96fdcce3
Opcode Fuzzy Hash: 2a76ef7fa5bd881fc1f4ad6f33c99be355a1e82a0e01096d0ea61af40f1052e5
Instruction Fuzzy Hash: 1A11283AA28B4192FB14AF25E89523CA7A4FF94F84F9440B1CA5E03768CE3CD894D311

Function 00007FF73AD349A0 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD349D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD349FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34A1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF73AD34A2E

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 93d07097a9f8805a64ec638d08541beec57b625efa615f68170694a84fdea58f
Instruction ID: 5663e2eeb55d04c324055e42c24bda2941223346a865fca68494968f657e236d
Opcode Fuzzy Hash: 93d07097a9f8805a64ec638d08541beec57b625efa615f68170694a84fdea58f
Instruction Fuzzy Hash: 17113D3A614B40D6E7409F25E580268B3A4F784F44F884075DF8E57328CF38E895D360

Function 00007FF73AD43F80 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD1A1A5,?,?,00000000,00007FF73AD12E61,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD43F90
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD1A1A5,?,?,00000000,00007FF73AD12E61,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD43FB6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD1A1A5,?,?,00000000,00007FF73AD12E61,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD43FC4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF73AD1A1A5,?,?,00000000,00007FF73AD12E61,?,?,00000000,00007FF73AD13395), ref: 00007FF73AD43FD2

Memory Dump Source

Source File: 00000000.00000002.1590038465.00007FF73ACF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73ACF0000, based on PE: true

Associated: 00000000.00000002.1589989121.00007FF73ACF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590075559.00007FF73AD53000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590098816.00007FF73AD6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590156032.00007FF73AD6C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73acf0000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4c9238fcdfe54545355688457451ffa8a4c98b9a5698b4f9ff7576b26b05f1e3
Instruction ID: 154769a317c8f24285568ccc7be9a77c4f65e0d5fea11fb5a77f33258330cf72
Opcode Fuzzy Hash: 4c9238fcdfe54545355688457451ffa8a4c98b9a5698b4f9ff7576b26b05f1e3
Instruction Fuzzy Hash: 14F0EC3A614F0192EB04AF25E995028B7B4FF98F887954171CE9D43778CF38C4A5C350

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_9bcc7898be1d4f9191567bd4d21a8cc341545d_d57ade92_b850ab27-e49f-4e0e-82ff-71445e2a72d7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4798.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4883.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48C3.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
SecuriteInfo.com.Win64.DropperX-gen.18606.18356.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre