Edit tour

Windows Analysis Report
CCuITQzvd4.exe

Overview

General Information

Sample name:	CCuITQzvd4.exe renamed because original name is a hash value
Original sample name:	06833640b01d9b8dcbc8001f0ff1cbc3aaa4ba1d45e08238c076b0d0d477c966.exe
Analysis ID:	1565143
MD5:	197de30a59fc9af28d140cc2c530c8b7
SHA1:	bc3be4bcbf7066ef83fc1da055dbc14429fcdeff
SHA256:	06833640b01d9b8dcbc8001f0ff1cbc3aaa4ba1d45e08238c076b0d0d477c966
Tags:	exevirustotal-vm-blacklistuser-JAMESWT_MHT
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Hides threads from debuggers

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (window names)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

CCuITQzvd4.exe (PID: 1912 cmdline: "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5: 197DE30A59FC9AF28D140CC2C530C8B7)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3800 cmdline: C:\Windows\system32\cmd.exe /c color 4 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 4896 cmdline: C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 | find /i /v "md5" | find /i /v "certutil" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

certutil.exe (PID: 3856 cmdline: certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 MD5: F17616EC0522FC5633151F7CAA278CAA)

find.exe (PID: 5936 cmdline: find /i /v "md5" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

find.exe (PID: 1112 cmdline: find /i /v "certutil" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4904 cmdline: C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6684 cmdline: cmd /C "color b && title Error && echo SSL connect error && timeout /t 5" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3532 cmdline: timeout /t 5 MD5: 100065E21CFBBDE57CBA2838921F84D6)

WerFault.exe (PID: 3536 cmdline: C:\Windows\system32\WerFault.exe -u -p 1912 -s 2148 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T10:57:10.751419+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49714	185.199.108.133	443	TCP
2024-11-29T10:57:12.475813+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49716	185.199.108.133	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: CCuITQzvd4.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CCuITQzvd4.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419A13D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF7C419A13D
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419C1F0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF7C419C1F0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419C240 CryptHashData,	0_2_00007FF7C419C240
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419C250 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C419C250
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41B62E0 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7C41B62E0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4199430 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF7C4199430
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4199500 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C4199500
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BCD30 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7C41BCD30
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BEE20 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C41BEE20
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41B59C0 CertOpenStore,GetLastError,CertCreateCertificateChainuser,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainuser,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7C41B59C0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF7C4180100
Source: CCuITQzvd4.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7C41A8B30

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.6:49722 version: TLS 1.2

Source: CCuITQzvd4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\mario\Desktop\Axiom Free temp\x64\Release\kr perm spoofer.pdb source: CCuITQzvd4.exe
Source:	Binary string: C:\Users\xxxxx\xxxxxxxx\xxxxxxx\xxxxxxxxxxxxxx\xxxxxx\xxxxxx\xxxxx\xxx\xxxxxxx.pdb source: CCuITQzvd4.exe
Source:	Binary string: river\Driver\build\bin\Premium.pdb source: CCuITQzvd4.exe, 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\nicov\OneDrive\Desktop\Spoofer Source\Driver\Driver\build\bin\Premium.pdb source: CCuITQzvd4.exe
Source:	Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: CCuITQzvd4.exe

Source: Joe Sandbox View	IP Address: 104.26.1.5 104.26.1.5
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49716 -> 185.199.108.133:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49714 -> 185.199.108.133:443

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1User-Agent: Mozilla/5.0Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1User-Agent: Mozilla/5.0Host: raw.githubusercontent.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4176DF0 malloc,recv,free,

0_2_00007FF7C4176DF0

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1User-Agent: Mozilla/5.0Host: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1User-Agent: Mozilla/5.0Host: raw.githubusercontent.com

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: keyauth.win

Source: CCuITQzvd4.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: CCuITQzvd4.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: CCuITQzvd4.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: CCuITQzvd4.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: CCuITQzvd4.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: CCuITQzvd4.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: CCuITQzvd4.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: CCuITQzvd4.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: CCuITQzvd4.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: CCuITQzvd4.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: CCuITQzvd4.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: CCuITQzvd4.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: CCuITQzvd4.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: CCuITQzvd4.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: CCuITQzvd4.exe, 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://discord.gg/jGguvU29
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/72
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/N2A
Source: CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/%w
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txtC
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txtU
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579476000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt/%
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt=ke
Source: CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtC%M
Source: CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtWk
Source: CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtk%e
Source: CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txttxtG
Source: CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtw%Y
Source: CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ot
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Xw
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/rosoft
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/uw3
Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/y
Source: CCuITQzvd4.exe	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.5:443 -> 192.168.2.6:49722 version: TLS 1.2

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41BCD30 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7C41BCD30

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4151550 GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,CloseHandle,	0_2_00007FF7C4151550
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4151230 GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,	0_2_00007FF7C4151230
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C414C440 LoadLibraryA,GetProcAddress,GetCurrentThreadId,OpenThread,NtSetInformationThread,	0_2_00007FF7C414C440
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4150E40 GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,	0_2_00007FF7C4150E40
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415B7F0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,GetCurrentProcessId,VirtualFree,memset,DeviceIoControl,VirtualFree,	0_2_00007FF7C415B7F0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41603C0 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,VirtualFree,_stricmp,VirtualFree,VirtualFree,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C41603C0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C415C670: _invalid_parameter_noinfo_noreturn,memset,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,DeviceIoControl,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C415C670

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4154680	0_2_00007FF7C4154680
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C414C660	0_2_00007FF7C414C660
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41426B0	0_2_00007FF7C41426B0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41536E0	0_2_00007FF7C41536E0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C416B7F9	0_2_00007FF7C416B7F9
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41558F0	0_2_00007FF7C41558F0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41878F0	0_2_00007FF7C41878F0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4150320	0_2_00007FF7C4150320
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4145330	0_2_00007FF7C4145330
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4156D82	0_2_00007FF7C4156D82
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C416CDC0	0_2_00007FF7C416CDC0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4151DA0	0_2_00007FF7C4151DA0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4153EC0	0_2_00007FF7C4153EC0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4168EF0	0_2_00007FF7C4168EF0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4150A00	0_2_00007FF7C4150A00
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4143C10	0_2_00007FF7C4143C10
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4168C40	0_2_00007FF7C4168C40
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4188C30	0_2_00007FF7C4188C30
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41A9550	0_2_00007FF7C41A9550
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415A520	0_2_00007FF7C415A520
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4169580	0_2_00007FF7C4169580
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419C600	0_2_00007FF7C419C600
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4145600	0_2_00007FF7C4145600
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41955E0	0_2_00007FF7C41955E0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4152620	0_2_00007FF7C4152620
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4181620	0_2_00007FF7C4181620
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415C670	0_2_00007FF7C415C670
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C418A6B0	0_2_00007FF7C418A6B0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C418F790	0_2_00007FF7C418F790
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415B7F0	0_2_00007FF7C415B7F0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4189850	0_2_00007FF7C4189850
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C416A890	0_2_00007FF7C416A890
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41478A0	0_2_00007FF7C41478A0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419A13D	0_2_00007FF7C419A13D
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C416E120	0_2_00007FF7C416E120
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4147190	0_2_00007FF7C4147190
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41641F8	0_2_00007FF7C41641F8
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419A205	0_2_00007FF7C419A205
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C419A1FC	0_2_00007FF7C419A1FC
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41AD250	0_2_00007FF7C41AD250
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41552CA	0_2_00007FF7C41552CA
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41642F8	0_2_00007FF7C41642F8
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4184350	0_2_00007FF7C4184350
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41603C0	0_2_00007FF7C41603C0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41B0470	0_2_00007FF7C41B0470
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41B14A0	0_2_00007FF7C41B14A0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415B4B0	0_2_00007FF7C415B4B0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41654DE	0_2_00007FF7C41654DE
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BCD30	0_2_00007FF7C41BCD30
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BEDB0	0_2_00007FF7C41BEDB0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4152E80	0_2_00007FF7C4152E80
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4197EC0	0_2_00007FF7C4197EC0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C414BEA0	0_2_00007FF7C414BEA0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4148FD0	0_2_00007FF7C4148FD0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41B59C0	0_2_00007FF7C41B59C0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41799B0	0_2_00007FF7C41799B0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C415A9E0	0_2_00007FF7C415A9E0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41A4A20	0_2_00007FF7C41A4A20
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4192A90	0_2_00007FF7C4192A90
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4146A90	0_2_00007FF7C4146A90
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4169AE0	0_2_00007FF7C4169AE0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4145BD0	0_2_00007FF7C4145BD0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4141CD0	0_2_00007FF7C4141CD0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4181260 appears 70 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C41C039A appears 48 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4175260 appears 36 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4186A60 appears 322 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4172600 appears 49 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4189D40 appears 34 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C41868E0 appears 379 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4189BD0 appears 37 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4175190 appears 46 times
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: String function: 00007FF7C4189C60 appears 33 times

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1912 -s 2148

Source: CCuITQzvd4.exe, 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiQVW64.SYSH vs CCuITQzvd4.exe
Source: CCuITQzvd4.exe, 00000000.00000000.2147613457.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameiQVW64.SYSH vs CCuITQzvd4.exe
Source: CCuITQzvd4.exe	Binary or memory string: OriginalFilenameiQVW64.SYSH vs CCuITQzvd4.exe

Source: CCuITQzvd4.exe

Binary string: \Device\Nal

Source: classification engine

Classification label: mal68.evad.winEXE@20/2@2/3

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41710A0 GetLastError,_errno,FormatMessageA,strchr,strncpy,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF7C41710A0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C414C660 memset,CreateToolhelp32Snapshot,memset,Process32FirstW,_wcsicmp,Process32NextW,CloseHandle,

0_2_00007FF7C414C660

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\pc_name_list[1].txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3940:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_03

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\daa6e9dc-9d30-4881-9718-2f421141ac8c

Jump to behavior

Source: CCuITQzvd4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CCuITQzvd4.exe

ReversingLabs: Detection: 55%

Source: CCuITQzvd4.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory

Source: unknown	Process created: C:\Users\user\Desktop\CCuITQzvd4.exe "C:\Users\user\Desktop\CCuITQzvd4.exe"
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c color 4
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1912 -s 2148
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c color 4	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CCuITQzvd4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CCuITQzvd4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: CCuITQzvd4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: CCuITQzvd4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\mario\Desktop\Axiom Free temp\x64\Release\kr perm spoofer.pdb source: CCuITQzvd4.exe
Source:	Binary string: C:\Users\xxxxx\xxxxxxxx\xxxxxxx\xxxxxxxxxxxxxx\xxxxxx\xxxxxx\xxxxx\xxx\xxxxxxx.pdb source: CCuITQzvd4.exe
Source:	Binary string: river\Driver\build\bin\Premium.pdb source: CCuITQzvd4.exe, 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\nicov\OneDrive\Desktop\Spoofer Source\Driver\Driver\build\bin\Premium.pdb source: CCuITQzvd4.exe
Source:	Binary string: c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb source: CCuITQzvd4.exe

Source: CCuITQzvd4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: CCuITQzvd4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: CCuITQzvd4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: CCuITQzvd4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: CCuITQzvd4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4189530 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7C4189530

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4176529 push qword ptr [rdx+rdi*2-01h]; ret

0_2_00007FF7C417652E

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4150A00 GetModuleHandleA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,GetCurrentProcessId,_local_unwind,OpenProcess,_local_unwind,ReadProcessMemory,_local_unwind,CloseHandle,Process32NextW,CloseHandle,

0_2_00007FF7C4150A00

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

API coverage: 6.5 %

Source: C:\Windows\System32\timeout.exe TID: 5720

Thread sleep count: 36 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579476000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4151B30 CheckRemoteDebuggerPresent,

0_2_00007FF7C4151B30

Hides threads from debuggers

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Open window title or class name: ollydbg - [cpu]

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	File opened: TRW
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41C0228 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7C41C0228

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41C0228 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7C41C0228

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

0_2_00007FF7C4150A00

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C4189530 GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,

0_2_00007FF7C4189530

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BF504 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7C41BF504
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BFE08 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C41BFE08
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41BFFB0 SetUnhandledExceptionFilter,	0_2_00007FF7C41BFFB0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c color 4	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"	Jump to behavior
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior

Source: CCuITQzvd4.exe	Binary or memory string: nonceSET_ACTIVITYargspidactivitystatedetailstimestampsstartendassetslarge_imagelarge_textsmall_imagesmall_textpartyidsizesecretsmatchjoinspectateinstancevclient_idSUBSCRIBEUNSUBSCRIBEuuuuuuuubtnufruuuuuuuuuuuuuuuuuu"\0123456789ABCDEF00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899Unknown exceptionbad array new lengthstring too longbad castkernel32.dllShell_TrayWndntdll.dll\\.\EXTREM\\.\ICEEXT\\.\NDBGMSG.VXD\\.\RING0\\.\SIWVID\\.\SYSER\\.\SYSERBOOT
Source: CCuITQzvd4.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41C0020 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7C41C0020

Source: C:\Users\user\Desktop\CCuITQzvd4.exe

Code function: 0_2_00007FF7C41558F0 _beginthreadex,_Thrd_detach,GetUserNameA,GetUserNameA,GetStdHandle,GetConsoleCursorInfo,GetStdHandle,SetConsoleCursorInfo,_beginthreadex,_Thrd_detach,GetConsoleWindow,GetConsoleScreenBufferInfo,GetConsoleWindow,SetConsoleScreenBufferSize,?_Throw_Cpp_error@std@@YAXH@Z,?_Throw_Cpp_error@std@@YAXH@Z,?_Throw_Cpp_error@std@@YAXH@Z,?_Throw_Cpp_error@std@@YAXH@Z,

0_2_00007FF7C41558F0

Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C4194C60 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF7C4194C60
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41AB554 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7C41AB554
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41885A0 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF7C41885A0
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41AB780 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7C41AB780
Source: C:\Users\user\Desktop\CCuITQzvd4.exe	Code function: 0_2_00007FF7C41A4A20 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memmove,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7C41A4A20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	23 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	351 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CCuITQzvd4.exe	55%	ReversingLabs	Win64.Trojan.Generic
CCuITQzvd4.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.1.5	true	false		high
raw.githubusercontent.com	185.199.108.133	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://raw.githubusercontent.com/rosoft	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/Ot	CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sectigo.com/CPS0	CCuITQzvd4.exe	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	CCuITQzvd4.exe	false	high
http://ocsp.sectigo.com0	CCuITQzvd4.exe	false	high
http://ocsp.thawte.com0	CCuITQzvd4.exe	false	high
https://keyauth.win/api/1.2/N2A	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	CCuITQzvd4.exe	false	high
https://raw.githubusercontent.com/y	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	false	high
https://keyauth.win/api/1.2/72	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txtU	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579451000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	CCuITQzvd4.exe	false	high
https://discord.gg/jGguvU29	CCuITQzvd4.exe, 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtWk	CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://curl.haxx.se/docs/http-cookies.html	CCuITQzvd4.exe	false	high
https://curl.haxx.se/docs/http-cookies.html#	CCuITQzvd4.exe	false	high
https://raw.githubusercontent.com/	CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579461000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/uw3	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txtC	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	CCuITQzvd4.exe	false	high
http://crl.thawte.com/ThawteTimestampingCA.crl0	CCuITQzvd4.exe	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt=ke	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/Xw	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/%w	CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt/%	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579476000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtC%M	CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtk%e	CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txtw%Y	CCuITQzvd4.exe, 00000000.00000003.2190127888.000001D579476000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txttxtG	CCuITQzvd4.exe, 00000000.00000003.2190045938.000001D5794BE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://keyauth.win/api/1.2/	CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D579493000.00000004.00000020.00020000.00000000.sdmp, CCuITQzvd4.exe, 00000000.00000002.2227138302.000001D5793FC000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.1.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565143
Start date and time:	2024-11-29 10:56:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CCuITQzvd4.exe renamed because original name is a hash value
Original Sample Name:	06833640b01d9b8dcbc8001f0ff1cbc3aaa4ba1d45e08238c076b0d0d477c966.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@20/2@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 73 Number of non-executed functions: 148
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: CCuITQzvd4.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.1.5	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.6030.29502.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Generic.36879400.484.7364.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.6639.30242.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Evo-gen.24402.15705.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.25010.24037.exe	Get hash	malicious	Unknown	Browse
	lvXRlexBnb.exe	Get hash	malicious	Unknown	Browse
	oMBUxRQ4cj.exe	Get hash	malicious	Unknown	Browse
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	file.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	exe004.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
raw.githubusercontent.com	nYkkZZbAIR.exe	Get hash	malicious	Stealerium	Browse	185.199.110.133
	Job Description.lnk.download.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	185.199.110.133
	CORREIO BCV.zip.html	Get hash	malicious	Unknown	Browse	185.199.111.133
	document.vbs	Get hash	malicious	Unknown	Browse	185.199.111.133
	ZipRipper.cmd	Get hash	malicious	Unknown	Browse	185.199.108.133
	gr5zS9wytq.bat	Get hash	malicious	Unknown	Browse	185.199.111.133
	gr5zS9wytq.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	based.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse	185.199.110.133
	xeno.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Dl2EmyL53n.doc	Get hash	malicious	Unknown	Browse	185.199.108.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	qAyJeM1rqk.exe	Get hash	malicious	LummaC	Browse	172.67.160.80
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	You have received a gift from Giftano.eml	Get hash	malicious	GiftCardfraud	Browse	104.17.25.14
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	104.21.24.198
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	172.67.179.67
	specifications.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.90.137
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	172.64.41.3
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	172.67.179.67
FASTLYUS	nYkkZZbAIR.exe	Get hash	malicious	Stealerium	Browse	185.199.110.133
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	You have received a gift from Giftano.eml	Get hash	malicious	GiftCardfraud	Browse	151.101.2.208
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ce5f3254611a8c095a3d821d44539877	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	104.26.1.5
	SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	lUAc7lqa56.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
37f463bf4616ecd445d4a1937da06e19	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	11309-#U96fb#U4fe1#U8cbb#U96fb#U5b50#U901a#U77e5#U55ae#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	INV_642421346_50136253995_SIMPLE_SK#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	30180908_signed#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	#U017dIADOS#U0164 O ROZPO#U010cET 28.11.2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.108.133
	rjustificantePago_es_5678021862895.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.199.108.133
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.199.108.133
	file.exe	Get hash	malicious	Vidar	Browse	185.199.108.133
	file.exe	Get hash	malicious	Amadey	Browse	185.199.108.133

Process:	C:\Users\user\Desktop\CCuITQzvd4.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3145
Entropy (8bit):	4.991276116977138
Encrypted:	false
SSDEEP:	96:oiDjZkeTuUruqwyZdrRnSpG5lr8druckP:oiDjZkeT7qqwyZdrRn/5lKrkP
MD5:	DD8E526AEA8FD5CBE26E02ABFB61104C
SHA1:	B2EA96BB16DA297B34DF121A5A59FDB5D9905351
SHA-256:	C4FACF7ECA009951F63280521105C4EFE7359CA7D8036B714B6A9597EDF7402D
SHA-512:	5552BD4E05BE02E47A2B3FEFF6120BF57E598D11550FB674D4A2CBAFC7C97DB3B0D88AECA5C14FBA6889A5D5CBCB93511D86CB1592774AFAED11B01BF1E096EC
Malicious:	false
Preview:	00900BC83802.00900BC83803.0CC47AC83803.18C9ACDF-7C00-4.3CECEFC83806.6C4E733F-C2D9-4.ABIGAI.ACEPC.AIDANPC.ALENMOOS-PC.ALIONE.APPONFLY-VPS.ARCHIBALDPC.azure.B30F0242-1C6A-4.BAROSINO-PC.BECKER-PC.BEE7370C-8C0C-4.C81F66C83805.CATWRIGHT.CHSHAW.COFFEE-SHOP.COMPNAME_4047.COMPNAME_4416.COMPNAME_4803.CRYPTODEV222222.d1bnJkfVlH.DAPERE.DESKTOP-19OLLTD.DESKTOP-1PYKP29.DESKTOP-1Y2433R.DESKTOP-2UCEUPB.DESKTOP-47OCZTT.DESKTOP-4GCZVJU.DESKTOP-4U8DTF8.DESKTOP-54XGX6F.DESKTOP-5OV9S0O.DESKTOP-62YPFIQ.DESKTOP-64ACUCH.DESKTOP-6AKQQAM.DESKTOP-6BMFT65.DESKTOP-6UJBD2J.DESKTOP-70T5SDX.DESKTOP-7AFSTDP.DESKTOP-7XC6GEZ.DESKTOP-8K9D93B.DESKTOP-9981ETL.DESKTOP-AHGXKTV.DESKTOP-ALBERTO.DESKTOP-AUPFKSY.DESKTOP-B0T93D6.DESKTOP-B9OARKC.DESKTOP-BGN5L8Y.DESKTOP-BLN60OL.DESKTOP-BUGIO.DESKTOP-BXJYAEC.DESKTOP-CBGPFEE.DESKTOP-CDQE7VN.DESKTOP-CHAYANN.DESKTOP-CM0DAW8.DESKTOP-CNFVLMW.DESKTOP-CRCCCOT.DESKTOP-D019GDM.DESKTOP-D4FEN3M.DESKTOP-DAU8GJ2.DESKTOP-DE369SE.DESKTOP-DIL6IYA.DESKTOP-ECWZXY2.DESKTOP-ET51AJO.DESKTOP-F7BGEN9.DES

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\pc_username_list[1].txt

Download File

Process:	C:\Users\user\Desktop\CCuITQzvd4.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1275
Entropy (8bit):	5.686349299485424
Encrypted:	false
SSDEEP:	24:8YGEgnRyOQWvFyIDrVgaQ9d0zdRExKU8lN9iyqrVvX9OADV10OKMIVBtK8g0n:rGEgnRyxqZG/9d0zSEJiyqrRLloztPg0
MD5:	1D67516CC29BB3DD51B882AD9E82CD2E
SHA1:	267E80B9E0AA1982838238B67765BD840F7C788B
SHA-256:	F411221BF6E51E6DEB4E8D5CDC7E2E1BA4BBB3868DA5BB1BC0C29A3A3A02D0A7
SHA-512:	25D6D92314F59C3EDE98E7D485AEDAAC09D0B2781D6DBAEF3B9D003FAA838BE47249A14163652BD46A18DAB951DC22A1BDC463BB4973B8F66359AB4CDE4AEE35
Malicious:	false
Preview:	05h00Gi0.05KvAUQKPQ.21zLucUnfI85.3u2v9m8.43By4.4tgiizsLimS.5sIBK.5Y3y73.grepete.64F2tKIqO5.6O4KyHhJXBiR.7DBgdxu.7wjlGX7PjlW4.8LnfAai9QdJR.8Nl0ColNQ5bq.8VizSM.9yjCPsEYIMH.Abby.acox.Administrator.Amy.andrea.AppOnFlySupport.ASPNET.azure.barbarray.benjah.Bruno.BUiA1hkm.BvJChRPnsxn.BXw7q.cather.cM0uEGN4do.cMkNdS6.DdQrgc.DefaultAccount.doroth.dOuyo8RV71.DVrzi.dxd8DJ7c.e60UW.ecVtZ5wE.EGG0p.equZE3J.fNBDSlDTXY.Frank.fred.G2DbYLDgzz8Y.george.GexwjQdjXG.GGw8NR.GJAm1NxXVm.GjBsjb.gL50ksOp.gu17B.Guest.h7dk1xPr.h86LHD.HAPUBWS.Harry Johnson.hbyLdJtcKyN1.HEUeRzl.hmarc.ICQja5iT.IVwoKUF.IZZuXj.j6SHA37KA.j7pNjWM.JAW4Dz0.JcOtj17dZx.jeremdiaz.John.John Doe.jude.Julia.katorres.kEecfMwgj.kevans.kFu0lQwgX5P.KUv3bT4.l3cnbB8Ar5b8.Lisa.lK3zMR.lmVwjj9b.Louise.lubi53aN14cU.Lucas.Marci.mike.Mr.None.noK4zG7ZhOf.nZAp7UBVaS1.o6jdigq.o8yTi52T.Of20XqH4VL.OgJb6GqgK0O.OZFUCOD6.patex.PateX.Paul Jones.pf5vj.PgfV1X.PqONjHVwexsS.pWOuqdTDQ.PxmdUOpVyx.QfofoG.QmIS5df7u.QORxJKNk.qZo9A.rB5BnfuR2.RDhJ0CNFevzX.rexburns.RGzcBUyrznReg.

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.490907561003706
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CCuITQzvd4.exe
File size:	728'576 bytes
MD5:	197de30a59fc9af28d140cc2c530c8b7
SHA1:	bc3be4bcbf7066ef83fc1da055dbc14429fcdeff
SHA256:	06833640b01d9b8dcbc8001f0ff1cbc3aaa4ba1d45e08238c076b0d0d477c966
SHA512:	cfaec1fda5db873655edd080b03de83cfc5b03ccf53e1e7267ffc35f60fb7ce9d07559772f24bcaca593547e75ace2cdaead6e41d7d6d91e2ff409cc6ee75a08
SSDEEP:	12288:I+wgmeCSSJWIVrEvxMIgrbukxrTyMUteYksJZe9FXV:I+wrerSJXVgDgraYrThUssvuX
TLSH:	B9F49D5656B509E9D1ABD03DC1178603F7B2B05923209BEB13E486B92F23BE46F3E711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i<...o...o...o...o...o...n...o...o...o...n...o...n...o...n...oR..n...ok..n...ok..n...o...n...o...oz..o...n...o...o...o...n...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14007fa00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x663BF2AC [Wed May 8 21:46:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6e395037e41e00776b67c2ad9c72c7e9

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9B80833EACh
dec eax
add esp, 28h
jmp 00007F9B80833707h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F9B808338A2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F9B808338A5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F9B8083389Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F9B80832EF6h
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F9B80833801h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa4760	0x208	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xea000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe5000	0x4fb0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x57c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9bfa0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9c080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9be60	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0xc18	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8093c	0x80a00	866f65bbe02578c94f101d8a9227b4db	False	0.4993261813654033	data	6.441053204093362	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0x25770	0x25800	f102cf3c1dea4af9c6e6f87553bba060	False	0.42796875	data	6.003501322593407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa8000	0x3c5c0	0x6000	3a8dd05ccdb8e48c1a3f7590b06acb5c	False	0.3218994140625	data	5.0332079448205285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe5000	0x4fb0	0x5000	0716f0fcab7da248b0ecd502129c2101	False	0.487451171875	data	5.963051317619714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xea000	0x1e8	0x200	e9f115b7a129575544ad9e589233eba2	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x57c	0x600	c304b933a197955c131827a83c81c161	False	0.5520833333333334	data	5.091835132103112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xea060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	OpenProcess, CreateToolhelp32Snapshot, Process32NextW, MapViewOfFile, UnmapViewOfFile, GetModuleFileNameA, GetModuleHandleW, QueryFullProcessImageNameW, SetLastError, CreateFileA, LoadLibraryA, LeaveCriticalSection, SleepEx, QueryPerformanceFrequency, GetSystemDirectoryA, FreeLibrary, VerifyVersionInfoA, QueryPerformanceCounter, GetTickCount, MoveFileExA, WaitForSingleObjectEx, GetEnvironmentVariableA, GetFileType, WaitForMultipleObjects, GetFileSizeEx, WideCharToMultiByte, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, UnhandledExceptionFilter, Process32FirstW, EnterCriticalSection, CreateFileMappingW, CreateThread, GetTempPathW, VirtualAlloc, DeviceIoControl, VirtualFree, OpenThread, ReadProcessMemory, DeleteCriticalSection, GetProcAddress, GetModuleHandleA, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetSystemTimeAsFileTime, InitializeSListHead, OutputDebugStringW, OpenFileMappingW, GetCurrentThreadId, InitializeCriticalSectionEx, GetStdHandle, GetCurrentProcess, VirtualProtect, MultiByteToWideChar, GetModuleFileNameW, lstrlenW, WaitNamedPipeW, GetCurrentProcessId, CloseHandle, GetLastError, CreateFileW, PeekNamedPipe, WriteFile, FormatMessageA, ReadFile, Sleep
USER32.dll	FindWindowW, MessageBoxA, FindWindowA
ADVAPI32.dll	CryptEncrypt, CryptDestroyKey, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGenRandom, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA, SetSecurityInfo, IsValidSid, InitializeAcl, GetTokenInformation, GetLengthSid, AddAccessAllowedAce, OpenProcessToken, CryptImportKey, RegSetKeyValueW, RegDeleteKeyW, RegCreateKeyW, RegOpenKeyW, GetUserNameA, RegCloseKey, RegCreateKeyExW, RegSetValueExW
MSVCP140.dll	?good@ios_base@std@@QEBA_NXZ, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ??Bid@locale@std@@QEAA_KXZ, ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ??7ios_base@std@@QEBA_NXZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?_Xbad_function_call@std@@YAXXZ, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, _Mtx_current_owns, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, _Cnd_init_in_situ, ?_Throw_Cpp_error@std@@YAXH@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, _Cnd_timedwait, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, _Thrd_detach, ?_Xlength_error@std@@YAXPEBD@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Xout_of_range@std@@YAXPEBD@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exceptions@std@@YAHXZ, ??0_Lockit@std@@QEAA@H@Z, ??1_Lockit@std@@QEAA@XZ, _Mtx_destroy_in_situ, _Cnd_broadcast, _Mtx_unlock, _Xtime_get_ticks, _Cnd_do_broadcast_at_thread_exit, _Mtx_init_in_situ, _Mtx_lock
ntdll.dll	RtlLookupFunctionEntry, RtlCaptureContext, VerSetConditionMask, RtlInitUnicodeString, NtQuerySystemInformation, RtlVirtualUnwind
WININET.dll	InternetOpenA, InternetOpenUrlA, InternetReadFile, InternetCloseHandle
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertEnumCertificatesInStore, CertFindCertificateInStore, CertFreeCertificateContext, CryptStringToBinaryA, PFXImportCertStore, CryptDecodeObjectEx, CertAddCertificateContextToStore, CertFindExtension, CertGetNameStringA, CryptQueryObject, CertCreateCertificateChainEngine, CertFreeCertificateChainEngine, CertGetCertificateChain, CertFreeCertificateChain, CertCloseStore, CertOpenStore
WS2_32.dll	select, getaddrinfo, ioctlsocket, freeaddrinfo, listen, htonl, accept, WSAStartup, WSAIoctl, WSASetLastError, socket, recvfrom, sendto, gethostname, ntohl, setsockopt, ntohs, htons, getsockopt, __WSAFDIsSet, getsockname, getpeername, connect, bind, WSAGetLastError, closesocket, recv, send, WSACleanup
RPCRT4.dll	UuidCreate, RpcStringFreeA, UuidToStringA
PSAPI.DLL	GetModuleInformation
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__C_specific_handler, __std_exception_destroy, __std_exception_copy, _CxxThrowException, memchr, memcmp, __std_terminate, memmove, memset, strchr, strrchr, strstr, __current_exception, __current_exception_context, memcpy, _local_unwind
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vswprintf, __stdio_common_vfprintf, __stdio_common_vsprintf, fputc, _open, _close, _write, _read, fflush, __p__commode, _set_fmode, fclose, fgetc, fwrite, _lseeki64, fgetpos, setvbuf, ungetc, fsetpos, ftell, fseek, feof, fread, __stdio_common_vsscanf, fputs, fopen, _fseeki64, _get_stream_buffer_pointers, fgets, __acrt_iob_func, _popen, _pclose
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, realloc, free, malloc, _set_new_mode, calloc
api-ms-win-crt-runtime-l1-1-0.dll	_initterm, _initterm_e, _exit, exit, __p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _register_onexit_function, _set_app_type, _initialize_onexit_table, _invalid_parameter_noinfo_noreturn, _initialize_narrow_environment, _configure_narrow_argv, _getpid, system, abort, _seh_filter_exe, _cexit, terminate, strerror, __sys_nerr, _errno, _crt_atexit, _beginthreadex, _get_initial_narrow_environment
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	_stricmp, strncpy, _wcsicmp, strncmp, _strdup, tolower, strpbrk, isupper, strcmp, strcspn, strspn
api-ms-win-crt-filesystem-l1-1-0.dll	_unlink, _stat64, _lock_file, _fstat64, _unlock_file, _access, _wremove
api-ms-win-crt-utility-l1-1-0.dll	srand, qsort, rand
api-ms-win-crt-convert-l1-1-0.dll	strtod, strtol, strtoull, atoi, strtoul, strtoll
api-ms-win-crt-locale-l1-1-0.dll	localeconv, _configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass
SHELL32.dll	ShellExecuteA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T10:57:10.751419+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49714	185.199.108.133	443	TCP
2024-11-29T10:57:12.475813+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49716	185.199.108.133	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 10:57:08.837232113 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:08.837281942 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:08.837471962 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:08.848164082 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:08.848181009 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.069813013 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.069896936 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.418203115 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.418231964 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.418597937 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.418709993 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.421008110 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.463334084 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.751436949 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.751626968 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.752474070 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.752532005 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.757165909 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.757240057 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.757241011 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.757281065 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.757560968 CET	49714	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.757576942 CET	443	49714	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.782363892 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.782393932 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:10.782562017 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.782761097 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:10.782776117 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:11.993194103 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:11.993362904 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:11.994026899 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:11.994033098 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:11.994235992 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:11.994240046 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:12.475860119 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:12.475938082 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:12.476982117 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:12.477041960 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:12.477055073 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:12.477080107 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:12.479682922 CET	49716	443	192.168.2.6	185.199.108.133
Nov 29, 2024 10:57:12.479701996 CET	443	49716	185.199.108.133	192.168.2.6
Nov 29, 2024 10:57:13.631671906 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:13.631690979 CET	443	49722	104.26.1.5	192.168.2.6
Nov 29, 2024 10:57:13.631767988 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:13.632236958 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:13.632250071 CET	443	49722	104.26.1.5	192.168.2.6
Nov 29, 2024 10:57:14.896155119 CET	443	49722	104.26.1.5	192.168.2.6
Nov 29, 2024 10:57:14.896267891 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:14.906691074 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:14.906712055 CET	443	49722	104.26.1.5	192.168.2.6
Nov 29, 2024 10:57:14.906862020 CET	443	49722	104.26.1.5	192.168.2.6
Nov 29, 2024 10:57:14.906991005 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:14.907103062 CET	49722	443	192.168.2.6	104.26.1.5
Nov 29, 2024 10:57:14.907115936 CET	443	49722	104.26.1.5	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 10:57:08.690001965 CET	51062	53	192.168.2.6	1.1.1.1
Nov 29, 2024 10:57:08.829447031 CET	53	51062	1.1.1.1	192.168.2.6
Nov 29, 2024 10:57:13.486445904 CET	59206	53	192.168.2.6	1.1.1.1
Nov 29, 2024 10:57:13.629631996 CET	53	59206	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 10:57:08.690001965 CET	192.168.2.6	1.1.1.1	0x318e	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:13.486445904 CET	192.168.2.6	1.1.1.1	0x958c	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 10:57:08.829447031 CET	1.1.1.1	192.168.2.6	0x318e	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:08.829447031 CET	1.1.1.1	192.168.2.6	0x318e	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:08.829447031 CET	1.1.1.1	192.168.2.6	0x318e	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:08.829447031 CET	1.1.1.1	192.168.2.6	0x318e	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:13.629631996 CET	1.1.1.1	192.168.2.6	0x958c	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:13.629631996 CET	1.1.1.1	192.168.2.6	0x958c	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Nov 29, 2024 10:57:13.629631996 CET	1.1.1.1	192.168.2.6	0x958c	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.199.108.133	443	1912	C:\Users\user\Desktop\CCuITQzvd4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 09:57:10 UTC	125	OUT	GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1 User-Agent: Mozilla/5.0 Host: raw.githubusercontent.com
2024-11-29 09:57:10 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3145 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "72b0005e577398f4eb7596131aa14f87c4f7379acc30e24456d4830af5304467" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: E79B:24F1AE:A7DC9:B6584:67498FF6 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 09:57:10 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890083-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1732874231.583617,VS0,VE14 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 26cc3c581055311a486c92f43385662d3e29a366 Expires: Fri, 29 Nov 2024 10:02:10 GMT Source-Age: 0
2024-11-29 09:57:10 UTC	1378	IN	Data Raw: 30 30 39 30 30 42 43 38 33 38 30 32 0a 30 30 39 30 30 42 43 38 33 38 30 33 0a 30 43 43 34 37 41 43 38 33 38 30 33 0a 31 38 43 39 41 43 44 46 2d 37 43 30 30 2d 34 0a 33 43 45 43 45 46 43 38 33 38 30 36 0a 36 43 34 45 37 33 33 46 2d 43 32 44 39 2d 34 0a 41 42 49 47 41 49 0a 41 43 45 50 43 0a 41 49 44 41 4e 50 43 0a 41 4c 45 4e 4d 4f 4f 53 2d 50 43 0a 41 4c 49 4f 4e 45 0a 41 50 50 4f 4e 46 4c 59 2d 56 50 53 0a 41 52 43 48 49 42 41 4c 44 50 43 0a 61 7a 75 72 65 0a 42 33 30 46 30 32 34 32 2d 31 43 36 41 2d 34 0a 42 41 52 4f 53 49 4e 4f 2d 50 43 0a 42 45 43 4b 45 52 2d 50 43 0a 42 45 45 37 33 37 30 43 2d 38 43 30 43 2d 34 0a 43 38 31 46 36 36 43 38 33 38 30 35 0a 43 41 54 57 52 49 47 48 54 0a 43 48 53 48 41 57 0a 43 4f 46 46 45 45 2d 53 48 4f 50 0a 43 4f 4d 50 Data Ascii: 00900BC8380200900BC838030CC47AC8380318C9ACDF-7C00-43CECEFC838066C4E733F-C2D9-4ABIGAIACEPCAIDANPCALENMOOS-PCALIONEAPPONFLY-VPSARCHIBALDPCazureB30F0242-1C6A-4BAROSINO-PCBECKER-PCBEE7370C-8C0C-4C81F66C83805CATWRIGHTCHSHAWCOFFEE-SHOPCOMP
2024-11-29 09:57:10 UTC	1378	IN	Data Raw: 46 4f 0a 44 45 53 4b 54 4f 50 2d 4c 54 4d 43 4b 4c 41 0a 44 45 53 4b 54 4f 50 2d 4d 4a 43 36 35 30 30 0a 44 45 53 4b 54 4f 50 2d 4d 57 46 52 56 4b 48 0a 44 45 53 4b 54 4f 50 2d 4e 41 4b 46 46 4d 54 0a 44 45 53 4b 54 4f 50 2d 4e 4b 50 30 49 34 50 0a 44 45 53 4b 54 4f 50 2d 4e 4d 31 5a 50 4c 47 0a 44 45 53 4b 54 4f 50 2d 4e 54 55 37 56 55 4f 0a 44 45 53 4b 54 4f 50 2d 4f 36 46 42 4d 46 37 0a 44 45 53 4b 54 4f 50 2d 4f 37 42 49 33 50 54 0a 44 45 53 4b 54 4f 50 2d 50 41 30 46 4e 56 35 0a 44 45 53 4b 54 4f 50 2d 50 4b 51 4e 44 53 52 0a 44 45 53 4b 54 4f 50 2d 51 4c 4e 32 56 55 46 0a 44 45 53 4b 54 4f 50 2d 51 55 41 59 38 47 53 0a 44 45 53 4b 54 4f 50 2d 52 43 41 33 51 57 58 0a 44 45 53 4b 54 4f 50 2d 52 48 58 44 4b 57 57 0a 44 45 53 4b 54 4f 50 2d 52 50 34 46 Data Ascii: FODESKTOP-LTMCKLADESKTOP-MJC6500DESKTOP-MWFRVKHDESKTOP-NAKFFMTDESKTOP-NKP0I4PDESKTOP-NM1ZPLGDESKTOP-NTU7VUODESKTOP-O6FBMF7DESKTOP-O7BI3PTDESKTOP-PA0FNV5DESKTOP-PKQNDSRDESKTOP-QLN2VUFDESKTOP-QUAY8GSDESKTOP-RCA3QWXDESKTOP-RHXDKWWDESKTOP-RP4F
2024-11-29 09:57:10 UTC	389	IN	Data Raw: 45 45 4c 35 33 53 4e 0a 57 49 4e 5a 44 53 2d 31 42 48 52 56 50 51 55 0a 57 49 4e 5a 44 53 2d 32 32 55 52 4a 49 42 56 0a 57 49 4e 5a 44 53 2d 33 46 46 32 49 39 53 4e 0a 57 49 4e 5a 44 53 2d 35 4a 37 35 44 54 48 48 0a 57 49 4e 5a 44 53 2d 36 54 55 49 48 4e 37 52 0a 57 49 4e 5a 44 53 2d 38 4d 41 45 49 38 45 34 0a 57 49 4e 5a 44 53 2d 39 49 4f 37 35 53 56 47 0a 57 49 4e 5a 44 53 2d 41 4d 37 36 48 50 4b 32 0a 57 49 4e 5a 44 53 2d 42 30 33 4c 39 43 45 4f 0a 57 49 4e 5a 44 53 2d 42 4d 53 4d 44 38 4d 45 0a 57 49 4e 5a 44 53 2d 42 55 41 4f 4b 47 47 31 0a 57 49 4e 5a 44 53 2d 4b 37 56 49 4b 34 46 43 0a 57 49 4e 5a 44 53 2d 4d 49 4c 4f 42 4d 33 35 0a 57 49 4e 5a 44 53 2d 50 55 30 55 52 50 56 49 0a 57 49 4e 5a 44 53 2d 51 4e 47 4b 47 4e 35 39 0a 57 49 4e 5a 44 53 2d Data Ascii: EEL53SNWINZDS-1BHRVPQUWINZDS-22URJIBVWINZDS-3FF2I9SNWINZDS-5J75DTHHWINZDS-6TUIHN7RWINZDS-8MAEI8E4WINZDS-9IO75SVGWINZDS-AM76HPK2WINZDS-B03L9CEOWINZDS-BMSMD8MEWINZDS-BUAOKGG1WINZDS-K7VIK4FCWINZDS-MILOBM35WINZDS-PU0URPVIWINZDS-QNGKGN59WINZDS-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	185.199.108.133	443	1912	C:\Users\user\Desktop\CCuITQzvd4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 09:57:11 UTC	129	OUT	GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1 User-Agent: Mozilla/5.0 Host: raw.githubusercontent.com
2024-11-29 09:57:12 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "bbf75a064e165fba2b8fcc6595e496788fe27c3185ffa2fa56d3479e12867693" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: E854:128C4E:AEAFA:BD2CE:67498FF8 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 09:57:12 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740073-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1732874232.314653,VS0,VE8 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 214b45b2bc9e89d2ac04c5b9c61e7794f15a1a74 Expires: Fri, 29 Nov 2024 10:02:12 GMT Source-Age: 0
2024-11-29 09:57:12 UTC	1275	IN	Data Raw: 30 35 68 30 30 47 69 30 0a 30 35 4b 76 41 55 51 4b 50 51 0a 32 31 7a 4c 75 63 55 6e 66 49 38 35 0a 33 75 32 76 39 6d 38 0a 34 33 42 79 34 0a 34 74 67 69 69 7a 73 4c 69 6d 53 0a 35 73 49 42 4b 0a 35 59 33 79 37 33 0a 67 72 65 70 65 74 65 0a 36 34 46 32 74 4b 49 71 4f 35 0a 36 4f 34 4b 79 48 68 4a 58 42 69 52 0a 37 44 42 67 64 78 75 0a 37 77 6a 6c 47 58 37 50 6a 6c 57 34 0a 38 4c 6e 66 41 61 69 39 51 64 4a 52 0a 38 4e 6c 30 43 6f 6c 4e 51 35 62 71 0a 38 56 69 7a 53 4d 0a 39 79 6a 43 50 73 45 59 49 4d 48 0a 41 62 62 79 0a 61 63 6f 78 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 0a 41 6d 79 0a 61 6e 64 72 65 61 0a 41 70 70 4f 6e 46 6c 79 53 75 70 70 6f 72 74 0a 41 53 50 4e 45 54 0a 61 7a 75 72 65 0a 62 61 72 62 61 72 72 61 79 0a 62 65 6e 6a 61 68 0a 42 72 75 6e Data Ascii: 05h00Gi005KvAUQKPQ21zLucUnfI853u2v9m843By44tgiizsLimS5sIBK5Y3y73grepete64F2tKIqO56O4KyHhJXBiR7DBgdxu7wjlGX7PjlW48LnfAai9QdJR8Nl0ColNQ5bq8VizSM9yjCPsEYIMHAbbyacoxAdministratorAmyandreaAppOnFlySupportASPNETazurebarbarraybenjahBrun

Target ID:	0
Start time:	04:57:07
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\CCuITQzvd4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\CCuITQzvd4.exe"
Imagebase:	0x7ff7c4140000
File size:	728'576 bytes
MD5 hash:	197DE30A59FC9AF28D140CC2C530C8B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:57:07
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:57:11
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c color 4
Imagebase:	0x7ff7c4cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:57:12
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"
Imagebase:	0x7ff7c4cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:57:12
Start date:	29/11/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -hashfile "C:\Users\user\Desktop\CCuITQzvd4.exe" MD5
Imagebase:	0x7ff65a7f0000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:57:12
Start date:	29/11/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i /v "md5"
Imagebase:	0x7ff67f0d0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:57:12
Start date:	29/11/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i /v "certutil"
Imagebase:	0x7ff67f0d0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:57:13
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Imagebase:	0x7ff7c4cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:57:13
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Imagebase:	0x7ff7c4cf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:57:13
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:57:14
Start date:	29/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5
Imagebase:	0x7ff7e1670000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:57:14
Start date:	29/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1912 -s 2148
Imagebase:	0x7ff7e3a50000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.3%
Total number of Nodes:	1847
Total number of Limit Nodes:	98

Executed Functions

Function 00007FF7C4143C10 Relevance: 137.8, APIs: 15, Strings: 63, Instructions: 1331COMMON

Download Yara Rule

APIs

_Xtime_get_ticks.MSVCP140 ref: 00007FF7C4143C6C
memset.VCRUNTIME140 ref: 00007FF7C4143C9F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41441B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4144F23
memset.VCRUNTIME140 ref: 00007FF7C4144F6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4144FC4
_Mtx_lock.MSVCP140 ref: 00007FF7C414502C
memmove.VCRUNTIME140 ref: 00007FF7C4145064
_Mtx_unlock.MSVCP140 ref: 00007FF7C4145074
_Mtx_lock.MSVCP140 ref: 00007FF7C4145091
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C41450BA
memmove.VCRUNTIME140 ref: 00007FF7C41450DC
_Mtx_unlock.MSVCP140 ref: 00007FF7C41450F3

Part of subcall function 00007FF7C4146770: memcmp.VCRUNTIME140 ref: 00007FF7C414687F

?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4145180
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41451BD

Strings

5, xrefs: 00007FF7C4143E3F
TZHRL?, xrefs: 00007FF7C4144C8E
9, xrefs: 00007FF7C4144AB1
7, xrefs: 00007FF7C4144423
6, xrefs: 00007FF7C4144B57
6, xrefs: 00007FF7C4144AA2
7, xrefs: 00007FF7C4143EEF
4, xrefs: 00007FF7C4143FA7
5, xrefs: 00007FF7C41441F0
7, xrefs: 00007FF7C4143E49
5, xrefs: 00007FF7C41446D6
3, xrefs: 00007FF7C4143EDA
_VGFWP]9AVWGSC8, xrefs: 00007FF7C4143FE5
3, xrefs: 00007FF7C41441E6
{"nonce":"1","cmd":"SET_ACTIVITY","args":{"pid":1912,"activity":{"state":"2222222222222222https://discord.gg/jGguvU29","details":"2222222222222222https://discord.gg/jGguvU29","assets":{"large_image":"2222222222222222https://discord.gg/jGguvU29"},"secrets":{"jo, xrefs: 00007FF7C4145059, 00007FF7C41450D5
eqstp?, xrefs: 00007FF7C414424F
d, xrefs: 00007FF7C4143F2B
3, xrefs: 00007FF7C414440D
s, xrefs: 00007FF7C41446C7
4, xrefs: 00007FF7C4143F35
5, xrefs: 00007FF7C414499C
6, xrefs: 00007FF7C4143E44
wafzd7, xrefs: 00007FF7C4143EBF
E, xrefs: 00007FF7C4143ED5
4, xrefs: 00007FF7C4143E3A
WE@5SEUAWE8, xrefs: 00007FF7C4143CF0
3, xrefs: 00007FF7C4143FA2
c, xrefs: 00007FF7C4143F9D
Q\PP6, xrefs: 00007FF7C4143F8C
4, xrefs: 00007FF7C4144997
u, xrefs: 00007FF7C4144A8E
a, xrefs: 00007FF7C4144B43
4, xrefs: 00007FF7C41441EB
4, xrefs: 00007FF7C4144412
G@QG6, xrefs: 00007FF7C414497C
4, xrefs: 00007FF7C4144A98
8, xrefs: 00007FF7C4144AAC
VR@T6, xrefs: 00007FF7C4143F1A, 00007FF7C41441D0
n, xrefs: 00007FF7C4143E30
\\ZVS7, xrefs: 00007FF7C4143E1A
3, xrefs: 00007FF7C4144992
22222222222222226666666666666666, xrefs: 00007FF7C41442E7, 00007FF7C4144D2A
5, xrefs: 00007FF7C4144417
5, xrefs: 00007FF7C4144B52
3, xrefs: 00007FF7C4144B48
5, xrefs: 00007FF7C4143FAC
4, xrefs: 00007FF7C41446D1
7, xrefs: 00007FF7C4144B5C
3, xrefs: 00007FF7C41446CC
3, xrefs: 00007FF7C4144A93
u, xrefs: 00007FF7C414498D
4, xrefs: 00007FF7C4144B4D
3, xrefs: 00007FF7C4144A08
5, xrefs: 00007FF7C4143F3A
s, xrefs: 00007FF7C4144408
3, xrefs: 00007FF7C4143F30
5, xrefs: 00007FF7C4143EE4
3, xrefs: 00007FF7C4143E35
5, xrefs: 00007FF7C4144A9D
i, xrefs: 00007FF7C4144A03
d, xrefs: 00007FF7C41441E1
4, xrefs: 00007FF7C4143EDF
7, xrefs: 00007FF7C4144AA7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$Cpp_error@std@@Mtx_lockMtx_unlockThrow_memmovememset$Xtime_get_ticksmemcmp
String ID: 22222222222222226666666666666666$3$3$3$3$3$3$3$3$3$3$3$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$6$6$6$7$7$7$7$7$8$9$E$G@QG6$Q\PP6$TZHRL?$VR@T6$WE@5SEUAWE8$\\ZVS7$_VGFWP]9AVWGSC8$a$c$d$d$eqstp?$i$n$s$s$u$u$wafzd7${"nonce":"1","cmd":"SET_ACTIVITY","args":{"pid":1912,"activity":{"state":"2222222222222222https://discord.gg/jGguvU29","details":"2222222222222222https://discord.gg/jGguvU29","assets":{"large_image":"2222222222222222https://discord.gg/jGguvU29"},"secrets":{"jo
API String ID: 1889954511-876902999
Opcode ID: 5bb1209d2239abe55ed22bd3582d6d852c18d0dc8e8bb6d37cb69dd4b5b1b0f8
Instruction ID: 7d3bc63018cf0d1d9d1150ba0f8be4262a26e220e4545515e4ceee0a355d1bba
Opcode Fuzzy Hash: 5bb1209d2239abe55ed22bd3582d6d852c18d0dc8e8bb6d37cb69dd4b5b1b0f8
Instruction Fuzzy Hash: A2D21C62E1D78246FB12AF37F4802B4E760AF52BACF849335DA8D66595EF2CE141C710

Function 00007FF7C416B7F9 Relevance: 90.2, APIs: 22, Strings: 29, Instructions: 981windowCOMMON

Download Yara Rule

APIs

RpcStringFreeA.RPCRT4 ref: 00007FF7C416B820

Part of subcall function 00007FF7C4160BB0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4160CAA

Part of subcall function 00007FF7C4158C60: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FF7C4153979), ref: 00007FF7C4158CA6

Part of subcall function 00007FF7C4160CD0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4160DC1

Part of subcall function 00007FF7C4160F70: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416106D

Part of subcall function 00007FF7C4158CF0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FF7C416B8B4), ref: 00007FF7C4158D48

Part of subcall function 00007FF7C4158D50: memmove.VCRUNTIME140(?,?,?,00007FF7C41419DA), ref: 00007FF7C4158E43

memcmp.VCRUNTIME140 ref: 00007FF7C416BCD2
MessageBoxA.USER32 ref: 00007FF7C416BD55
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416BD5D
memset.VCRUNTIME140 ref: 00007FF7C416BD97
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z.MSVCP140 ref: 00007FF7C416BE44
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140 ref: 00007FF7C416BE65
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF7C416BE83
memcmp.VCRUNTIME140 ref: 00007FF7C416BF93
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416BFCF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C151

Part of subcall function 00007FF7C4160720: memcmp.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,0000006E00000006,krnigger,?,?,?,00007FF7C416CD48), ref: 00007FF7C41607EC
Part of subcall function 00007FF7C4160720: memcmp.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,0000006E00000006,krnigger,?,?,?,00007FF7C416CD48), ref: 00007FF7C4160863

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7C416C4C4
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7C416C4D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C530
MessageBoxA.USER32 ref: 00007FF7C416C862
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C8B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C8B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C916
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C95B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C9B8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416C9FD

Strings

#5.:, xrefs: 00007FF7C416C831
xzws, xrefs: 00007FF7C416C6AE
|, xrefs: 00007FF7C416C179
%6~e}, xrefs: 00007FF7C416BF32, 00007FF7C416C54B
qfe, xrefs: 00007FF7C416C046
Signature checksum failed. The request was either tampered with, or your session ended and you need to run the program again., xrefs: 00007FF7C416C001
qabz, xrefs: 00007FF7C416C28D
6~e}, xrefs: 00007FF7C416BB43, 00007FF7C416BF39, 00007FF7C416C027, 00007FF7C416C2F2, 00007FF7C416C129, 00007FF7C416C0F1, 00007FF7C416C008, 00007FF7C416C014, 00007FF7C416BE5E, 00007FF7C416BC78
6gwa, xrefs: 00007FF7C416BA2A
zsy, xrefs: 00007FF7C416C295
), xrefs: 00007FF7C416BA04
6~e}, xrefs: 00007FF7C416B99B
dhbv, xrefs: 00007FF7C416BA10
numOnlineUsers, xrefs: 00007FF7C416C341
6~e}, xrefs: 00007FF7C416C86A, 00007FF7C416C5C6, 00007FF7C416C702, 00007FF7C416C6E2
-, xrefs: 00007FF7C416B8B4
numKeys, xrefs: 00007FF7C416C37C
cdqp , xrefs: 00007FF7C416C096
x|ra, xrefs: 00007FF7C416C541
version, xrefs: 00007FF7C416C3B7
j, xrefs: 00007FF7C416C83B
6ys`6gwa, xrefs: 00007FF7C416BAB3, 00007FF7C416BBB0, 00007FF7C416BBDD, 00007FF7C416BBEE, 00007FF7C416C6C1, 00007FF7C416C23C, 00007FF7C416C1FC, 00007FF7C416C684, 00007FF7C416C661, 00007FF7C416C6F2, 00007FF7C416C6D2, 00007FF7C416C624, 00007FF7C416C1BF
6ys`6gwa, xrefs: 00007FF7C416BA53
numUsers, xrefs: 00007FF7C416C306
cta`, xrefs: 00007FF7C416C1B8
customerPanelLink, xrefs: 00007FF7C416C3F2
)|x~, xrefs: 00007FF7C416BA18
6t|p, xrefs: 00007FF7C416B9CF
, xrefs: 00007FF7C416BE09

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$D@std@@@std@@U?$char_traits@memcmp$??6?$basic_ostream@MessageV01@exitmemmove$??1?$basic_ios@??1?$basic_iostream@?setw@std@@FreeJ@1@_Smanip@_StringU?$_V21@@Vios_base@1@memset
String ID: $#5.:$%6~e}$)$)|x~$-$6gwa$6t|p$6ys`6gwa$6ys`6gwa$6~e}$6~e}$6~e}$Signature checksum failed. The request was either tampered with, or your session ended and you need to run the program again.$cdqp $cta`$customerPanelLink$dhbv$j$numKeys$numOnlineUsers$numUsers$qabz$qfe$version$xzws$x|ra$zsy$|
API String ID: 4267879706-15394976
Opcode ID: a8b2e60b3ed1f7a13f875118df6261c7e405be00463cc579e582a1feda6bcfc6
Instruction ID: 1a1589281c2c10b8de5faeb15230c9d1754f6a5ba4f458e207c35b79c55d1164
Opcode Fuzzy Hash: a8b2e60b3ed1f7a13f875118df6261c7e405be00463cc579e582a1feda6bcfc6
Instruction Fuzzy Hash: BCB2B962918BC19AE720EF36E8843ED6760FB95B9CF805136DACD07A99DF78D244C350

Function 00007FF7C41426B0 Relevance: 67.6, APIs: 24, Strings: 14, Instructions: 1077
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7C41426EC
RegCreateKeyExW.KERNEL32 ref: 00007FF7C4142B91
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4142D41
fprintf.MSPDB140-MSVCRT ref: 00007FF7C4142D4F
lstrlenW.KERNEL32 ref: 00007FF7C4142D65
RegSetValueExW.KERNEL32 ref: 00007FF7C4142D8B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4142F65
fprintf.MSPDB140-MSVCRT ref: 00007FF7C4142F73
lstrlenW.KERNEL32 ref: 00007FF7C4142F7C
RegSetValueExW.KERNEL32 ref: 00007FF7C4143107
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C41432D5
fprintf.MSPDB140-MSVCRT ref: 00007FF7C41432E3
RegCreateKeyExW.KERNEL32 ref: 00007FF7C414331F
RegSetValueExW.KERNEL32 ref: 00007FF7C4143350
RegCloseKey.ADVAPI32 ref: 00007FF7C4143366
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4143525
fprintf.MSPDB140-MSVCRT ref: 00007FF7C4143533
lstrlenW.KERNEL32 ref: 00007FF7C414353F
RegCreateKeyExW.KERNEL32 ref: 00007FF7C4143720
RegSetValueExW.KERNEL32 ref: 00007FF7C4143750
RegCloseKey.ADVAPI32 ref: 00007FF7C4143767
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4143931
fprintf.MSPDB140-MSVCRT ref: 00007FF7C414393F
RegCloseKey.ADVAPI32 ref: 00007FF7C4143948

Strings

DefaultIcon, xrefs: 00007FF7C41432F5
4, xrefs: 00007FF7C414279D
?, xrefs: 00007FF7C4143711
7, xrefs: 00007FF7C41427AF
6, xrefs: 00007FF7C41427A9
/.%+"MH, xrefs: 00007FF7C414377E
8, xrefs: 00007FF7C41427B5
3, xrefs: 00007FF7C4142794
,'D, xrefs: 00007FF7C4143545
5, xrefs: 00007FF7C41427A3
--NE, xrefs: 00007FF7C4143381
9, xrefs: 00007FF7C41427BB
;, xrefs: 00007FF7C4142785
':NE, xrefs: 00007FF7C4142BAC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: __acrt_iob_funcfprintf$Value$CloseCreatelstrlen$FileModuleName
String ID: ':NE$,'D$--NE$/.%+"MH$3$4$5$6$7$8$9$;$?$DefaultIcon
API String ID: 4028330169-3661395554
Opcode ID: 40fde78c66471f6cd6c21f4c995f4580f014c4f15fdb93c95e7a316c948baa3b
Instruction ID: d839d06311dca6b49e1dfae48335ce7be9d85c0d330599b9a7248fa950fe0353
Opcode Fuzzy Hash: 40fde78c66471f6cd6c21f4c995f4580f014c4f15fdb93c95e7a316c948baa3b
Instruction Fuzzy Hash: 3BA22E66D2DB9647E7039F36E4410A4E364AFA7B98F90D327F98831D52FF29E1818704

Function 00007FF7C416CDC0 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C416CEAC
OpenProcessToken.ADVAPI32 ref: 00007FF7C416CEBE
GetTokenInformation.KERNELBASE ref: 00007FF7C416CEE3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C416CEEC
GetTokenInformation.KERNELBASE ref: 00007FF7C416CF17
IsValidSid.ADVAPI32 ref: 00007FF7C416CF28
GetLengthSid.ADVAPI32 ref: 00007FF7C416CF39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C416CF44
InitializeAcl.ADVAPI32 ref: 00007FF7C416CF5D
AddAccessAllowedAce.ADVAPI32 ref: 00007FF7C416CF78
GetCurrentProcess.KERNEL32 ref: 00007FF7C416CF82
SetSecurityInfo.ADVAPI32 ref: 00007FF7C416CFA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C416CFB4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C416CFBD
CloseHandle.KERNEL32 ref: 00007FF7C416CFCC
GetModuleHandleA.KERNEL32 ref: 00007FF7C416D053
GetCurrentProcess.KERNEL32 ref: 00007FF7C416D05C
GetModuleInformation.PSAPI ref: 00007FF7C416D072
SleepEx.KERNEL32 ref: 00007FF7C416D120

Strings

LockMemAccess() failed, don't tamper with the program., xrefs: 00007FF7C416CFE8
>ewk, xrefs: 00007FF7C416CE30
>ewk, xrefs: 00007FF7C416CDF1
check_section_integrity() failed, don't tamper with the program., xrefs: 00007FF7C416CE84
Pattern checksum failed, don't tamper with the program., xrefs: 00007FF7C416D0FE

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Process$CurrentInformationToken$HandleModulefreemalloc$AccessAllowedCloseInfoInitializeLengthOpenSecuritySleepValid
String ID: >ewk$>ewk$LockMemAccess() failed, don't tamper with the program.$Pattern checksum failed, don't tamper with the program.$check_section_integrity() failed, don't tamper with the program.
API String ID: 2765164163-2190684333
Opcode ID: cc299bac938864c0c7ad72a2e779a0bf449ff756f9bd57958e64a0f19e583f03
Instruction ID: 1db840117fd305bc20f62b2a2201c86ecc4f44f5bd33afe896ed1f6b4a4be7d6
Opcode Fuzzy Hash: cc299bac938864c0c7ad72a2e779a0bf449ff756f9bd57958e64a0f19e583f03
Instruction Fuzzy Hash: 38A1AE32A196869BEB10EF22F8902F9A7A0FB45F5CF804535DA8D07A95DF3CD615C320

Function 00007FF7C41558F0 Relevance: 41.5, APIs: 18, Strings: 5, Instructions: 1256COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41BF110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF7C4159D11), ref: 00007FF7C41BF12A

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415595F
_Thrd_detach.MSVCP140 ref: 00007FF7C415598B
GetUserNameA.ADVAPI32 ref: 00007FF7C4155BC8
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4157D85
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4157D95

Strings

w$, xrefs: 00007FF7C41568B7
c, xrefs: 00007FF7C4156BB0
NrF<, xrefs: 00007FF7C4156A27
;(%R, xrefs: 00007FF7C41559F2
krnigger, xrefs: 00007FF7C4156F42

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Cpp_error@std@@Throw_$NameThrd_detachUser_beginthreadexmalloc
String ID: w$$;(%R$NrF<$c$krnigger
API String ID: 280933533-3730878727
Opcode ID: 91c6a1867d571571664e1d996c3cc068ed80fc7e1ff9fd34598360cbde5c766a
Instruction ID: df489ebc379c48da0c85087c1b38b0843fd05253a50d2d648e3688a323851243
Opcode Fuzzy Hash: 91c6a1867d571571664e1d996c3cc068ed80fc7e1ff9fd34598360cbde5c766a
Instruction Fuzzy Hash: EDC2F172A04A8587DB14DF2AE4907BCBBA1FB85F9DF848222DA8D47749CF38D855C350

Function 00007FF7C4188C30 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF7C4188CCC
socket.WS2_32 ref: 00007FF7C4188D15
htons.WS2_32 ref: 00007FF7C4188DA1
setsockopt.WS2_32 ref: 00007FF7C4188E03
WSAGetLastError.WS2_32 ref: 00007FF7C4188E0D
getsockopt.WS2_32 ref: 00007FF7C4188EAF
setsockopt.WS2_32 ref: 00007FF7C4188EDE
setsockopt.WS2_32 ref: 00007FF7C4188F1D
WSAIoctl.WS2_32 ref: 00007FF7C4188FAA
WSAGetLastError.WS2_32 ref: 00007FF7C4188FB4

Part of subcall function 00007FF7C4194E90: ioctlsocket.WS2_32 ref: 00007FF7C4194EA9

Part of subcall function 00007FF7C418D9B0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7C417685F), ref: 00007FF7C418D9C7

connect.WS2_32 ref: 00007FF7C41890DB
WSAGetLastError.WS2_32 ref: 00007FF7C41890F8

Part of subcall function 00007FF7C4171890: GetLastError.KERNEL32 ref: 00007FF7C41718B2
Part of subcall function 00007FF7C4171890: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41718BA

Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186B85
Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186BA0

Part of subcall function 00007FF7C4187540: closesocket.WS2_32 ref: 00007FF7C4187583

Strings

@, xrefs: 00007FF7C4188E47
Trying %s:%ld..., xrefs: 00007FF7C4188DAF
Could not set TCP_NODELAY: %s, xrefs: 00007FF7C4188E2A
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C418919E
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF7C4188FBD
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7C4188F2A
Immediate connect fail for %s: %s, xrefs: 00007FF7C4189128

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemmovesocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1781130894-3868455274
Opcode ID: d4404ed3eeeb0dd06869ebd3051aeb88ffce753f639c24b31608c20daf480909
Instruction ID: 2c3548d4eb5d7c9111c361e81df3c7d5c0d88c2d896155f9d3306dd82158ab6e
Opcode Fuzzy Hash: d4404ed3eeeb0dd06869ebd3051aeb88ffce753f639c24b31608c20daf480909
Instruction Fuzzy Hash: 2DF1B171A1C68287E720EF26A4C42ADA391FB44F6CF914135EA9D47B84DF3CE945CB11

Function 00007FF7C4168EF0 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7C4168F40
memmove.VCRUNTIME140 ref: 00007FF7C4168FD5
memmove.VCRUNTIME140 ref: 00007FF7C416902B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416916E
_popen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C41691B5
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C41691E2
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4169222
_pclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4169230
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416926A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41692BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41692FC

Strings

>, xrefs: 00007FF7C41691A2
0, xrefs: 00007FF7C41690BE
certutil -hashfile ", xrefs: 00007FF7C416903A
?, xrefs: 00007FF7C41690C7
krnigger, xrefs: 00007FF7C4168EFC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$fgetsmemmove$FileModuleName_pclose_popen
String ID: 0$>$?$certutil -hashfile "$krnigger
API String ID: 464220010-886724711
Opcode ID: 25bfdb0e96ef2f6a016c7fd3c9b07d75090a865f98384c8265ce9fc0ee1f1a0c
Instruction ID: 3abfa98243e7daf43d6578e25ece2068e9c6a10db66be920e49cceea3e1c4387
Opcode Fuzzy Hash: 25bfdb0e96ef2f6a016c7fd3c9b07d75090a865f98384c8265ce9fc0ee1f1a0c
Instruction Fuzzy Hash: D3D1A562E18B8196FB10DF25E8803EDA761FB95BA8F905235DADD16A99DF3CD180C310

Function 00007FF7C41710A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF7C41710C8
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41710D0

Strings

No error, xrefs: 00007FF7C4171520
%s (0x%08X), xrefs: 00007FF7C4171125
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF7C417152C
Unknown error, xrefs: 00007FF7C41715C0
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF7C41715D9
%s - %s, xrefs: 00007FF7C4171629
CRYPT_E_REVOKED, xrefs: 00007FF7C4171502

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: ed7fc7876de281d4f35d58aa0b33b0ad0e193e6dbdd3c6af983b6c5aa8a53d86
Instruction ID: 67eb818f4667d2c72b1f3b15c87e8370f16082e44f039c8198375272f3de1bd6
Opcode Fuzzy Hash: ed7fc7876de281d4f35d58aa0b33b0ad0e193e6dbdd3c6af983b6c5aa8a53d86
Instruction Fuzzy Hash: F251A771A0C68287E725AF62B8D43B9A764BB45FB8FC44135DACE02B55DF3CD9058720

Function 00007FF7C414C660 Relevance: 26.0, APIs: 7, Strings: 6, Instructions: 3293processCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C414FEFF
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C414FF09
memset.VCRUNTIME140 ref: 00007FF7C414FF27
Process32FirstW.KERNEL32 ref: 00007FF7C414FFCB
_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C415001A
Process32NextW.KERNEL32 ref: 00007FF7C41500F5
CloseHandle.KERNEL32 ref: 00007FF7C415011E

Strings

:&D, xrefs: 00007FF7C414E10B
2.L, xrefs: 00007FF7C414C68E, 00007FF7C414EB1B
7!T, xrefs: 00007FF7C414F827
2.L, xrefs: 00007FF7C414F653
:&D, xrefs: 00007FF7C414CC9B
:&D, xrefs: 00007FF7C414DE0B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Process32memset$CloseCreateFirstHandleNextSnapshotToolhelp32_wcsicmp
String ID: 2.L$2.L$7!T$:&D$:&D$:&D
API String ID: 3373788898-560323532
Opcode ID: 4ed067691acd6047ad06cd1f831d697f2058b4674655170072288a451278a2e4
Instruction ID: bf2f7f66da17b536118ff9d2591b1d4a385e94269947b790a937bdc462c9498c
Opcode Fuzzy Hash: 4ed067691acd6047ad06cd1f831d697f2058b4674655170072288a451278a2e4
Instruction Fuzzy Hash: 50633066D3DB9646E7139F39A4424A4E324AFB7789B90D327F9C831D52FF19B2818304

Function 00007FF7C4150A00 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237
processlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C4150A38
GetProcAddress.KERNEL32 ref: 00007FF7C4150BF7
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C4150C0A
Process32FirstW.KERNEL32 ref: 00007FF7C4150C2B
GetCurrentProcessId.KERNEL32 ref: 00007FF7C4150C3D
_local_unwind.VCRUNTIME140 ref: 00007FF7C4150C69
OpenProcess.KERNEL32 ref: 00007FF7C4150C75
_local_unwind.VCRUNTIME140 ref: 00007FF7C4150C94
ReadProcessMemory.KERNEL32 ref: 00007FF7C4150CB2
_local_unwind.VCRUNTIME140 ref: 00007FF7C4150CC8
CloseHandle.KERNEL32 ref: 00007FF7C4150DCF
Process32NextW.KERNEL32 ref: 00007FF7C4150DE2
CloseHandle.KERNEL32 ref: 00007FF7C4150E06

Strings

kernel32.dll, xrefs: 00007FF7C4150A31

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: HandleProcess_local_unwind$CloseProcess32$AddressCreateCurrentFirstMemoryModuleNextOpenProcReadSnapshotToolhelp32
String ID: kernel32.dll
API String ID: 919829046-1793498882
Opcode ID: dff2305a088c63fdd0889957667106ddef3e6da0d56f244b05eccc104ce48bb2
Instruction ID: c9e904b4fde1524ed03aa2a1801cc0f5d15a95ec64a6dcf88604e8156f33f4eb
Opcode Fuzzy Hash: dff2305a088c63fdd0889957667106ddef3e6da0d56f244b05eccc104ce48bb2
Instruction Fuzzy Hash: 5FB1E736E19B8187E7119F26F4801A9F774FF95B94F809335EA8A22A55DF3CE141C700

Function 00007FF7C4189530 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000000,00007FF7C41B23AA,?,?,?,?,00007FF7C41898BB), ref: 00007FF7C4189544
GetProcAddress.KERNEL32(?,?,?,?,00007FF7C41898BB), ref: 00007FF7C4189569
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00007FF7C41898BB), ref: 00007FF7C418957C

Strings

kernel32, xrefs: 00007FF7C418953D
AddDllDirectory, xrefs: 00007FF7C41895C3
LoadLibraryExA, xrefs: 00007FF7C418955A

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 98fbc65355e0a354ca1e1add5b4f88c6fda0f5413833e457a602aadc21f5ae85
Instruction ID: da3ebf6fc48fd4320118098c054f72f756dafb7b865be91f7c7aba44f823690b
Opcode Fuzzy Hash: 98fbc65355e0a354ca1e1add5b4f88c6fda0f5413833e457a602aadc21f5ae85
Instruction Fuzzy Hash: 6A419E16F0A64287EB15AF57B880139A791AF86FB5F884130CE9D07790DF3DE486C720

Function 00007FF7C4194C60 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7C4194CA1
htonl.WS2_32 ref: 00007FF7C4194CCE
setsockopt.WS2_32 ref: 00007FF7C4194D05
bind.WS2_32 ref: 00007FF7C4194D20
getsockname.WS2_32 ref: 00007FF7C4194D3C
listen.WS2_32 ref: 00007FF7C4194D51
socket.WS2_32 ref: 00007FF7C4194D68
connect.WS2_32 ref: 00007FF7C4194D87
accept.WS2_32 ref: 00007FF7C4194D9E
send.WS2_32 ref: 00007FF7C4194DEC
recv.WS2_32 ref: 00007FF7C4194E0A
memcmp.VCRUNTIME140 ref: 00007FF7C4194E25
closesocket.WS2_32 ref: 00007FF7C4194E31

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 7dd6608b05fa775b281e054cdc98dc8968419323758e08cf5ab32425e0e3cd09
Instruction ID: 575786010ff56751172f173339e22c8514bc467fa33c8acc0fef9902a005a7a5
Opcode Fuzzy Hash: 7dd6608b05fa775b281e054cdc98dc8968419323758e08cf5ab32425e0e3cd09
Instruction Fuzzy Hash: 99515F31A08A4687D720AF26F994169B3A1FB54FB8F905330EABE43AE4DF3CD4458710

Function 00007FF7C4168C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 172
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C4168C76
GetCurrentProcess.KERNEL32 ref: 00007FF7C4168CBE
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF7C4168CD3
CreateFileW.KERNEL32 ref: 00007FF7C4168D01
CreateFileMappingW.KERNELBASE ref: 00007FF7C4168D2C
MapViewOfFile.KERNEL32 ref: 00007FF7C4168D4C
VirtualProtect.KERNEL32 ref: 00007FF7C4168E4B
VirtualProtect.KERNEL32 ref: 00007FF7C4168E73
UnmapViewOfFile.KERNEL32 ref: 00007FF7C4168E8F
CloseHandle.KERNEL32 ref: 00007FF7C4168E98
UnmapViewOfFile.KERNEL32 ref: 00007FF7C4168EAF
CloseHandle.KERNEL32 ref: 00007FF7C4168EB8

Strings

@, xrefs: 00007FF7C4168E3A

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: File$HandleView$CloseCreateProcessProtectUnmapVirtual$CurrentFullImageMappingModuleNameQuery
String ID: @
API String ID: 1254450295-2766056989
Opcode ID: 9bd14418a0c21c4e4fc77e0752ec2e3718948a41fc3b3ac9e88f67b73ea4a313
Instruction ID: 8f987a07270573716c559b97ffc90f35dfca8f23a1b786c0964645ba15773f63
Opcode Fuzzy Hash: 9bd14418a0c21c4e4fc77e0752ec2e3718948a41fc3b3ac9e88f67b73ea4a313
Instruction Fuzzy Hash: 7571BF32B0968297E764AF16F9802BAB7B1FB84F68F844135DA8903794DF3CE445C760

Function 00007FF7C4145330 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF7C4145388
_Mtx_init_in_situ.MSVCP140 ref: 00007FF7C41453B5
_Cnd_init_in_situ.MSVCP140 ref: 00007FF7C41453BF
MultiByteToWideChar.KERNEL32 ref: 00007FF7C41453FA

Part of subcall function 00007FF7C41426B0: GetModuleFileNameW.KERNEL32 ref: 00007FF7C41426EC

GetCurrentProcessId.KERNEL32 ref: 00007FF7C414540F
_Mtx_lock.MSVCP140 ref: 00007FF7C4145422
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C414542F
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4145450
_Mtx_unlock.MSVCP140 ref: 00007FF7C41454D2
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C414558A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41455B0
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C41455C0

Strings

, xrefs: 00007FF7C41453C8

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Cpp_error@std@@Throw_$ByteCharCnd_init_in_situCurrentFileModuleMtx_init_in_situMtx_lockMtx_unlockMultiNameProcessWide_beginthreadexmemsetterminate
String ID:
API String ID: 2455840147-3916222277
Opcode ID: ee42542b0e69d3b43cf5a50e72ef331c7e7940879c3675321fb1c498ae5561f0
Instruction ID: 6a9471f108ca2842034d2ac11bd0af8ddc0181e07208f1851ad71b7a44bfbc8a
Opcode Fuzzy Hash: ee42542b0e69d3b43cf5a50e72ef331c7e7940879c3675321fb1c498ae5561f0
Instruction Fuzzy Hash: E7818621D18B8283E721DF12F884375B360FB99B68F955235DACD42665EF7CE191C710

Function 00007FF7C4156D82 Relevance: 22.0, APIs: 5, Strings: 7, Instructions: 1037COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7C4156F9D
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF7C4157664
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4157CB6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4157D04
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4157D26

Strings

m', xrefs: 00007FF7C41575FE
789:;, xrefs: 00007FF7C4157381
TNhE, xrefs: 00007FF7C41574B7
krnigger, xrefs: 00007FF7C4156F42
/$$$$$$$$ /$$$$$$$$ | $$_____/ |__ $$__/ | $$ /$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ | $$, xrefs: 00007FF7C4156F63
7, xrefs: 00007FF7C4156FBB
8.`, xrefs: 00007FF7C41578F7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: V01@$D@std@@@std@@U?$char_traits@_invalid_parameter_noinfo_noreturn$??5?$basic_istream@??6?$basic_ostream@V01@@terminate
String ID: /$$$$$$$$ /$$$$$$$$ | $$_____/ |__ $$__/ | $$ /$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ | $$$789:;$7$8.`$TNhE$krnigger$m'
API String ID: 385310142-3803897408
Opcode ID: 4d56eec2b841ab2518e34400b676ebcab5c9aa4655f742fde794f78a0895abfc
Instruction ID: cbe1e4912f6abd8c19c6630994dcea79a550c68fc2a5db2330c681a30da4c58a
Opcode Fuzzy Hash: 4d56eec2b841ab2518e34400b676ebcab5c9aa4655f742fde794f78a0895abfc
Instruction Fuzzy Hash: 52A22962E19B5147EB02DF3AE4816B8B760FF56B98F80C327EE9923A55DF28D141C310

Function 00007FF7C41552CA Relevance: 21.7, APIs: 9, Strings: 3, Instructions: 714COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415567A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41558E6
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415595F
_Thrd_detach.MSVCP140 ref: 00007FF7C415598B
GetUserNameA.ADVAPI32 ref: 00007FF7C4155BC8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4155C0E
GetUserNameA.ADVAPI32 ref: 00007FF7C4155E2C
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4155E7B
GetStdHandle.KERNEL32 ref: 00007FF7C4155E91

Strings

+<, xrefs: 00007FF7C4155320
o*, xrefs: 00007FF7C415532C
;(%R, xrefs: 00007FF7C41559F2

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: NameUser_invalid_parameter_noinfo_noreturnabort$HandleThrd_detach_beginthreadex
String ID: ;(%R$+<$o*
API String ID: 2000874323-86386748
Opcode ID: e78c76044d4bd5439ebdc591dc40e665733f3b6941d39ffd16786bc296b797df
Instruction ID: fe13f6af7750d96d37ee58c9571d94a6208185d7bd927a859b9912cf5ff8d3f6
Opcode Fuzzy Hash: e78c76044d4bd5439ebdc591dc40e665733f3b6941d39ffd16786bc296b797df
Instruction Fuzzy Hash: 4E62C872E15BC586EB01AF3AE4803ECA365FF51F9CF908336DA8D1695ADF689185C310

Function 00007FF7C41878F0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337COMMON

Download Yara Rule

Strings

Connection time-out, xrefs: 00007FF7C41879D9
After %I64dms connect time, move on!, xrefs: 00007FF7C4187AB5
Connection failed, xrefs: 00007FF7C4187CD6
connect to %s port %ld failed: %s, xrefs: 00007FF7C4187B6D
Failed to connect to %s port %ld: %s, xrefs: 00007FF7C4187E1E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: 9ad5143435e137e0544db4452ef0083e1380c5922c62ccd9246047e4b29126cd
Instruction ID: e478570fcbe4f6de161da96e40fc2defb42d1f315197499d3ea69178d68636b0
Opcode Fuzzy Hash: 9ad5143435e137e0544db4452ef0083e1380c5922c62ccd9246047e4b29126cd
Instruction Fuzzy Hash: 99E1D361F0868283E755AF26A8C43B9A3A1FB85BB8F850235DAAD077C1DF3CE551C311

Function 00007FF7C41536E0 Relevance: 16.3, APIs: 7, Strings: 2, Instructions: 506COMMON

Download Yara Rule

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C4153903
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153A37
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153A3E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153A8C

Part of subcall function 00007FF7C41596A0: ?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF7C4153AC6), ref: 00007FF7C41596AB

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153EA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153EAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4153EB6

Strings

7, xrefs: 00007FF7C41544D1
|, xrefs: 00007FF7C41544CC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xout_of_range@std@@rand
String ID: 7$|
API String ID: 3361734476-1983837878
Opcode ID: 7ba4e7822fa0516a8c7d41fa6fd23bc7289631a0ff2bf3411274c34c084691f6
Instruction ID: 2976bb8d0152d75480c9f6e6022f0f4d3ee0c1d9d87e5a6e496c2da8b1dc2e5e
Opcode Fuzzy Hash: 7ba4e7822fa0516a8c7d41fa6fd23bc7289631a0ff2bf3411274c34c084691f6
Instruction Fuzzy Hash: BF220D62E19B854BF7029F7AE4402ACA361EF56B98F40C326EE5C73A95DF389185C314

Function 00007FF7C4151550 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C4151747
GetProcAddress.KERNEL32 ref: 00007FF7C4151755
GetCurrentProcess.KERNEL32 ref: 00007FF7C415175E
NtQueryInformationProcess.NTDLL ref: 00007FF7C4151780
CloseHandle.KERNEL32 ref: 00007FF7C4151798

Strings

ntdll.dll, xrefs: 00007FF7C4151740

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: HandleProcess$AddressCloseCurrentInformationModuleProcQuery
String ID: ntdll.dll
API String ID: 1796618146-2227199552
Opcode ID: b15344747a92233a80e5d6e598e4b1921ac9247d4c3ca84b41fa358939f1231a
Instruction ID: b19c502bb761e27ed61fb985864d43f81f8c97c58a6406ab1821566ea3481d38
Opcode Fuzzy Hash: b15344747a92233a80e5d6e598e4b1921ac9247d4c3ca84b41fa358939f1231a
Instruction Fuzzy Hash: 53811E26D29B8147E713DF3AF441275F760FF96B94F80D326EA8922A51EF2DE1418700

Function 00007FF7C414C440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123threadlibrarynativeCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7C414C44D
GetProcAddress.KERNEL32 ref: 00007FF7C414C624
GetCurrentThreadId.KERNEL32 ref: 00007FF7C414C62D
OpenThread.KERNEL32 ref: 00007FF7C414C63D
NtSetInformationThread.NTDLL ref: 00007FF7C414C650

Strings

ntdll.dll, xrefs: 00007FF7C414C446

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Thread$AddressCurrentInformationLibraryLoadOpenProc
String ID: ntdll.dll
API String ID: 1003793795-2227199552
Opcode ID: 67c2ca3a9b3ea0504740e507e33fbd8abc9d5ed09ab831aa584d92e5ffae49a1
Instruction ID: 457a6face66a6cac93b5f78e1f994bfadb566c35cdf2593992f9d3f326375753
Opcode Fuzzy Hash: 67c2ca3a9b3ea0504740e507e33fbd8abc9d5ed09ab831aa584d92e5ffae49a1
Instruction Fuzzy Hash: 08513B66D2D78247F7036F36A841064E364AFA7B94B80D33AFE9535D61FF29A1C28604

Function 00007FF7C4154680 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 414COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41547EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41548BF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41548C6
SleepEx.KERNEL32 ref: 00007FF7C4154C98

Strings

B=vP, xrefs: 00007FF7C4154B79

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleep
String ID: B=vP
API String ID: 3287135283-786740973
Opcode ID: 90f2dc1a3683e820d581321f8fa7430b6afd08be99beb85e1562d35a2936f949
Instruction ID: c0859d3e6c5691d1b9f69aabaa845c93999a1567ba7e950e660f8be4357d316b
Opcode Fuzzy Hash: 90f2dc1a3683e820d581321f8fa7430b6afd08be99beb85e1562d35a2936f949
Instruction Fuzzy Hash: D602CE72A08A8587EB14EF1BE0907B8BB61FB45FA8F944132DA8E07795DE38E454D710

Function 00007FF7C4151230 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 181librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C4151427
GetProcAddress.KERNEL32 ref: 00007FF7C4151435
GetCurrentProcess.KERNEL32 ref: 00007FF7C415143E
NtQueryInformationProcess.NTDLL ref: 00007FF7C4151460

Strings

ntdll.dll, xrefs: 00007FF7C4151420

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Process$AddressCurrentHandleInformationModuleProcQuery
String ID: ntdll.dll
API String ID: 2292878059-2227199552
Opcode ID: fd80a3a21f5f385f03b29f139869302f9046a304e66edd4ee3dee45d33ce1aee
Instruction ID: 3552643fa1ec615d8c2d09c4e4b1f0dc1e7dda28b4a89d2e1a724b3c13e9aeb0
Opcode Fuzzy Hash: fd80a3a21f5f385f03b29f139869302f9046a304e66edd4ee3dee45d33ce1aee
Instruction Fuzzy Hash: 31811E26D29B8147E7139F3AF441275F760FF96B98F80D326EA8922A51EF3DE1418700

Function 00007FF7C4150E40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 179librarynativeloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C4151037
GetProcAddress.KERNEL32 ref: 00007FF7C4151045
GetCurrentProcess.KERNEL32 ref: 00007FF7C415104E
NtQueryInformationProcess.NTDLL ref: 00007FF7C415106B

Strings

ntdll.dll, xrefs: 00007FF7C4151030

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Process$AddressCurrentHandleInformationModuleProcQuery
String ID: ntdll.dll
API String ID: 2292878059-2227199552
Opcode ID: f70203133e9339d3f6c7e2adfb41d51199aaf160e49a553e5e0da299cced50cb
Instruction ID: 863c2829a358d29dae731de463493361afbae35329948178a43d1a98aa5d84cf
Opcode Fuzzy Hash: f70203133e9339d3f6c7e2adfb41d51199aaf160e49a553e5e0da299cced50cb
Instruction Fuzzy Hash: 93814F26D19B8147E703DF3AE4412B5F760FF96B98F90C326EA8932951EF39E1418704

Function 00007FF7C4153EC0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

7, xrefs: 00007FF7C41544D1
|, xrefs: 00007FF7C41544CC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: 7$|
API String ID: 0-1983837878
Opcode ID: 78f762ecef1f12d3f8024b2f0bf1788633d9f99d425d9ec0ab052a1fd3e840be
Instruction ID: b9d0977f315ddd5138f516520d6ca144f7dcebbdd27848d721e9ae45950a169c
Opcode Fuzzy Hash: 78f762ecef1f12d3f8024b2f0bf1788633d9f99d425d9ec0ab052a1fd3e840be
Instruction Fuzzy Hash: 3551E762E18BC587E700DF26F8807AAB7A0FB55BA8F505225EE9C03A95DF7CD090C750

Function 00007FF7C4150320 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 408fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7C4150676

Strings

WQ+$0C, xrefs: 00007FF7C415035C
6666666666666666, xrefs: 00007FF7C4150523
SO%3B, xrefs: 00007FF7C41504DB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: CreateFile
String ID: 6666666666666666$SO%3B$WQ+$0C
API String ID: 823142352-1459311844
Opcode ID: 3aa0a76b8e4f231b0b526d7dbd8108d63ff7e15e05853210615a5f3eea8fda52
Instruction ID: 4a4c455c3740acff9422c22964655fe3b49ea0580d17e271bf224826c4f70b3d
Opcode Fuzzy Hash: 3aa0a76b8e4f231b0b526d7dbd8108d63ff7e15e05853210615a5f3eea8fda52
Instruction Fuzzy Hash: 5F024166E19B854BF703DF3AE4415B4F770AF57B48B80C326DE8936A52EB39B1818704

Function 00007FF7C4176DF0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7C41771E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4177207

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: ee7c4732b895467b3390a345fafef04c656ff5fdc64102a4edf700bea217f88e
Instruction ID: b4fb7eeeea97783f6f4ef78f55c9941fb1a0a703405fd8bfbdd42312318eeb7b
Opcode Fuzzy Hash: ee7c4732b895467b3390a345fafef04c656ff5fdc64102a4edf700bea217f88e
Instruction Fuzzy Hash: B8C1B432A0968247EB659E26A4903B9A390FB45BBCF944235DEEE437C4DF3CED418710

Function 00007FF7C4151DA0 Relevance: 3.3, APIs: 2, Instructions: 256COMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF7C41520EB
FindWindowW.USER32 ref: 00007FF7C41520FB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: f0364ed2e43bb3037575e3edf55b232e1f596dc37590368e62c40bdc068a7e7c
Instruction ID: 5004f53c2afbbed9e1d5926aaa53f5cbcde2c7b2c5476ca61d5a60859a255fca
Opcode Fuzzy Hash: f0364ed2e43bb3037575e3edf55b232e1f596dc37590368e62c40bdc068a7e7c
Instruction Fuzzy Hash: 75B11026D2DB9547E7139F3AA4411B5F360EFB7B89F90D313FE8831952EF29A1818604

Function 00007FF7C4151B30 Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FF7C4151CBB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 82adc34da68b59ad0fa854a5f098c815fc39b0b55731464f4599ccf08b2458eb
Instruction ID: a8aaf6c35890da7d596f568466aedeac49d51de50c383fe077a07106eac276b7
Opcode Fuzzy Hash: 82adc34da68b59ad0fa854a5f098c815fc39b0b55731464f4599ccf08b2458eb
Instruction Fuzzy Hash: 27619032B14A5087DB24DF1AE090BB8BBA1FB86F9DF998122CA8D47754CF39D415CB00

Function 00007FF7C419AC50 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419AD40
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419AD91
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419ADD4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419AEB7
memmove.VCRUNTIME140 ref: 00007FF7C419AF59
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419AFC2
memmove.VCRUNTIME140 ref: 00007FF7C419B09A
memset.VCRUNTIME140 ref: 00007FF7C419B267
CertFreeCertificateContext.CRYPT32 ref: 00007FF7C419B2CA

Strings

schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF7C419B15E, 00007FF7C419B372
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7C419B12B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF7C419B2EA
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7C419B30A
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF7C419B0C6
schannel: unable to allocate memory, xrefs: 00007FF7C419B3BF
SSL: public key does not match pinned public key!, xrefs: 00007FF7C419B2AC, 00007FF7C419B2D4
schannel: unable to re-allocate memory, xrefs: 00007FF7C419ADE2
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF7C419B174

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: malloc$memmove$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 3540109735-3059304359
Opcode ID: 1256b78b9161f3a64d1ae05adb83a78b187135cef385665968d487fc98cff563
Instruction ID: 5d6a72e931399866a49b7cbe088c277f79eaf33e5d2017149b75e60125c1ecea
Opcode Fuzzy Hash: 1256b78b9161f3a64d1ae05adb83a78b187135cef385665968d487fc98cff563
Instruction Fuzzy Hash: 8E127032A04B8187E760EF2AE8943AEB7A5FB44FA8F900135CA9D47794DF78E545C710

Function 00007FF7C4199E70 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C4199F41
GetProcAddress.KERNEL32 ref: 00007FF7C4199F51

Strings

schannel: SNI or certificate check failed: %s, xrefs: 00007FF7C419AB2D
ntdll, xrefs: 00007FF7C4199F3A
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF7C419A8EF
schannel: unable to allocate memory, xrefs: 00007FF7C419AA47
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF7C419ABE9
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF7C419AB0C, 00007FF7C419AB53
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7C4199FE2
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF7C4199F22
http/1.1, xrefs: 00007FF7C419A953
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7C419A933
schannel: ALPN, offering %s, xrefs: 00007FF7C419A975
wine_get_version, xrefs: 00007FF7C4199F4A
http/1.1, xrefs: 00007FF7C419A967

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 30d76047c308249f6e25c77b9eda1cab9fd5e70497ef2bfb2aeb410cf612d6e4
Instruction ID: 5a4db82b08a05697bfed5e2f9b4661d53ee404fa24cf82ea14c50796bc6da3c1
Opcode Fuzzy Hash: 30d76047c308249f6e25c77b9eda1cab9fd5e70497ef2bfb2aeb410cf612d6e4
Instruction Fuzzy Hash: 20029132A08B8587E720AF26E8803ADB7A5FB54BA8F904135DE9E47795DF38E544C710

Function 00007FF7C417C2D0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C302
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C39D
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF7C417C3B6

Part of subcall function 00007FF7C4194C60: socket.WS2_32 ref: 00007FF7C4194CA1

DeleteCriticalSection.KERNEL32 ref: 00007FF7C417C3F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C3FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C404
closesocket.WS2_32 ref: 00007FF7C417C422
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C458
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417C45E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417C48D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C4A7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417C4B0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417C4E5
EnterCriticalSection.KERNEL32 ref: 00007FF7C417C506
LeaveCriticalSection.KERNEL32 ref: 00007FF7C417C51A
CloseHandle.KERNEL32 ref: 00007FF7C417C527
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C552
closesocket.WS2_32 ref: 00007FF7C417C56B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C57F

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 5d05a290eafb770b4f20be9df5c037b8d3d36d567a95b238c111c5e211464718
Instruction ID: c1885bf999b54ceb5ea47be97479f532d79e9e167ee9e83ed9f4eacb03c681db
Opcode Fuzzy Hash: 5d05a290eafb770b4f20be9df5c037b8d3d36d567a95b238c111c5e211464718
Instruction Fuzzy Hash: A3813F26E05B8187E624EF12F994279B360FB98B68F455235DB9E03762EF78E4D48310

Function 00007FF7C4183940 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF7C4184023
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7C4184192
No connections available in cache, xrefs: 00007FF7C418433B
No more connections allowed to host %s: %zu, xrefs: 00007FF7C41840D2
ftp@example.com, xrefs: 00007FF7C4183AFF
proxy, xrefs: 00007FF7C4184002
No connections available., xrefs: 00007FF7C41840E1
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7C41841C0
anonymous, xrefs: 00007FF7C4183AF8
host, xrefs: 00007FF7C4184010

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: edffa2297fe5d86c1985965ecc49eb7e1276c016a28d551347fee300c03684af
Instruction ID: c19fce8cb51e520979c445ec8a70522cbe813c5974e51ecd0b748d822760f3d3
Opcode Fuzzy Hash: edffa2297fe5d86c1985965ecc49eb7e1276c016a28d551347fee300c03684af
Instruction Fuzzy Hash: A342A622A09BC653EB59EF23A5803B9B391FB45FA8F490135CE9D47745EF28E460C321

Function 00007FF7C4146C60 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 252
filestringpipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146D36
GetLastError.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146D50
WaitNamedPipeW.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146D8F
CreateFileW.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146DC1
memset.VCRUNTIME140(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146DEF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146EEE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4146F69
WriteFile.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4147008
CloseHandle.KERNEL32(?,?,?,00007FF7C4143C8B), ref: 00007FF7C4147044

Strings

DISPATCH, xrefs: 00007FF7C4146EE4
READY, xrefs: 00007FF7C4146EFA
cmd, xrefs: 00007FF7C4146E19
evt, xrefs: 00007FF7C4146E84

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: File$Create$CloseErrorHandleLastNamedPipeWaitWritefreememsetstrcmp
String ID: DISPATCH$READY$cmd$evt
API String ID: 1306779981-563425595
Opcode ID: ffffbbce5e3e7c358ee8c47757bf0661cbe4db33e30e3e20367d01bf71d89886
Instruction ID: d5d1ffa63f7d6ba9b9231de32f25bde4e0472589ac3f4f4b609df457c456d280
Opcode Fuzzy Hash: ffffbbce5e3e7c358ee8c47757bf0661cbe4db33e30e3e20367d01bf71d89886
Instruction Fuzzy Hash: 9FC18422A0868287EB20EF16F4902B9A3A0FB45FBCF945131DADD57694EF3CE551C720

Function 00007FF7C416E7FE Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E963
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E9B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416EA83
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416EA8A

Strings

wc, xrefs: 00007FF7C416E844
8c, xrefs: 00007FF7C416E883
fc, xrefs: 00007FF7C416E855
aa~9, xrefs: 00007FF7C416E826
{tkropt, xrefs: 00007FF7C416E838
{tkr, xrefs: 00007FF7C416E81F
'c, xrefs: 00007FF7C416E894
Lc, xrefs: 00007FF7C416E86F
opt, xrefs: 00007FF7C416E82D

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: aa~9$opt${tkr${tkropt$'c$8c$Lc$fc$wc
API String ID: 3668304517-4281314335
Opcode ID: 7d52879d251e948d455f9dce13de2195ec0aa3bba2bb2191179e321ddfbf8045
Instruction ID: af4a6af9ea803ce4cb14fd8d629c7f22d74d563920ce81e8d8c58495f3879761
Opcode Fuzzy Hash: 7d52879d251e948d455f9dce13de2195ec0aa3bba2bb2191179e321ddfbf8045
Instruction Fuzzy Hash: 5461D262E18B8196FB00EF6AE4943ED6321FB41BACF804631CA9D17AC6DF7CD5858350

Function 00007FF7C4188270 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF7C41882DC
WSAGetLastError.WS2_32 ref: 00007FF7C41882E6

Part of subcall function 00007FF7C4171890: GetLastError.KERNEL32 ref: 00007FF7C41718B2
Part of subcall function 00007FF7C4171890: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41718BA

getsockname.WS2_32 ref: 00007FF7C4188366
WSAGetLastError.WS2_32 ref: 00007FF7C4188370

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF7C4188306
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C418848C
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7C41883F6
getsockname() failed with errno %d: %s, xrefs: 00007FF7C4188390

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 4e8ca920375c8ec092b1c953721ab9fbfbe7887d7be421fc5eda049d73c7ccf8
Instruction ID: a4f8c65d60d0039e02e5560f22e8bf4d97689f4592aa72697d1c1450bb056369
Opcode Fuzzy Hash: 4e8ca920375c8ec092b1c953721ab9fbfbe7887d7be421fc5eda049d73c7ccf8
Instruction Fuzzy Hash: 8D916D26E18AC187E720DF26E4802E9A3A0FB99F9CF845236DE8C47615DF39D185C721

Function 00007FF7C41988D0 Relevance: 19.6, APIs: 13, Instructions: 128networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF7C41988F2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C419895E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198998
memmove.VCRUNTIME140(?,?,?,00007FF7C417C215), ref: 00007FF7C41989B1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C41989BF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C41989FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A03
freeaddrinfo.WS2_32(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A31
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A45
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A4F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A5C
WSASetLastError.WS2_32(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A7D

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemmove
String ID:
API String ID: 2030585312-0
Opcode ID: 785f3b22a0b1322bae2985a9db837513d2b71ff640c43d5c1f8d9d141fd5f23a
Instruction ID: 808dafd9e76d3fc93765676c3edff7ef6db09f98c9bb7dcdce31e82fb96afd0d
Opcode Fuzzy Hash: 785f3b22a0b1322bae2985a9db837513d2b71ff640c43d5c1f8d9d141fd5f23a
Instruction Fuzzy Hash: 78512C36A1974187EA25AF52B994239A7A1FF98FA8F844035CECE13750DF3CE4448724

Function 00007FF7C41961E0 Relevance: 16.7, APIs: 11, Instructions: 241sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7C419623D
Sleep.KERNEL32 ref: 00007FF7C419624E
WSASetLastError.WS2_32 ref: 00007FF7C41963B8
Sleep.KERNEL32 ref: 00007FF7C41963C9
__WSAFDIsSet.WS2_32 ref: 00007FF7C419647C
__WSAFDIsSet.WS2_32 ref: 00007FF7C4196493
__WSAFDIsSet.WS2_32 ref: 00007FF7C41964AE
__WSAFDIsSet.WS2_32 ref: 00007FF7C41964C2
__WSAFDIsSet.WS2_32 ref: 00007FF7C41964DD
__WSAFDIsSet.WS2_32 ref: 00007FF7C41964F1

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 2e904bbcd3946398438d8159249f570fd3e2dce51e2e8286323b97aaeb071608
Instruction ID: 309e7705726aee889a0237425a7ff20a1e4f464dd85e8bd29e639171d882a8a5
Opcode Fuzzy Hash: 2e904bbcd3946398438d8159249f570fd3e2dce51e2e8286323b97aaeb071608
Instruction Fuzzy Hash: C391EA21B0C6428BE7686E56BDC41B9A392BB64B6CF904135E99D87BC4DE3CDA418230

Function 00007FF7C41592C0 Relevance: 16.6, APIs: 11, Instructions: 126COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7C41592FD
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415931C
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415934E
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C4159369
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415938F
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C41593AC
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C41593D3
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415941E

Part of subcall function 00007FF7C4159750: ??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C415977D
Part of subcall function 00007FF7C4159750: ??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C4159797
Part of subcall function 00007FF7C4159750: ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41597C9
Part of subcall function 00007FF7C4159750: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41597F4
Part of subcall function 00007FF7C4159750: std::_Facet_Register.LIBCPMT ref: 00007FF7C415980D
Part of subcall function 00007FF7C4159750: ??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C415982C

?always_noconv@codecvt_base@std@@QEBA_NXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C4159433
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415944A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,00000000,00007FF7C4154D1D), ref: 00007FF7C415948B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$Init@?$basic_streambuf@$Lockit@std@@$??0?$basic_ios@??0?$basic_istream@??0?$basic_streambuf@??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Bid@locale@std@@D@std@@@1@_Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@V?$basic_streambuf@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 3731820665-0
Opcode ID: d40533ed72d45aa00a05f75889ffe4d46e7ff0534484c2ed7ea8f676f4ebf572
Instruction ID: 7f8b70ca3505516f67a9a12ded9d78156bc285e4070b11ba3ceaa922a9cebb92
Opcode Fuzzy Hash: d40533ed72d45aa00a05f75889ffe4d46e7ff0534484c2ed7ea8f676f4ebf572
Instruction Fuzzy Hash: 8E513832A09B8187EB10DF2AF890269B7A4FB89F98F544035CA8E43B28DF3CD454C750

Function 00007FF7C41711D2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
%s - %s, xrefs: 00007FF7C4171629
SEC_E_BAD_BINDINGS, xrefs: 00007FF7C41711D2

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 5fc562e4b6e15ba88f1f89897622d30c8a78dcca1307b9c8f8ee7024db9c0b67
Instruction ID: 098526716567f23e4406951b8a0629407d5ebac55293c8dd376a195ced33638a
Opcode Fuzzy Hash: 5fc562e4b6e15ba88f1f89897622d30c8a78dcca1307b9c8f8ee7024db9c0b67
Instruction Fuzzy Hash: CC313262A0C7C187E635AF61B4943AAA7A5FB85B68FC40035DACD02B55DF3CD9448720

Function 00007FF7C4171202 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

SEC_E_CANNOT_PACK, xrefs: 00007FF7C4171202
%s (0x%08X), xrefs: 00007FF7C4171125
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 7578fe3012f49a859624df38652462464dab63256e7888dda25ecf9bcf171211
Instruction ID: 147f2ed9fb3d4bcb25def50ca1e832498742d19273a9378fc4bf93d793bd76ed
Opcode Fuzzy Hash: 7578fe3012f49a859624df38652462464dab63256e7888dda25ecf9bcf171211
Instruction Fuzzy Hash: 55313262A0C6C18BE635AF61B4943AAA7A5FB85B68FC40035DACD02B95DF3CD944C720

Function 00007FF7C417120E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
SEC_E_CERT_EXPIRED, xrefs: 00007FF7C417120E
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: a1c265ca3acc15e4f279b215c9a45adec1b75f6f820d9362bffb6af321e81e0c
Instruction ID: 7322240a0503fc48ab675260d33b2522588f1c2f0db0412b4f12908a0b9375a2
Opcode Fuzzy Hash: a1c265ca3acc15e4f279b215c9a45adec1b75f6f820d9362bffb6af321e81e0c
Instruction Fuzzy Hash: 6B313262A0C6C187E635AF61B4953AAA7A5FB85B68FC40035DACD02B55DF3CD9448720

Function 00007FF7C41711DE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
SEC_E_BAD_PKGID, xrefs: 00007FF7C41711DE
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 6db1ffd50240426916ba2374a268fc2fc9a50b603492c6ff0571527b9e158fc6
Instruction ID: 8277079ca693d880d4790663fbdeb5a10589b8ed694d0dd55f90837dab2ea987
Opcode Fuzzy Hash: 6db1ffd50240426916ba2374a268fc2fc9a50b603492c6ff0571527b9e158fc6
Instruction Fuzzy Hash: 57313262A0C6C187E635AF61B4943AAA7A5FB85B68FC40035DACD02B95DF3CD9448720

Function 00007FF7C41711EA Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF7C41711EA
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: de96f32c4f3bb04fb0119059d6572de3eda57499a4c690ad10b793e4d22a13d3
Instruction ID: 78173d86606ed6cdc80496e8a9f0b6068593c2a0f4158ad21b0e3ca94e89556a
Opcode Fuzzy Hash: de96f32c4f3bb04fb0119059d6572de3eda57499a4c690ad10b793e4d22a13d3
Instruction Fuzzy Hash: 9E313262A0C6C187E635AF61B4943AAA7A5FB85B68FC40035DACD02B95DF3CD9448720

Function 00007FF7C41711F6 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
SEC_E_CANNOT_INSTALL, xrefs: 00007FF7C41711F6
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: d806b9af4ebe440079ac050810bb0f8dacf854d1c4374348e877d2963df66731
Instruction ID: 353b88b9598b3079c52120840887734c70d58a3d03fdcbc341009fa7f48d2b65
Opcode Fuzzy Hash: d806b9af4ebe440079ac050810bb0f8dacf854d1c4374348e877d2963df66731
Instruction Fuzzy Hash: D0313262A0C6C187E635AF61B4943AAA7A5FB85B68FC40035DACD02B55DF3CD944C720

Function 00007FF7C417121A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

SEC_E_CERT_UNKNOWN, xrefs: 00007FF7C417121A
%s (0x%08X), xrefs: 00007FF7C4171125
%s - %s, xrefs: 00007FF7C4171629

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: b4fc1ef068f92bf483523780863403f1902ff9be0f6395ff6d768ac462e58b25
Instruction ID: 6b2859a0011dee713fc6db23ce1f379c8677f6edc646a1d7e0ba085677716d05
Opcode Fuzzy Hash: b4fc1ef068f92bf483523780863403f1902ff9be0f6395ff6d768ac462e58b25
Instruction Fuzzy Hash: BF313262A0C6C187E635AF61B4953AAA7A5FB85B68FC40035DACD02B95DF3CD9448720

Function 00007FF7C417111E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C4171179
strchr.VCRUNTIME140 ref: 00007FF7C41711A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417163F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417164A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4171655
GetLastError.KERNEL32 ref: 00007FF7C417165E
SetLastError.KERNEL32 ref: 00007FF7C417166A

Strings

%s (0x%08X), xrefs: 00007FF7C4171125
%s - %s, xrefs: 00007FF7C4171629
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF7C417111E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: fcc2513ea6eaf2474b868cad5887f4fa0cc0c4532daad8c559d63ef346117a92
Instruction ID: a72148c02212e2583002c9a8d9e5a7e8ecd45d49afc97b2c36e586064b6d6835
Opcode Fuzzy Hash: fcc2513ea6eaf2474b868cad5887f4fa0cc0c4532daad8c559d63ef346117a92
Instruction Fuzzy Hash: AC313062A0C6C18BEA31AF61B4943AAA795FB85B68FC40035DACD02B55DF3CD9448720

Function 00007FF7C41828D0 Relevance: 15.2, APIs: 10, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C4172451,?,?,?,?,00007FF7C416E772), ref: 00007FF7C41828E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4182931

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: callocfree
String ID:
API String ID: 306872129-0
Opcode ID: b2d62bd4ee0d3176f64a18890ff3bd5a2ee5f42f53e8f0c709cf6e5a5bf30e77
Instruction ID: 77b2b956510ea66cb7d8335bc6808f08be684b7c5998ff171eb2531ce179e16d
Opcode Fuzzy Hash: b2d62bd4ee0d3176f64a18890ff3bd5a2ee5f42f53e8f0c709cf6e5a5bf30e77
Instruction Fuzzy Hash: D5914E32908BC186E3119F35E4443E877A0FB59F6CF485239CE991B39ADFB99195C720

Function 00007FF7C4185F10 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4185F5F

Strings

Couldn't resolve proxy '%s', xrefs: 00007FF7C418613C
Unix socket path too long: '%s', xrefs: 00007FF7C4185FB6
Couldn't resolve host '%s', xrefs: 00007FF7C4186091

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: 47f813c136bca1cc7a46e4d3a5c4252b027ace10dc816a15cda618fa8371b37d
Instruction ID: 9456b0a1a4afb3d3156e671bf091e939a846bd773dbea68704c901bc3502cf22
Opcode Fuzzy Hash: 47f813c136bca1cc7a46e4d3a5c4252b027ace10dc816a15cda618fa8371b37d
Instruction Fuzzy Hash: 1751C526B0CB4287F619AF26B4D037AA790EB84FA8F550031DB8D43792DF3DE8558721

Function 00007FF7C4146930 Relevance: 13.6, APIs: 9, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4143C10: _Xtime_get_ticks.MSVCP140 ref: 00007FF7C4143C6C

_Mtx_lock.MSVCP140 ref: 00007FF7C414698A
_Xtime_get_ticks.MSVCP140 ref: 00007FF7C41469A8
_Mtx_current_owns.MSVCP140 ref: 00007FF7C41469E2
_Cnd_timedwait.MSVCP140 ref: 00007FF7C41469F8

Part of subcall function 00007FF7C4143C10: memset.VCRUNTIME140 ref: 00007FF7C4143C9F

_Mtx_unlock.MSVCP140 ref: 00007FF7C4146A06
_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 00007FF7C4146A1A
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4146A5B
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4146A6E
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7C4146A7A

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Cpp_error@std@@Throw_$Xtime_get_ticks$Cnd_do_broadcast_at_thread_exitCnd_timedwaitMtx_current_ownsMtx_lockMtx_unlockmemset
String ID:
API String ID: 1017179710-0
Opcode ID: 81644a0eef17cc88585d4caa169bf76818bc4ecd8546b04ff1047519d21baaaf
Instruction ID: 7c5e0dfd8ebcfb513ca24b53a8e607060e5066dfa73b27afcb7b7a1a09456d20
Opcode Fuzzy Hash: 81644a0eef17cc88585d4caa169bf76818bc4ecd8546b04ff1047519d21baaaf
Instruction Fuzzy Hash: 27319231A18B8287E714AF17F890269A3A0FB84FA9F949035DBCE47794DF3CE4258710

Function 00007FF7C416A680 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4160A50: memmove.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00007FF7C416A6C0), ref: 00007FF7C4160B5E
Part of subcall function 00007FF7C4160A50: memmove.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00007FF7C416A6C0), ref: 00007FF7C4160B6D

memmove.VCRUNTIME140 ref: 00007FF7C416A6FF
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A772
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A7AC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A7FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A87D

Strings

&& timeout /t 5", xrefs: 00007FF7C416A6F5, 00007FF7C416A713
start cmd /C "color b && title Error && echo , xrefs: 00007FF7C416A6AF

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$system
String ID: && timeout /t 5"$start cmd /C "color b && title Error && echo
API String ID: 1752041281-3357973498
Opcode ID: 1a48badb80918005a4a06b4d1308b8511d1b77aeffac83fd6a9d692f96e83253
Instruction ID: e9bc32d74611ff7499d5bba3dc39323cf9c4a0dea4836e6a5d01aacd2aaba337
Opcode Fuzzy Hash: 1a48badb80918005a4a06b4d1308b8511d1b77aeffac83fd6a9d692f96e83253
Instruction Fuzzy Hash: 3751A262A18B8583EA10DF26F5843ADA361FB85BE8F905235DBDD03A95DF7CD084C350

Function 00007FF7C41BF884 Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C41BF8AD
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C41BF91B
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF969
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF96E
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF976
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF97E
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF9A0
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41BF9FA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: eff7ce2f4848a336f84a8afada40722879e5c2b17aa7a74de101bdbaebf573f2
Instruction ID: 67603c0ef589528e715cca91971ddbb3524044955e66f802140bd66177b1af39
Opcode Fuzzy Hash: eff7ce2f4848a336f84a8afada40722879e5c2b17aa7a74de101bdbaebf573f2
Instruction Fuzzy Hash: EB313A61E082425BFA20BF67B8D13B9A651AF45FACFC44035EECD872D7CE2CA4458270

Function 00007FF7C417C1C0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41988D0: getaddrinfo.WS2_32 ref: 00007FF7C41988F2
Part of subcall function 00007FF7C41988D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C419895E
Part of subcall function 00007FF7C41988D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198998
Part of subcall function 00007FF7C41988D0: memmove.VCRUNTIME140(?,?,?,00007FF7C417C215), ref: 00007FF7C41989B1
Part of subcall function 00007FF7C41988D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C41989BF
Part of subcall function 00007FF7C41988D0: freeaddrinfo.WS2_32(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A31
Part of subcall function 00007FF7C41988D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A45
Part of subcall function 00007FF7C41988D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A4F
Part of subcall function 00007FF7C41988D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C215), ref: 00007FF7C4198A5C

WSAGetLastError.WS2_32 ref: 00007FF7C417C21B
WSAGetLastError.WS2_32 ref: 00007FF7C417C225
EnterCriticalSection.KERNEL32 ref: 00007FF7C417C240
LeaveCriticalSection.KERNEL32 ref: 00007FF7C417C24F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417C260
send.WS2_32 ref: 00007FF7C417C283
WSAGetLastError.WS2_32 ref: 00007FF7C417C28D
LeaveCriticalSection.KERNEL32 ref: 00007FF7C417C2A0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemmovesend
String ID:
API String ID: 3577680466-0
Opcode ID: 5f34689dccec7763c3bcacda852f7777a1baac8e3d638eb1f751b1e07d39df43
Instruction ID: cf7d5dda2fca8fc5ca328e634142bc523dce377a433a6dfbcdfda507b099c119
Opcode Fuzzy Hash: 5f34689dccec7763c3bcacda852f7777a1baac8e3d638eb1f751b1e07d39df43
Instruction Fuzzy Hash: 5F317731A0864287E750AF66F890269B3A0FF84FBCF940135DA9E83694DF3CD885C760

Function 00007FF7C4195E40 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7C4195EA6
WSASetLastError.WS2_32 ref: 00007FF7C4196066
Sleep.KERNEL32 ref: 00007FF7C4196076
__WSAFDIsSet.WS2_32 ref: 00007FF7C419618A
__WSAFDIsSet.WS2_32 ref: 00007FF7C41961A2
Sleep.KERNEL32 ref: 00007FF7C41961CD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 82b7a133b29c5d0416ffec955c730a14cdf0918f8e1a714710e89ac833011534
Instruction ID: b4bad6c8cb3d9f3e156c8687318ea75ed7f36545eef53e87da29672db8ec6a9c
Opcode Fuzzy Hash: 82b7a133b29c5d0416ffec955c730a14cdf0918f8e1a714710e89ac833011534
Instruction Fuzzy Hash: 2DA1F922A1865287EB696F16BC80279A296FF64FB8F944235E99A477C4DF3DD4008320

Function 00007FF7C41990B0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41992DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419931F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4199347
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4199389

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF7C41991B8
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF7C419912E
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7C41992A3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: 0ee4f6ebc14d96f5a78d7d8c05b8683bf4884315ea0d91adb8cb6726cfcb0d95
Instruction ID: 0fec237be1a24ffaa9b175d6956fa54d79db952b13de955c187fec2682abe185
Opcode Fuzzy Hash: 0ee4f6ebc14d96f5a78d7d8c05b8683bf4884315ea0d91adb8cb6726cfcb0d95
Instruction Fuzzy Hash: EB915B36A04F8186EB10DF26E8946AD77A4FB88FA9F840135CE8D47BA4DF38D545CB10

Function 00007FF7C4177D30 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C417BF70: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C0C3
Part of subcall function 00007FF7C417BF70: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C0D7
Part of subcall function 00007FF7C417BF70: CloseHandle.KERNEL32(?,?,?,?), ref: 00007FF7C417C0E4
Part of subcall function 00007FF7C417BF70: closesocket.WS2_32 ref: 00007FF7C417C124
Part of subcall function 00007FF7C417BF70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C13D

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4177D7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4177D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4177EC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4177EEE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF7C4177FAB
%s, xrefs: 00007FF7C4177FF7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$CriticalSection$CloseEnterHandleLeaveclosesocket
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1742564213-118628944
Opcode ID: 72d500bfa27e992c650a12bc18f9d0cc26959ef9f23b724bb2ab25dd527cd50a
Instruction ID: 27e351c57e8f40bcd421a9de12a13c4960f3a591e5cffde8fbfa0e9d874c7524
Opcode Fuzzy Hash: 72d500bfa27e992c650a12bc18f9d0cc26959ef9f23b724bb2ab25dd527cd50a
Instruction Fuzzy Hash: BF913132F0868183E759BF26B6943B9A391FB45FA8F844431DE9D47755CF38E8608760

Function 00007FF7C41821B0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41821DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41821F1

Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418200D
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418202A
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418203E
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418205A
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C4182077
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418209A
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41820AE
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41820C2
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41820E8
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41820FC
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C4182110
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418215F
Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418216C

Part of subcall function 00007FF7C4181F90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4182195

memset.VCRUNTIME140 ref: 00007FF7C4182225

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7C4182401
User-Agent: %s, xrefs: 00007FF7C41822BF

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: a28a128eb6dffa5aa405572c3a199ab602f93f9098cb33351c1167319e743714
Instruction ID: d769f1b98be65f9050f632e196a8631d0d3e4b957008ce46ea5115deb4503186
Opcode Fuzzy Hash: a28a128eb6dffa5aa405572c3a199ab602f93f9098cb33351c1167319e743714
Instruction Fuzzy Hash: 8A71632290CBC186E752EF26E4903BDA751EB45FA8F894131DFDD0B286DF78E4418362

Function 00007FF7C4154CA0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C4154D01
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z.MSVCP140 ref: 00007FF7C4154D58
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7C4154DA0
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7C4154DAE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4154E20
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ.MSVCP140 ref: 00007FF7C4154E7C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_istream@$??1?$basic_ios@?widen@?$basic_ios@_invalid_parameter_noinfo_noreturnmemset
String ID:
API String ID: 6499212-0
Opcode ID: 4b492516429974d73597a34fe802142468ada099d3fa598b4af816153ffa8803
Instruction ID: 1cd30c36bba55d6fdbc538a82ea0a0436f69622d3e5e60389aef71314da30830
Opcode Fuzzy Hash: 4b492516429974d73597a34fe802142468ada099d3fa598b4af816153ffa8803
Instruction Fuzzy Hash: A2518D32A18B8586DB10DF2AF4843AEB761FB84F99F848035DA8D43665DF7CD455CB10

Function 00007FF7C4151870 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7C4151A0A
CloseHandle.KERNEL32 ref: 00007FF7C4151A20
CloseHandle.KERNEL32 ref: 00007FF7C4151ADA

Strings

\\.\TRW, xrefs: 00007FF7C415194A
RBOOT, xrefs: 00007FF7C415197C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: CloseHandle$CreateFile
String ID: RBOOT$\\.\TRW
API String ID: 1378612225-3026008024
Opcode ID: 008431e7ccf701031be08e6743ab85f3a48d635a097aaf7dceb0b3dde1b3e5d5
Instruction ID: 6b4a227f5a04ee9d2175aba1b2ad5b9dfaefd08d2d0a5e07c5b4cbd277bd24b1
Opcode Fuzzy Hash: 008431e7ccf701031be08e6743ab85f3a48d635a097aaf7dceb0b3dde1b3e5d5
Instruction Fuzzy Hash: 9E819136E18B818AE712DF66E4802A9B7B0FB4AB68F505236DE9D53754EB3CD085C710

Function 00007FF7C4186E40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186F06
recv.WS2_32 ref: 00007FF7C4186F30
send.WS2_32 ref: 00007FF7C4186F53
WSAGetLastError.WS2_32 ref: 00007FF7C4186F65

Strings

Send failure: %s, xrefs: 00007FF7C4186F95

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: 088f2d54bbb428d18878f8d9ef195428184d83b7f7bfa4200649c220535cd6dc
Instruction ID: f743d31dc939d065fef4db98a544b3a6ac49c0e9c7af074ea840bd21a7abf99d
Opcode Fuzzy Hash: 088f2d54bbb428d18878f8d9ef195428184d83b7f7bfa4200649c220535cd6dc
Instruction Fuzzy Hash: 5641BC72B05B8186EB60AF26F890779A290AB08FBCF854235DEAD47785DF3CD450C310

Function 00007FF7C414C240 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C414C25A
GetProcAddress.KERNEL32 ref: 00007FF7C414C3F4
VirtualProtect.KERNEL32 ref: 00007FF7C414C413

Strings

ntdll.dll, xrefs: 00007FF7C414C253
nP)/6C, xrefs: 00007FF7C414C273

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: nP)/6C$ntdll.dll
API String ID: 2099061454-471648349
Opcode ID: 5d8b1d8e658ac78b20eb60263d39517ef5931efdf79a7fe07972142ef8e83e5f
Instruction ID: 365cb3965c3f529b2e2523f32a1218943557a3481c3de0f11699b2960361c031
Opcode Fuzzy Hash: 5d8b1d8e658ac78b20eb60263d39517ef5931efdf79a7fe07972142ef8e83e5f
Instruction Fuzzy Hash: E4513966D1DB8247EB13AF36B881074E750AF5AB98F80D336E9C931A51FF2DE2418614

Function 00007FF7C4176BF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4176C0D
closesocket.WS2_32 ref: 00007FF7C4176D19
closesocket.WS2_32 ref: 00007FF7C4176D26

Strings

d, xrefs: 00007FF7C4176CB9

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: closesocket$calloc
String ID: d
API String ID: 2958813939-2564639436
Opcode ID: b42c4628c2429037b5cdd668abfe90ece5f2e129eaf48b38d81682e9d9956e6b
Instruction ID: 2d558bfccfade9c0cd12da4e96e5d0c2d3c3e06a557912a3cd9854f7fa2edd50
Opcode Fuzzy Hash: b42c4628c2429037b5cdd668abfe90ece5f2e129eaf48b38d81682e9d9956e6b
Instruction Fuzzy Hash: 93411035A1874282E750BF36E4902E9A361FB98B7CFC54131DE9D8A2D6EF38D9458321

Function 00007FF7C41B2370 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4189530: GetModuleHandleA.KERNEL32(00000000,?,00000000,00007FF7C41B23AA,?,?,?,?,00007FF7C41898BB), ref: 00007FF7C4189544

GetProcAddress.KERNEL32(?,?,?,?,00007FF7C41898BB), ref: 00007FF7C41B23C0

Strings

secur32.dll, xrefs: 00007FF7C41B2393
InitSecurityInterfaceA, xrefs: 00007FF7C41B23B6
security.dll, xrefs: 00007FF7C41B239A

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 1646373207-3788156360
Opcode ID: fe5788ad3959305cfce3ba41362fea9792a8e2d0f9b3483cf684791c3aff5b82
Instruction ID: 3478629ed6c76e2955f4f0113450cae9defdd99f6546da2a7dc9ca6bbded8c82
Opcode Fuzzy Hash: fe5788ad3959305cfce3ba41362fea9792a8e2d0f9b3483cf684791c3aff5b82
Instruction Fuzzy Hash: 52F01960F09B0283FE64BF12B9D577093916F18F68FC80434C98D426A0EE6CA19D8321

Function 00007FF7C41914D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41915D0

Part of subcall function 00007FF7C4191B60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191BBA

Part of subcall function 00007FF7C4191910: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41919A8
Part of subcall function 00007FF7C4191910: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41919B1

Strings

TCP4, xrefs: 00007FF7C419156A
PROXY %s %s %s %li %li, xrefs: 00007FF7C41915A4
TCP6, xrefs: 00007FF7C4191557

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: bd2a5a362163a1c3c6f6062036447e602a6c83f98aaa5b9671240220fdec9c45
Instruction ID: 9df69ee35e798008a1cf69957f2c9c39cc490b29897e382ef20284b0c919ed91
Opcode Fuzzy Hash: bd2a5a362163a1c3c6f6062036447e602a6c83f98aaa5b9671240220fdec9c45
Instruction Fuzzy Hash: 4641BB71E0C68247F750EF26B8903B9A7A1AB95BACF984036DACD47685DE7CD444C720

Function 00007FF7C4199C80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF7C4199DC3
SSL/TLS connection timeout, xrefs: 00007FF7C4199DDC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: ca09f9469a07117a51d350654f8b058deb309a54403bb35f61471f118e5f1bfb
Instruction ID: a0d52e0a33281124c32dec65f90e72e9a21333a9d6064a0add3375426496510c
Opcode Fuzzy Hash: ca09f9469a07117a51d350654f8b058deb309a54403bb35f61471f118e5f1bfb
Instruction Fuzzy Hash: DD518421B1864687EB54AF22ADC427AA792EB64FBCF944235DA9D473D1DF3CE441C320

Function 00007FF7C4150150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF7C4150177
OpenFileMappingW.KERNEL32 ref: 00007FF7C4150250

Strings

_I6, xrefs: 00007FF7C41502A3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: FileFindMappingOpenWindow
String ID: _I6
API String ID: 2657998760-3342240918
Opcode ID: 95a0389fac39110eaafebdfcad6d335d4525ab13e7cf9d9046af721cf619aba5
Instruction ID: d5fc331433cfb3f28eaa09317181e27f36170f47a488fd7855e0498e218269bd
Opcode Fuzzy Hash: 95a0389fac39110eaafebdfcad6d335d4525ab13e7cf9d9046af721cf619aba5
Instruction Fuzzy Hash: F751AF32B04A558BDB28DF5AE4D0AB8BB71FB85F58F948126CA8E03754CF39E815C710

Function 00007FF7C4182EB0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4182F15

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7C4183054
User-Agent: %s, xrefs: 00007FF7C4182F26

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: 6598e2191999e06cc3f84cdd88f7f733fadba054a2fff76f565a981cc35b0efb
Instruction ID: e07ac941617ab3b05e0b081b015beb87bcac106efe6c28cfcd622ccfc3120136
Opcode Fuzzy Hash: 6598e2191999e06cc3f84cdd88f7f733fadba054a2fff76f565a981cc35b0efb
Instruction Fuzzy Hash: 5B518462A08AC182E7519F26E4803ADA750E785FACF8C4131DF9C0B39ADF7DD591C321

Function 00007FF7C4141100 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 00007FF7C414110D

Strings

Shell_TrayWnd, xrefs: 00007FF7C4141106

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: FindWindow
String ID: Shell_TrayWnd
API String ID: 134000473-2988720461
Opcode ID: 4986cc9439b392de3528393d0828bd77597dfe70ea1a7d70101ccca469f97a05
Instruction ID: 5946e480b150476a0a3a60fa24374a5751be722dfbf16687b4227549ba05ee71
Opcode Fuzzy Hash: 4986cc9439b392de3528393d0828bd77597dfe70ea1a7d70101ccca469f97a05
Instruction Fuzzy Hash: A0C04C25E5AA52D3E719FF13FCC106462A1AB98B24FD54031C59D012209D3C569A8760

Function 00007FF7C4186C60 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7C4186C6C
WSAGetLastError.WS2_32 ref: 00007FF7C4186C7B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 31fde0d77fca9be4ff6ab238c8a7155cffcf7ada8e5832acd849a67c8b8655be
Instruction ID: 96a71b0a45e8ad99186d4e73cf98ba6540a3a4ff843c2a47c93d1777b10e071a
Opcode Fuzzy Hash: 31fde0d77fca9be4ff6ab238c8a7155cffcf7ada8e5832acd849a67c8b8655be
Instruction Fuzzy Hash: 5FE0DF21F0460943FF286F72B89573812D0CB54B36F884334CA7A863C0CA2C44D68310

Function 00007FF7C418E2F0 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7C418E319

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: a2bece2981595bf886521fc655bcc31f980d62e1ba07d56a841d5b86e74eb8d2
Instruction ID: c8f47ac8f9843b7829cb73cfe80f80d253ba00e060451918a2cf9d00be0eb6b2
Opcode Fuzzy Hash: a2bece2981595bf886521fc655bcc31f980d62e1ba07d56a841d5b86e74eb8d2
Instruction Fuzzy Hash: 22E09236F0660183DE18BF3798D12B92360AB50B38FD55371CA7D467D0DE2DE6569B10

Function 00007FF7C4198F50 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4198F6B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 523010f792cf80407fa6ba54d0fad46fd14b07c5aaa12e2dc1ea6e4bef6ea2f2
Instruction ID: 9d7bad9b7336c03b0c25b1be2b227235226ed6e12332d123b26fc116e97eade9
Opcode Fuzzy Hash: 523010f792cf80407fa6ba54d0fad46fd14b07c5aaa12e2dc1ea6e4bef6ea2f2
Instruction Fuzzy Hash: 28D02B63B18A00439F24DF72AC40029E351B78C774B884338AE7D82BE0DB3CD1454600

Function 00007FF7C415A4E0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 00007FF7C415A4EB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Cnd_do_broadcast_at_thread_exit
String ID:
API String ID: 2632783013-0
Opcode ID: e11524b6c8e944ceaa45ca8bd353642313b658d10b9561499b48361e0df600b6
Instruction ID: 45f2b1d83e6fd201412fe8d9947788f7c1aac722c7e27db6fae7d967d5e28503
Opcode Fuzzy Hash: e11524b6c8e944ceaa45ca8bd353642313b658d10b9561499b48361e0df600b6
Instruction Fuzzy Hash: D8C08C80F2020283EB243FB3B8862AE4250AF89F25F985030CD8689751DD2D84DE8710

Function 00007FF7C4194E90 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7C4194EA9

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 3053710e576a1c2b00801a0c18e0f520af9e9e9d1ba02976cc129279527279db
Instruction ID: f3a36947d6fd95d69e9a11c65877bb0b55bc3d1defcec78d1b79679293f4ba24
Opcode Fuzzy Hash: 3053710e576a1c2b00801a0c18e0f520af9e9e9d1ba02976cc129279527279db
Instruction Fuzzy Hash: 0FC08016F14681C7C3486F6258C5087A7B1EBC4618FD57435D24741124DD3CC2E58B40

Function 00007FF7C41C0560 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7C41C0572

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9ac26b2a8ccf57baaac75e74821fb1369a2aa0f1093208d0923b09893856d63a
Instruction ID: 94e178881f3269c7f5369ba15ab269e728093bafb5b02bd9f5f5443bd9e6b4c6
Opcode Fuzzy Hash: 9ac26b2a8ccf57baaac75e74821fb1369a2aa0f1093208d0923b09893856d63a
Instruction Fuzzy Hash: 6CC08C59F21900CFEB19AFB2AC4503483209F59F68F988830DD8D0A2208E0890924120

Non-executed Functions

Function 00007FF7C418F790 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418F868
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418F875
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418F948
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418F9CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FA73
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FB0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FBD5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FC0D
strchr.VCRUNTIME140 ref: 00007FF7C418FD87
strchr.VCRUNTIME140 ref: 00007FF7C418FD9A
strchr.VCRUNTIME140 ref: 00007FF7C418FDAC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FEB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FF23
memmove.VCRUNTIME140 ref: 00007FF7C418FF4A
strchr.VCRUNTIME140 ref: 00007FF7C418FF5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418FF72
strstr.VCRUNTIME140 ref: 00007FF7C41901A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41902E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4190459

Part of subcall function 00007FF7C4175190: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4175203

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419050C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4190591
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41907EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4190800
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419080F

Part of subcall function 00007FF7C4191B60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191BBA

strchr.VCRUNTIME140 ref: 00007FF7C4190DC7
strchr.VCRUNTIME140 ref: 00007FF7C4190DDA
strchr.VCRUNTIME140 ref: 00007FF7C4190DEC

Part of subcall function 00007FF7C4191B60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191BDA
Part of subcall function 00007FF7C4191B60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191BE3

strchr.VCRUNTIME140 ref: 00007FF7C419103F
strchr.VCRUNTIME140 ref: 00007FF7C4191052
strchr.VCRUNTIME140 ref: 00007FF7C4191064

Part of subcall function 00007FF7C4194190: strchr.VCRUNTIME140 ref: 00007FF7C4194276
Part of subcall function 00007FF7C4194190: strchr.VCRUNTIME140 ref: 00007FF7C4194289
Part of subcall function 00007FF7C4194190: strchr.VCRUNTIME140 ref: 00007FF7C419429B

Strings

Transfer-Encoding:, xrefs: 00007FF7C418FD3E
%s%s, xrefs: 00007FF7C41909A0
If-Unmodified-Since, xrefs: 00007FF7C4190A54
Cookie: , xrefs: 00007FF7C41908FE, 00007FF7C4190974
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7C419136E
%s, xrefs: 00007FF7C4190D43
chunked, xrefs: 00007FF7C418FDC6
Content-Range, xrefs: 00007FF7C419043E
%x, xrefs: 00007FF7C4191165
HEAD, xrefs: 00007FF7C418F8D1
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7C41907CB
http, xrefs: 00007FF7C419010B
Accept, xrefs: 00007FF7C4190263
%s , xrefs: 00007FF7C4190523
Content-Length: %I64d, xrefs: 00007FF7C4190BBB, 00007FF7C4190D10, 00007FF7C4190F95
;type=%c, xrefs: 00007FF7C4190211
POST, xrefs: 00007FF7C418F915
Transfer-Encoding: chunked, xrefs: 00007FF7C418FE7F
0, xrefs: 00007FF7C41911B6, 00007FF7C41912B5
Host: %s%s%s:%d, xrefs: 00007FF7C4190072
Content-Length, xrefs: 00007FF7C4190BA4, 00007FF7C4190CF9, 00007FF7C4190F7E
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF7C418FE8C
Failed sending PUT request, xrefs: 00007FF7C4190C39
?%s, xrefs: 00007FF7C41905FB
Expect:, xrefs: 00007FF7C4190D85, 00007FF7C4190FFA
Host:, xrefs: 00007FF7C418FF81
Last-Modified, xrefs: 00007FF7C4190A4B
Accept: */*, xrefs: 00007FF7C4190275
Could only read %I64d bytes from the input, xrefs: 00007FF7C4190415
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7C4190498
Host:%s, xrefs: 00007FF7C418FFB6
Invalid TIMEVALUE, xrefs: 00007FF7C4190A13
Content-Range: bytes %s/%I64d, xrefs: 00007FF7C41904A6
multipart/form-data, xrefs: 00007FF7C418FCBA
Referer, xrefs: 00007FF7C418FB23
Accept-Encoding, xrefs: 00007FF7C418FBB1
GET, xrefs: 00007FF7C418F922
Proxy-Connection: Keep-Alive, xrefs: 00007FF7C419068F, 00007FF7C41906A4
ftp, xrefs: 00007FF7C4190179
Could not seek stream, xrefs: 00007FF7C4190358
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7C4190474
%s?%s, xrefs: 00007FF7C418F965
Failed sending POST request, xrefs: 00007FF7C4190C99, 00007FF7C4190EDD
;type=, xrefs: 00007FF7C419019E
%s%s=%s, xrefs: 00007FF7C4190919
Range: bytes=%s, xrefs: 00007FF7C41902EE
OPTIONS, xrefs: 00007FF7C418F8FB
ftp://%s:%s@%s, xrefs: 00007FF7C41905BB
Accept-Encoding: %s, xrefs: 00007FF7C418FBE2
Expect, xrefs: 00007FF7C4190D64, 00007FF7C4190FD9
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7C4190AE4
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7C4190FC1
User-Agent, xrefs: 00007FF7C418F92D
PUT, xrefs: 00007FF7C418F908
Content-Type, xrefs: 00007FF7C418FC77, 00007FF7C4190FAD
Proxy-Connection, xrefs: 00007FF7C4190663
Content-Length: 0, xrefs: 00007FF7C4190C60
Cookie, xrefs: 00007FF7C418FB92
If-Modified-Since, xrefs: 00007FF7C4190A5D
Failed sending HTTP request, xrefs: 00007FF7C4190F36
File already completely uploaded, xrefs: 00007FF7C41903F9
Range, xrefs: 00007FF7C41902C2
Failed sending HTTP POST request, xrefs: 00007FF7C419126B
1.0, xrefs: 00007FF7C41904F0
Transfer-Encoding, xrefs: 00007FF7C418FD1D
1.1, xrefs: 00007FF7C41904FE
Host: %s%s%s, xrefs: 00007FF7C419002D
Referer: %s, xrefs: 00007FF7C418FB3E
Host, xrefs: 00007FF7C418FEB9
100-continue, xrefs: 00007FF7C4190E06, 00007FF7C4191086

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemmovestrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 3050856829-4264080130
Opcode ID: fb5b63b42484928773a87ff23c7afc13d01d0dcf6659fa3f65ff3d35cd128a5d
Instruction ID: 1573e3d7c4bf1b27bcfdf6b0a0057961247b5d46b12559c2bee879bab440b6ee
Opcode Fuzzy Hash: fb5b63b42484928773a87ff23c7afc13d01d0dcf6659fa3f65ff3d35cd128a5d
Instruction Fuzzy Hash: C703C221A0868287FB24AF23A8D03B9A7A1AF55FBCF844035CE8D57695DF3DE445C321

Function 00007FF7C419A13D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C419A298
strchr.VCRUNTIME140 ref: 00007FF7C419A2C4
strchr.VCRUNTIME140 ref: 00007FF7C419A2FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A322
strchr.VCRUNTIME140 ref: 00007FF7C419A432
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A44A

Strings

schannel: TLS 1.3 is not yet supported, xrefs: 00007FF7C419A1CB
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF7C419A4B0
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF7C419A822
Microsoft Unified Security Protocol Provider, xrefs: 00007FF7C419A83F
schannel: unable to allocate memory, xrefs: 00007FF7C419A7BC, 00007FF7C419AA47
LocalMachine, xrefs: 00007FF7C419A353
CurrentUser, xrefs: 00007FF7C419A312
LocalMachineGroupPolicy, xrefs: 00007FF7C419A3EC
CurrentService, xrefs: 00007FF7C419A375
schannel: Failed to read cert file %s, xrefs: 00007FF7C419A7F9
CurrentUserGroupPolicy, xrefs: 00007FF7C419A3CD
Services, xrefs: 00007FF7C419A397
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF7C419A8B5
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF7C419A337
http/1.1, xrefs: 00007FF7C419A953
Users, xrefs: 00007FF7C419A3B6
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF7C419A74F
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7C419A933
schannel: ALPN, offering %s, xrefs: 00007FF7C419A975
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C419A6D9
LocalMachineEnterprise, xrefs: 00007FF7C419A40B
http/1.1, xrefs: 00007FF7C419A967
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF7C419A704

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 226b874003b3e77be6e8aecff270c4871e1a115fd52cbad6b95eb9bc9fda5cba
Instruction ID: 90ef56e79c6d1db0715dd96159ecfc661a4ef75ff6aed2f4ddf265cca54e9e5e
Opcode Fuzzy Hash: 226b874003b3e77be6e8aecff270c4871e1a115fd52cbad6b95eb9bc9fda5cba
Instruction Fuzzy Hash: 0C426F25A0868287EB24BF16F894279A3A5BB55FE8F844135CE9E47790DF3CE548C720

Function 00007FF7C41AD250 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186B85
Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186BA0

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD2DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD312
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD339
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD34C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AD355
#22.WLDAP32 ref: 00007FF7C41AD366
#211.WLDAP32 ref: 00007FF7C41AD400
#217.WLDAP32 ref: 00007FF7C41AD41C
#211.WLDAP32 ref: 00007FF7C41AD435
#211.WLDAP32 ref: 00007FF7C41AD447
#60.WLDAP32 ref: 00007FF7C41AD477
#211.WLDAP32 ref: 00007FF7C41AD592
#60.WLDAP32 ref: 00007FF7C41AD5B7
#22.WLDAP32 ref: 00007FF7C41AD65A
#41.WLDAP32 ref: 00007FF7C41ADA76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41ADA9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41ADAA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41ADAC8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41ADADB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41ADAE4
#46.WLDAP32 ref: 00007FF7C41ADAF6

Strings

LDAP remote: %s, xrefs: 00007FF7C41AD6D7
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF7C41AD284
LDAP local: %s, xrefs: 00007FF7C41AD2C7
LDAP local: %s, xrefs: 00007FF7C41AD36C
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF7C41AD664
LDAP local: trying to establish %s connection, xrefs: 00007FF7C41AD399
encrypted, xrefs: 00007FF7C41AD3AE
LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF7C41AD49B
DN: , xrefs: 00007FF7C41AD752
;binary, xrefs: 00007FF7C41AD8E0
There are more than %d entries, xrefs: 00007FF7C41ADA86
Microsoft Corporation., xrefs: 00007FF7C41AD270
cleartext, xrefs: 00007FF7C41AD38F

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 910d156440a90ea978d0b7741c25805626eb07d4639fc4770fb44ca804c3da6f
Instruction ID: 988c139d6ded215cd167d3ece3dfe12d05d453a5010eecee7d88a5164720ad53
Opcode Fuzzy Hash: 910d156440a90ea978d0b7741c25805626eb07d4639fc4770fb44ca804c3da6f
Instruction Fuzzy Hash: A8424E66F18B4287EB14AF63A8942B9A3A1FB44FACF804531CE8E57755DE3CE445C320

Function 00007FF7C41A9550 Relevance: 77.4, APIs: 26, Strings: 18, Instructions: 435networkfilepipeCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A959F
WSAStartup.WS2_32 ref: 00007FF7C41A9640
FreeLibrary.KERNEL32 ref: 00007FF7C41A982D
GetStdHandle.KERNEL32 ref: 00007FF7C41A983C
GetFileType.KERNEL32 ref: 00007FF7C41A985D
WaitForMultipleObjects.KERNEL32 ref: 00007FF7C41A98A7
PeekNamedPipe.KERNEL32 ref: 00007FF7C41A992C
ReadFile.KERNEL32 ref: 00007FF7C41A9953
ReadFile.KERNEL32 ref: 00007FF7C41A9A0D
WSAGetLastError.WS2_32 ref: 00007FF7C41A9A6E
WSAGetLastError.WS2_32 ref: 00007FF7C41A9C6A
FreeLibrary.KERNEL32 ref: 00007FF7C41A9C8A
GetLastError.KERNEL32 ref: 00007FF7C41A9C94

Part of subcall function 00007FF7C41AA4C0: send.WS2_32 ref: 00007FF7C41AA4FD
Part of subcall function 00007FF7C41AA4C0: WSAGetLastError.WS2_32 ref: 00007FF7C41AA507

Strings

WSAEnumNetworkEvents failed (%d), xrefs: 00007FF7C41A9A82
WSACloseEvent, xrefs: 00007FF7C41A96FC
WSAStartup failed (%d), xrefs: 00007FF7C41A964D
WSAEventSelect, xrefs: 00007FF7C41A9741
FreeLibrary(wsock2) failed (%u), xrefs: 00007FF7C41A9C9A
insufficient winsock version to support telnet, xrefs: 00007FF7C41A9CCF
failed to find WSACreateEvent function (%u), xrefs: 00007FF7C41A96F3
WSAEnumNetworkEvents, xrefs: 00007FF7C41A9770
, xrefs: 00007FF7C41A9C32
WSACreateEvent, xrefs: 00007FF7C41A96D5
Time-out, xrefs: 00007FF7C41A9C47
failed to find WSAEventSelect function (%u), xrefs: 00007FF7C41A9767
WSACloseEvent failed (%d), xrefs: 00007FF7C41A9C70
failed to load WS2_32.DLL (%u), xrefs: 00007FF7C41A96BB
failed to find WSACloseEvent function (%u), xrefs: 00007FF7C41A971C
WSACreateEvent failed (%d), xrefs: 00007FF7C41A97AE
WS2_32.DLL, xrefs: 00007FF7C41A968E
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00007FF7C41A9790

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast$File$FreeLibraryRead$HandleMultipleNamedObjectsPeekPipeStartupTypeWaitcallocsend
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$WSAStartup failed (%d)$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)$insufficient winsock version to support telnet
API String ID: 1025660337-777782649
Opcode ID: f1d6905e5fce8bc8bf68869ca38434ad1d82b517c66d06ed3463cea992b69d1b
Instruction ID: 78527bbc64c85a251d4721c1629aaabb9dfa74dd37e33d1f9cdfb6261228a827
Opcode Fuzzy Hash: f1d6905e5fce8bc8bf68869ca38434ad1d82b517c66d06ed3463cea992b69d1b
Instruction Fuzzy Hash: E9126272A1868287EB64AF16B4843B9A3A0FB45FA8F845535DDCE47794DF3CE484C720

Function 00007FF7C41641F8 Relevance: 62.1, APIs: 30, Strings: 5, Instructions: 823COMMON

Download Yara Rule

APIs

__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4164EFF
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4164F0C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4164FFF
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C416502C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4165039
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4165073
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41653EF

Strings

object, xrefs: 00007FF7C4164D36
number overflow parsing ', xrefs: 00007FF7C416493D
array, xrefs: 00007FF7C4164BA6
object separator, xrefs: 00007FF7C4164E50
object key, xrefs: 00007FF7C4164F5C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: __std_exception_destroy$_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 2506729964-85532522
Opcode ID: d01765797d5e6e74f8c899dc439544139bc2d90fea40527123e84af49c4789ab
Instruction ID: 8892afcd435d6e5f7d9e926cba5f0190cd7b51680814f881ab00a77fd96a3347
Opcode Fuzzy Hash: d01765797d5e6e74f8c899dc439544139bc2d90fea40527123e84af49c4789ab
Instruction Fuzzy Hash: E9827862E18B8597EB10AF6AF4803EDA321FB85BB8F905331DADD066D5DF68D184C314

Function 00007FF7C41B62E0 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C41B6326

Part of subcall function 00007FF7C41719D0: GetLastError.KERNEL32 ref: 00007FF7C41719EC
Part of subcall function 00007FF7C41719D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41719F4

CreateFileA.KERNEL32 ref: 00007FF7C41B6380
GetLastError.KERNEL32 ref: 00007FF7C41B6391
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B66CD

Strings

-----BEGIN CERTIFICATE-----, xrefs: 00007FF7C41B64CE
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7C41B6655
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7C41B6606
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7C41B63F2
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7C41B6692
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7C41B63AB
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7C41B6625
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7C41B66A3
-----END CERTIFICATE-----, xrefs: 00007FF7C41B64F9
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7C41B6429
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7C41B6340
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7C41B6671
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7C41B65D0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 36866d9a4dd46dffc955a754f7cf9930e53142672c94d5b501d627ba954e7275
Instruction ID: 58588ea005020c82c524d21ec5fafac8bca98c631acc21c86a8f09bc7fe7b75a
Opcode Fuzzy Hash: 36866d9a4dd46dffc955a754f7cf9930e53142672c94d5b501d627ba954e7275
Instruction Fuzzy Hash: 82B19061E08B0183EA20AF27F8807A9A6A1BB55FA8FC44036DDCD47794DE7CE545C761

Function 00007FF7C4189850 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 191libraryloadernetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7C4189878
WSACleanup.WS2_32 ref: 00007FF7C4189893
GetModuleHandleA.KERNEL32 ref: 00007FF7C41898E4
GetProcAddress.KERNEL32 ref: 00007FF7C4189910
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418992A
LoadLibraryA.KERNEL32 ref: 00007FF7C418994D
GetProcAddress.KERNEL32 ref: 00007FF7C418996A
GetSystemDirectoryA.KERNEL32 ref: 00007FF7C4189996
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41899AE
GetSystemDirectoryA.KERNEL32 ref: 00007FF7C41899C2
LoadLibraryA.KERNEL32 ref: 00007FF7C4189A30
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4189A3C
GetProcAddress.KERNEL32 ref: 00007FF7C4189A68
VerSetConditionMask.NTDLL ref: 00007FF7C4189AF1
VerSetConditionMask.NTDLL ref: 00007FF7C4189B04
VerSetConditionMask.NTDLL ref: 00007FF7C4189B13
VerSetConditionMask.NTDLL ref: 00007FF7C4189B22
VerSetConditionMask.NTDLL ref: 00007FF7C4189B32
VerifyVersionInfoA.KERNEL32 ref: 00007FF7C4189B43
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7C4189B5F

Strings

if_nametoindex, xrefs: 00007FF7C4189A5E
kernel32, xrefs: 00007FF7C41898CB
AddDllDirectory, xrefs: 00007FF7C4189960
LoadLibraryExA, xrefs: 00007FF7C41898FE
iphlpapi.dll, xrefs: 00007FF7C4189916

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ConditionMask$AddressProc$DirectoryLibraryLoadSystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 3424030832-2794540096
Opcode ID: 3332ffd42af34dc0ee3f7ef9b50b41b18d412a117fe73a420bf1d8d7b789efe6
Instruction ID: 0531d488e0368305e34288f9393f8ba7b88499edf65311d5457720324821ba5b
Opcode Fuzzy Hash: 3332ffd42af34dc0ee3f7ef9b50b41b18d412a117fe73a420bf1d8d7b789efe6
Instruction Fuzzy Hash: B6915025E1978287EB60AF12B8943B9B391FF89FA8F854135D9CE06754EF2CE4458720

Function 00007FF7C41885A0 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C4188672
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418868D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41886CC

Strings

bind failed with errno %d: %s, xrefs: 00007FF7C4188A58
Local port: %hu, xrefs: 00007FF7C4188A75
Couldn't bind to interface '%s', xrefs: 00007FF7C4188810
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF7C4188898
getsockname() failed with errno %d: %s, xrefs: 00007FF7C4188A1C
Bind to local port %hu failed, trying next, xrefs: 00007FF7C4188980
Couldn't bind to '%s', xrefs: 00007FF7C4188762
Local Interface %s is ip %s using address family %i, xrefs: 00007FF7C4188787

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 524ca47afb0c7bebec5d92ac7d67a0ac8aaeee4b42094fb6b187f4c9640b9eb1
Instruction ID: 1cd5324a332efef011855c2630c5e031d8471a0e1d9a376228a141e55540a8f0
Opcode Fuzzy Hash: 524ca47afb0c7bebec5d92ac7d67a0ac8aaeee4b42094fb6b187f4c9640b9eb1
Instruction Fuzzy Hash: 88E1A026E1869287E710EF26B8802B9A3A0FB99FACF815136DE8E43755DF7CD540C711

Function 00007FF7C4145600 Relevance: 38.8, APIs: 1, Strings: 21, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4145BD0: _Mtx_lock.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00007FF7C4145634), ref: 00007FF7C4145BE0
Part of subcall function 00007FF7C4145BD0: ?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00007FF7C4145634), ref: 00007FF7C4145BEF
Part of subcall function 00007FF7C4145BD0: ?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00007FF7C4145634), ref: 00007FF7C4145C11

_Cnd_broadcast.MSVCP140 ref: 00007FF7C414565D

Strings

G@QG6, xrefs: 00007FF7C41456D7
4, xrefs: 00007FF7C41457F3
3, xrefs: 00007FF7C4145763
VR@T6, xrefs: 00007FF7C4145663
4, xrefs: 00007FF7C4145799
u, xrefs: 00007FF7C41457B8
6, xrefs: 00007FF7C41457A1
3, xrefs: 00007FF7C41457ED
5, xrefs: 00007FF7C414579D
TZHRL?, xrefs: 00007FF7C4145886
9, xrefs: 00007FF7C41457AD
8, xrefs: 00007FF7C41457A9
7, xrefs: 00007FF7C41457DC
5, xrefs: 00007FF7C41457F7
u345, xrefs: 00007FF7C4145701
d345, xrefs: 00007FF7C4145697
3, xrefs: 00007FF7C4145792
7, xrefs: 00007FF7C41457A5
SEUAWE8, xrefs: 00007FF7C41457D3
i, xrefs: 00007FF7C414576C
a, xrefs: 00007FF7C4145804

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Cpp_error@std@@Throw_$Cnd_broadcastMtx_lock
String ID: 3$3$3$4$4$5$5$6$7$7$8$9$G@QG6$SEUAWE8$TZHRL?$VR@T6$a$d345$i$u$u345
API String ID: 4034779230-1092459702
Opcode ID: a13b450f275419a8dd4bfd8e60fb2de993e61a2292184488fbf3e896131550fb
Instruction ID: e376d27c62d6db62ea98c7eac0c7ac90618463674f725a7fd1560a0a273be7dc
Opcode Fuzzy Hash: a13b450f275419a8dd4bfd8e60fb2de993e61a2292184488fbf3e896131550fb
Instruction Fuzzy Hash: D6E11C52E0D7C14AFB03DF76E4803B8ABA16F16BBCF945235DA8D26596EF2C9145C320

Function 00007FF7C419A1FC Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C419A298
strchr.VCRUNTIME140 ref: 00007FF7C419A2C4
strchr.VCRUNTIME140 ref: 00007FF7C419A2FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A322
strchr.VCRUNTIME140 ref: 00007FF7C419A432
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A44A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C419A575
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C419A5A1

Strings

, xrefs: 00007FF7C419A1FC
CurrentUser, xrefs: 00007FF7C419A312
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C419A6D9

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: c16e2247d9ed598965092e6ee4cba87523a5161c76fd9d2a465fa131af984870
Instruction ID: b6c91da4b37a6c85bc511d13192202ac0084b9e0f99f0617b2304afe7db08e08
Opcode Fuzzy Hash: c16e2247d9ed598965092e6ee4cba87523a5161c76fd9d2a465fa131af984870
Instruction Fuzzy Hash: 42818325B0968247FA69BF13BC94379A7D1BF15FB8F844135CE9E46690DE3DE4488320

Function 00007FF7C419A205 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C419A298
strchr.VCRUNTIME140 ref: 00007FF7C419A2C4
strchr.VCRUNTIME140 ref: 00007FF7C419A2FE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A322
strchr.VCRUNTIME140 ref: 00007FF7C419A432
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419A44A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C419A575
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C419A5A1

Strings

CurrentUser, xrefs: 00007FF7C419A312
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7C419A6D9

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 7d68e8c7e3a11a94a255ff31ec158b3015902eda527245b849a139e941c8cafc
Instruction ID: 68e9f4c3dff027d5cd51878d419da33d1121937e38933c5b2d131757bb0f369d
Opcode Fuzzy Hash: 7d68e8c7e3a11a94a255ff31ec158b3015902eda527245b849a139e941c8cafc
Instruction Fuzzy Hash: AF818225B0968247FA69BF23BC94279A7D1BF15FB8F844135CE9E46790DE3DE4488320

Function 00007FF7C416A890 Relevance: 30.2, APIs: 12, Strings: 5, Instructions: 486COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41599F0: memmove.VCRUNTIME140 ref: 00007FF7C4159A28

memmove.VCRUNTIME140 ref: 00007FF7C416AB15

Part of subcall function 00007FF7C4160A50: memmove.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00007FF7C416A6C0), ref: 00007FF7C4160B5E
Part of subcall function 00007FF7C4160A50: memmove.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00007FF7C416A6C0), ref: 00007FF7C4160B6D

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A9E7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AA26
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AC6B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416ACAB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416ACFC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AD3B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AD96

Part of subcall function 00007FF7C4158C60: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FF7C4153979), ref: 00007FF7C4158CA6

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AE77
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AEB7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AF9E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416AFDE

Strings

syntax error , xrefs: 00007FF7C416A8D3
unexpected , xrefs: 00007FF7C416ADDE
; expected , xrefs: 00007FF7C416AF05
; last read: ', xrefs: 00007FF7C416AB0B, 00007FF7C416AB2D
while parsing , xrefs: 00007FF7C416A8FA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 15630516-4239264347
Opcode ID: d37661e6047cfb9c16b2f68a329f8b267e6650d468991b82eb005b5b3252f6dc
Instruction ID: c21edf0d7f52d0562f38d4199d7f2827406dcde84db5a22ca5e88bbe0883b05d
Opcode Fuzzy Hash: d37661e6047cfb9c16b2f68a329f8b267e6650d468991b82eb005b5b3252f6dc
Instruction Fuzzy Hash: CF22D462E18B8556EB00DF6AE4803ADA361EB86BF8F905321DEAD136D5DF7CD085C310

Function 00007FF7C415A520 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C415A861), ref: 00007FF7C415A666

Part of subcall function 00007FF7C41BF110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF7C4159D11), ref: 00007FF7C41BF12A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C415A861), ref: 00007FF7C415A6F1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C415A725
memset.VCRUNTIME140 ref: 00007FF7C415A785
GetTempPathW.KERNEL32 ref: 00007FF7C415A793
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415A850

Strings

\\.\Nal, xrefs: 00007FF7C415AA52

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskPathTempmallocmemset
String ID: \\.\Nal
API String ID: 4135678155-3214500369
Opcode ID: b8aa26911c5b49d9f0bc7bc1439edc7b152f4ee9beb441ca11b8734569c6580e
Instruction ID: 4cd759e6df491f57f3d172fed637e27b809e3b69193ba175a143e2e5c273d569
Opcode Fuzzy Hash: b8aa26911c5b49d9f0bc7bc1439edc7b152f4ee9beb441ca11b8734569c6580e
Instruction Fuzzy Hash: 5CE17262E18A4186EA10AF6AF4943ADA3A1EB44BF8F905731DEAD037D5DF7CD4818310

Function 00007FF7C41642F8 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4164A69
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4164A96
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4164AA3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4164ADD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41653EF

Strings

number overflow parsing ', xrefs: 00007FF7C416493D
array, xrefs: 00007FF7C4164BA6

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '
API String ID: 1346393832-1723591761
Opcode ID: 3613b2e8bea484ae284235a324b0c283367bc47c39f05ae85a12131f48b2f8c6
Instruction ID: c8dd5b4af54c3863de64f9a58274d7c01ac70fea9d38bb3122f8949ae717f673
Opcode Fuzzy Hash: 3613b2e8bea484ae284235a324b0c283367bc47c39f05ae85a12131f48b2f8c6
Instruction Fuzzy Hash: 6AE1B862E18B8556FB10AF6AF8843FDA321EB45BB8F905331DADD06AD5DF6CD180C214

Function 00007FF7C4147190 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 316filepipeCOMMON

Download Yara Rule

APIs

PeekNamedPipe.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C414721A
ReadFile.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C4147257
PeekNamedPipe.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C41472AE
ReadFile.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C41472EA
WriteFile.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C41473B0
CloseHandle.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C41473ED
CloseHandle.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C414740B
CloseHandle.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C4147600
CloseHandle.KERNEL32(?,?,?,?,?,00007FF7C4143CC4), ref: 00007FF7C4147676

Strings

Partial data in frame, xrefs: 00007FF7C414741C
message, xrefs: 00007FF7C4147501
code, xrefs: 00007FF7C41474A3
Pipe closed, xrefs: 00007FF7C4147623
Bad ipc frame, xrefs: 00007FF7C414732E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: CloseHandle$File$NamedPeekPipeRead$Write
String ID: Bad ipc frame$Partial data in frame$Pipe closed$code$message
API String ID: 2616183641-1531722677
Opcode ID: 1868b2551e2ab3c48577292a7bc1b394cfcb92e4bfae071895f83cb823084aaf
Instruction ID: ebbfb959ecc786c78eb17fe50d11708a2f07656ddd38633e3bb1ad03aa2e14b5
Opcode Fuzzy Hash: 1868b2551e2ab3c48577292a7bc1b394cfcb92e4bfae071895f83cb823084aaf
Instruction Fuzzy Hash: CAE1C372A1868287EB21DF26E5802B877A0FB05F78F845631DAAD47AD4DF38D551CB10

Function 00007FF7C416E120 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF7C416E215
memmove.VCRUNTIME140 ref: 00007FF7C416E260
memmove.VCRUNTIME140 ref: 00007FF7C416E315
memmove.VCRUNTIME140 ref: 00007FF7C416E361
memmove.VCRUNTIME140 ref: 00007FF7C416E3EC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E481
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E4C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E510
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416E55F

Part of subcall function 00007FF7C414BDB0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF7C4159AE6), ref: 00007FF7C414BDBB

Strings

, column , xrefs: 00007FF7C416E3E2, 00007FF7C416E404
at line , xrefs: 00007FF7C416E370

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturn$Xlength_error@std@@
String ID: at line $, column
API String ID: 637106600-191570568
Opcode ID: da2cceda677676182ac95b966fe8c549aebe28d67c8467f51aa1ccce973154b2
Instruction ID: 81f4cf8b9ec348621f89d924c78cfbbaf1dd503878a1bb649812990e85daa159
Opcode Fuzzy Hash: da2cceda677676182ac95b966fe8c549aebe28d67c8467f51aa1ccce973154b2
Instruction Fuzzy Hash: C5D1C362F18B8196EB10DF7AE5403EDA762EB44BA8F804235DE9D17BD9DE38D085C350

Function 00007FF7C415C670 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41599F0: memmove.VCRUNTIME140 ref: 00007FF7C4159A28

Part of subcall function 00007FF7C41603C0: NtQuerySystemInformation.NTDLL ref: 00007FF7C41603F3
Part of subcall function 00007FF7C41603C0: VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7C4160118), ref: 00007FF7C4160410
Part of subcall function 00007FF7C41603C0: VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7C4160118), ref: 00007FF7C4160426
Part of subcall function 00007FF7C41603C0: NtQuerySystemInformation.NTDLL ref: 00007FF7C4160441
Part of subcall function 00007FF7C41603C0: VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7C4160118), ref: 00007FF7C4160462

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415C70B
memset.VCRUNTIME140 ref: 00007FF7C415C9C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415CB85
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415CB8C
DeviceIoControl.KERNEL32 ref: 00007FF7C415CC04
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415CC81

Strings

ci.dll, xrefs: 00007FF7C415C6BC
xxx, xrefs: 00007FF7C415C790
xxx????x?xxxxxxx, xrefs: 00007FF7C415C720

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Virtual$FreeInformationQuerySystem$AllocControlDevicememmovememset
String ID: ci.dll$xxx$xxx????x?xxxxxxx
API String ID: 3837115440-4271536270
Opcode ID: fa7d7dfa25d0b51d8164c07ef9c2eefeaac9528bc47bbcd1f174165c3622e73b
Instruction ID: 6a80e5429342bd067d77408da985a8d8096c03fd47dc1d359bc79e28d22de644
Opcode Fuzzy Hash: fa7d7dfa25d0b51d8164c07ef9c2eefeaac9528bc47bbcd1f174165c3622e73b
Instruction Fuzzy Hash: E1F16261F09A4246EA10AF6AA4803FCA7A1AB45FACFC04536DE9D17BC5EF3CE545C350

Function 00007FF7C4169580 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 288COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF7C4169653
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41697C8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416981B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416986C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41698AB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41698FB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416993A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41699B6

Strings

parse error, xrefs: 00007FF7C4169649, 00007FF7C4169669

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove
String ID: parse error
API String ID: 15630516-316136553
Opcode ID: 33df5e89e881088357d9a480a26b4109d57c31d2755a70602aeb6cb7adcc4eee
Instruction ID: 6ea1d650b7a86d31b0ba605824e561e602202be25552421ac4c2fd3835e938a4
Opcode Fuzzy Hash: 33df5e89e881088357d9a480a26b4109d57c31d2755a70602aeb6cb7adcc4eee
Instruction Fuzzy Hash: 5DD1B862E24B8587EB00DF66E4843ADA721FB95BB8F905231EA9D026D5DF7CD1C1C350

Function 00007FF7C4181620 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF7C4181861
Found bundle for host %s: %p [%s], xrefs: 00007FF7C4181739
serially, xrefs: 00007FF7C418172E
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7C4181886
Server doesn't support multiplex (yet), xrefs: 00007FF7C418178F
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF7C4181EEA
Server doesn't support multiplex yet, wait, xrefs: 00007FF7C418176B
Multiplexed connection found!, xrefs: 00007FF7C4181E91
Can not multiplex, even if we wanted to!, xrefs: 00007FF7C41817DA
can multiplex, xrefs: 00007FF7C4181722
Could multiplex, but not asked to!, xrefs: 00007FF7C41817BC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 453e49cfe199f214d362d9b4aed09c493130f425c083848e112b522fff35f551
Instruction ID: d31b94686c0604cf6c3c5d71843c28a492b7ca8068676d5b660055bc5d21436b
Opcode Fuzzy Hash: 453e49cfe199f214d362d9b4aed09c493130f425c083848e112b522fff35f551
Instruction Fuzzy Hash: 6642BA13A0C7C247EB66AE27A5D03B9B791AB41F7CF894035DADD47285DF2CA950C322

Function 00007FF7C415B7F0 Relevance: 13.7, APIs: 9, Instructions: 191nativememoryCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF7C415B82C
VirtualFree.KERNEL32 ref: 00007FF7C415B84B
VirtualAlloc.KERNEL32 ref: 00007FF7C415B860
NtQuerySystemInformation.NTDLL ref: 00007FF7C415B879
GetCurrentProcessId.KERNEL32 ref: 00007FF7C415B8E1
VirtualFree.KERNEL32 ref: 00007FF7C415B924
memset.VCRUNTIME140 ref: 00007FF7C415BA26
DeviceIoControl.KERNEL32 ref: 00007FF7C415BAA4
VirtualFree.KERNEL32 ref: 00007FF7C415BACA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Virtual$Free$InformationQuerySystem$AllocControlCurrentDeviceProcessmemset
String ID:
API String ID: 2403452001-0
Opcode ID: 458d53bc56920e106d1ca5210840d529c9e769ed1a71471dd0d7984075af220b
Instruction ID: d0fd0ca8ed85df4f78fc4554b2e97b79a7513e4639538dd121a1611e0d930985
Opcode Fuzzy Hash: 458d53bc56920e106d1ca5210840d529c9e769ed1a71471dd0d7984075af220b
Instruction Fuzzy Hash: A281D522B18A458BEB20AF66E4503FDA7A0EB49F9CF804134DE8D57B85DF38D2458360

Function 00007FF7C419C600 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7C419C5F8,?,?,?,?,?,?,00007FF7C41B36FE), ref: 00007FF7C419C676
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000021C,-00000008,00000000,?,?,00007FF7C419C5F8,?,?,?,?,?,?,00007FF7C41B36FE), ref: 00007FF7C419C7DD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419C93C

Strings

%c%c%c%c, xrefs: 00007FF7C419C733
%c%c%c=, xrefs: 00007FF7C419C771
%c%c==, xrefs: 00007FF7C419C7A3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 3985033223-3943651191
Opcode ID: 0cfabf03a2ee9cc77b2e3b6a0b75556f06c9cd6ca5041f86a937075b6670a7b3
Instruction ID: 4559bfb4e11449d64fe56100d813fe658229dcf34db74c3edf7e4c2e7e6089a5
Opcode Fuzzy Hash: 0cfabf03a2ee9cc77b2e3b6a0b75556f06c9cd6ca5041f86a937075b6670a7b3
Instruction Fuzzy Hash: 8C91E9329086D146E725AF26B8843BAABA1EB55FB8F884231DADD477D5DF3CD4018710

Function 00007FF7C41AB780 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB7CF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB82C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB850
bind.WS2_32 ref: 00007FF7C41AB8CB
WSAGetLastError.WS2_32 ref: 00007FF7C41AB8D5

Strings

bind() failed; %s, xrefs: 00007FF7C41AB8F0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 12de7bbf04ca938dc8e0494ae512c463dfa055f6871f73e21d13eceafdef5c06
Instruction ID: abb1ce8225fdee598de01303a3a47636ffcff5fbcec9a8efea69755ca3816aad
Opcode Fuzzy Hash: 12de7bbf04ca938dc8e0494ae512c463dfa055f6871f73e21d13eceafdef5c06
Instruction Fuzzy Hash: DD518F72A0878287EB15AF27E4903B9A6A0FB44FA8F844035CF8D47796DF3CE5558320

Function 00007FF7C41AB554 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB59E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB5FB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AB623
bind.WS2_32 ref: 00007FF7C41AB6A2
WSAGetLastError.WS2_32 ref: 00007FF7C41AB6AC

Strings

bind() failed; %s, xrefs: 00007FF7C41AB6C7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: fac50365d3d43c760a1293e6d8003b2b2d1306400225a5ea9646fb880aa0a235
Instruction ID: 972ef6c78413a067023ec01d3f40ed3d1ec30aa8a9df2756819b40640247c17d
Opcode Fuzzy Hash: fac50365d3d43c760a1293e6d8003b2b2d1306400225a5ea9646fb880aa0a235
Instruction Fuzzy Hash: F5416372A0878587EB14AF27E4943A9A7A0FB48F98F884435CB8D47781DF3DE5658720

Function 00007FF7C41955E0 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dG, xrefs: 00007FF7C41956D4
%2I64d.%0I64dG, xrefs: 00007FF7C419569A
%4I64dP, xrefs: 00007FF7C41956FD
%2I64d.%0I64dM, xrefs: 00007FF7C4195629
%5I64d, xrefs: 00007FF7C41955F5
%4I64dk, xrefs: 00007FF7C419560E
%4I64dT, xrefs: 00007FF7C41956F0
%4I64dM, xrefs: 00007FF7C419567C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 8992302dc71b5a99d776417ecc031ef14abfbd4a3b22ce837ffd9106aaad1cd2
Instruction ID: 544c0d44c42987b62ce3a8b700852fa30a8544ff5130f3f763fe983d09aa71d9
Opcode Fuzzy Hash: 8992302dc71b5a99d776417ecc031ef14abfbd4a3b22ce837ffd9106aaad1cd2
Instruction Fuzzy Hash: AE219296E1DA4A83FE24EF97BC907F482629B54FB8EC00432E98F16791DE7C6541C160

Function 00007FF7C41C0228 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C41C0289
IsDebuggerPresent.KERNEL32 ref: 00007FF7C41C02A1
OutputDebugStringW.KERNEL32 ref: 00007FF7C41C02B2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7C41C02AB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 0d98bb66ead445561ea89465f13d10b5ff5aaeee82152862f8b44e4e6274f6ee
Instruction ID: 86fccf80889d6666fabf38d9610a0a7c26f00fc70ccc5ac90b65d2cea3bfcee7
Opcode Fuzzy Hash: 0d98bb66ead445561ea89465f13d10b5ff5aaeee82152862f8b44e4e6274f6ee
Instruction Fuzzy Hash: B9114232A14B5197E754AF63FA8437977A0FB44B69F805135C68D42950EF3DE064C720

Function 00007FF7C419C250 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF7C419C280
CryptGetHashParam.ADVAPI32 ref: 00007FF7C419C2A6
CryptDestroyHash.ADVAPI32 ref: 00007FF7C419C2B5
CryptReleaseContext.ADVAPI32 ref: 00007FF7C419C2C5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 04f9de0b98df099009d06a53fac6d2f7e7b195ec4336e10a5c8bb2e401b8feb3
Instruction ID: 4b4b347f6d7cc532f3517fa565f4453bf02cf94160dddceed4bec6c0df30caf0
Opcode Fuzzy Hash: 04f9de0b98df099009d06a53fac6d2f7e7b195ec4336e10a5c8bb2e401b8feb3
Instruction Fuzzy Hash: 80015E36A0964183EB14DF62E89432AB331FB85FD8F548132DA8906A68CF3DD448CB10

Function 00007FF7C419C1F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7C419C20C
CryptCreateHash.ADVAPI32 ref: 00007FF7C419C22D

Strings

@, xrefs: 00007FF7C419C1FC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: ee50960f48205662c9b063ffde2f41aa525107613b7d1882924e9d37a93c58d9
Instruction ID: 237269abeac03c6107fadcd25c54712dafee417a21e59d7b2424998e0e317ae4
Opcode Fuzzy Hash: ee50960f48205662c9b063ffde2f41aa525107613b7d1882924e9d37a93c58d9
Instruction Fuzzy Hash: D4E01A62F2465283F7709F66F841B16A361FB98B58F848021CA8C4AA54DF3DC1568B14

Function 00007FF7C41478A0 Relevance: 1.8, Strings: 1, Instructions: 585COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7C41487C4

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 36373df9921813780dcfbefa5da9584eb2890af88a1696ceb2b3cad65178726c
Instruction ID: f699474e3175c25dd96fcbc14c64870a3d4d9c4d68fb8cad58be7bdb1b43b8b6
Opcode Fuzzy Hash: 36373df9921813780dcfbefa5da9584eb2890af88a1696ceb2b3cad65178726c
Instruction Fuzzy Hash: DD326D6AA08F8546E715DF2AA0902BDB7A1AF15FECF946132CACD133D1EF2C95528310

Function 00007FF7C4152620 Relevance: 1.8, Strings: 1, Instructions: 502COMMON

Download Yara Rule

Strings

U[K9, xrefs: 00007FF7C415263B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: U[K9
API String ID: 0-4059496219
Opcode ID: 38ff2d4a3af4e95d20db2c9b3af5e4a66438f2c6fca323ec7e0a7c1c672cdec3
Instruction ID: 5115e7eab83bc27eefe74c0816b2c9e4ab8d2a41bbb0de6d372cdcc1e128bf43
Opcode Fuzzy Hash: 38ff2d4a3af4e95d20db2c9b3af5e4a66438f2c6fca323ec7e0a7c1c672cdec3
Instruction Fuzzy Hash: F7323023E29B954BE7039F3AD4411B8F764AF57B58F80C326EE8932952EF256281C314

Function 00007FF7C418A6B0 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4074e0605bbb6175c08b81b727039ee320673a4a75df880336feb7b24a9cbd2f
Instruction ID: 3d0a4bf59346acff48bad63f9a9602bf2c2fdc009838728a56404fd4ea02d488
Opcode Fuzzy Hash: 4074e0605bbb6175c08b81b727039ee320673a4a75df880336feb7b24a9cbd2f
Instruction Fuzzy Hash: 95F171B2A181A04BD36C8B2EA469639BFE1F3C9B45B04812EE7A7C3781D93CC555DF10

Function 00007FF7C419C240 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab837a5cb1f8ae10af9101eba5109c8f2c981b29e710b41bfdb9443fbba5537e
Instruction ID: b63b5758207c5d4b6acfe2012ba9c5c438962be4d26e12fda9e187ac96d37c6a
Opcode Fuzzy Hash: ab837a5cb1f8ae10af9101eba5109c8f2c981b29e710b41bfdb9443fbba5537e
Instruction Fuzzy Hash: 2DA01221A0580581A2204F01F590D105210F784B183504021840C014108D248141C200

Function 00007FF7C4199630 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C4199663
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41996B3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41996D4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41996EA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4199708
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4199726
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4199744
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419975C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4199774

Strings

CALG_DES, xrefs: 00007FF7C4199803
CALG_SSL3_SHAMD5, xrefs: 00007FF7C41999A7
CALG_SHA, xrefs: 00007FF7C419973D
CALG_HMAC, xrefs: 00007FF7C4199AB5
CALG_3DES_112, xrefs: 00007FF7C4199821
CALG_AGREEDKEY_ANY, xrefs: 00007FF7C4199911
CALG_HUGHES_MD5, xrefs: 00007FF7C419992F
CALG_AES_128, xrefs: 00007FF7C4199B0F
CALG_RC2, xrefs: 00007FF7C419987B
CALG_SHA_512, xrefs: 00007FF7C4199BC3
CALG_SSL2_MASTER, xrefs: 00007FF7C4199A5B
CALG_MD2, xrefs: 00007FF7C41996E3
CALG_DESX, xrefs: 00007FF7C419985D
CALG_AES_192, xrefs: 00007FF7C4199B2D
CALG_HASH_REPLACE_OWF, xrefs: 00007FF7C4199AF1
CALG_SKIPJACK, xrefs: 00007FF7C419994D
CALG_PCT1_MASTER, xrefs: 00007FF7C4199A3D
CALG_MAC, xrefs: 00007FF7C419976D
CALG_ECDH_EPHEM, xrefs: 00007FF7C4199C2F
CALG_SHA1, xrefs: 00007FF7C4199755
CALG_MD4, xrefs: 00007FF7C4199701
CALG_DH_EPHEM, xrefs: 00007FF7C41998F3
CALG_AES_256, xrefs: 00007FF7C4199B4B
CALG_NO_SIGN, xrefs: 00007FF7C41997C7
CALG_SEAL, xrefs: 00007FF7C41998B7
CALG_SHA_256, xrefs: 00007FF7C4199B87
CALG_ECDSA, xrefs: 00007FF7C4199C14
CALG_RSA_KEYX, xrefs: 00007FF7C41997E5
CALG_TLS1_MASTER, xrefs: 00007FF7C4199A79
CALG_DH_SF, xrefs: 00007FF7C41998D5
CALG_SSL3_MASTER, xrefs: 00007FF7C41999C5
CALG_SHA_384, xrefs: 00007FF7C4199BA5
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF7C4199A1F
CALG_RC5, xrefs: 00007FF7C4199A97
CALG_ECDH, xrefs: 00007FF7C4199BDE
CALG_AES, xrefs: 00007FF7C4199B69
CALG_RC4, xrefs: 00007FF7C4199899
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF7C4199A01
CALG_RSA_SIGN, xrefs: 00007FF7C419978B
CALG_TEK, xrefs: 00007FF7C419996B
CALG_ECMQV, xrefs: 00007FF7C4199BF9
CALG_3DES, xrefs: 00007FF7C419983F
CALG_CYLINK_MEK, xrefs: 00007FF7C4199989
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF7C41999E3
CALG_DSS_SIGN, xrefs: 00007FF7C41997A9
CALG_MD5, xrefs: 00007FF7C419971F
CALG_TLS1PRF, xrefs: 00007FF7C4199AD3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: a9b795ec9cfc193d77a01f6c363ed4e4aab33d2798b5a80b689dc7779d65b99a
Instruction ID: c3de4311957a6bf7ecb697e1087750837c2461b5c84271d95d03ce8c0b822981
Opcode Fuzzy Hash: a9b795ec9cfc193d77a01f6c363ed4e4aab33d2798b5a80b689dc7779d65b99a
Instruction Fuzzy Hash: B002FC50A2C55397FA20FF56FDD02B892A6EF70BACFC02131D98E86295EE1CE505C361

Function 00007FF7C41835D0 Relevance: 42.6, APIs: 34, Instructions: 121COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41835ED
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183603
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183617
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418362B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418363F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183653
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183667
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418367B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418368F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41836A3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41836B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41836CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41836DF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41836F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183707
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418371B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418372F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183743
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183757
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418376B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418377F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183793
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41837A7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41837BB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41837CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41837E3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41837F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418380B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418381F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183833

Part of subcall function 00007FF7C41838C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4183848,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41838DB
Part of subcall function 00007FF7C41838C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4183848,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183909

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418385D

Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C4180081
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C4180091
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C418009F
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800AD
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800BB
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800C9
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800D7
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800E5

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C4183889
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C418389D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41838AD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6e950c50106e03e73eefd5f0bd20df9c078ba1704b96837c8d41928c2ff600d8
Instruction ID: 58e5ef910a6cd6462139af91e9c7fd06dfe804dbffea98848d2f3738f4c2be80
Opcode Fuzzy Hash: 6e950c50106e03e73eefd5f0bd20df9c078ba1704b96837c8d41928c2ff600d8
Instruction Fuzzy Hash: 4F717739908B8183D740EF62E5D42BC73A8FB89FA9F480135CE8D5B619CF7891998735

Function 00007FF7C419B7C0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF7C419BE01
memmove.VCRUNTIME140 ref: 00007FF7C419BE1D

Strings

schannel: server indicated shutdown in a prior call, xrefs: 00007FF7C419B888
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF7C419B98D
schannel: failed to read data from server: %s, xrefs: 00007FF7C419BD52
schannel: enough decrypted data is already available, xrefs: 00007FF7C419B845
schannel: renegotiation failed, xrefs: 00007FF7C419BD8E
schannel: failed to decrypt data, need more data, xrefs: 00007FF7C419BD2A
schannel: remote party requests renegotiation, xrefs: 00007FF7C419BBE2
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF7C419BDA2
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF7C419B865
schannel: can't renogotiate, an error is pending, xrefs: 00007FF7C419BD82
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF7C419BC5F
schannel: unable to re-allocate memory, xrefs: 00007FF7C419B8FD, 00007FF7C419BD66
schannel: server closed the connection, xrefs: 00007FF7C419BC94
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF7C419BDAE
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF7C419BC18
schannel: Curl_read_plain returned error %d, xrefs: 00007FF7C419BB61

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memmove
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 2162964266-857957974
Opcode ID: ca8b7f4cca08d0f4b377d0602cf2dfd1810a07ca2c8ad81eb1be3a2644f642ed
Instruction ID: b69f8f920a92ebcfb5fe1d72b3074254f1d8d46685ef6a9b71e0b44cfc66ddfd
Opcode Fuzzy Hash: ca8b7f4cca08d0f4b377d0602cf2dfd1810a07ca2c8ad81eb1be3a2644f642ed
Instruction Fuzzy Hash: 8002D372A28B4587EB60EF17E8C4369ABA5FB94FA8F910135DA8D47790DF38D640C710

Function 00007FF7C415F6B0 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 230registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C415A520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C415A861), ref: 00007FF7C415A6F1

Part of subcall function 00007FF7C415DF70: memmove.VCRUNTIME140 ref: 00007FF7C415E073
Part of subcall function 00007FF7C415DF70: memmove.VCRUNTIME140 ref: 00007FF7C415E083

RegCreateKeyW.ADVAPI32 ref: 00007FF7C415F793
RegSetKeyValueW.ADVAPI32 ref: 00007FF7C415F7D0
RegSetKeyValueW.ADVAPI32 ref: 00007FF7C415F805
RegCloseKey.ADVAPI32 ref: 00007FF7C415F817
GetModuleHandleA.KERNEL32 ref: 00007FF7C415F824
GetProcAddress.KERNEL32 ref: 00007FF7C415F840
GetProcAddress.KERNEL32 ref: 00007FF7C415F853
RtlInitUnicodeString.NTDLL ref: 00007FF7C415F8C8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415F91E
RegCloseKey.ADVAPI32 ref: 00007FF7C415F93E

Part of subcall function 00007FF7C414BDB0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF7C4159AE6), ref: 00007FF7C414BDBB

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415F97D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415F9D2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415FA27

Strings

SYSTEM\CurrentControlSet\Services\, xrefs: 00007FF7C415F727
ntdll.dll, xrefs: 00007FF7C415F81D
RtlAdjustPrivilege, xrefs: 00007FF7C415F836
\??\, xrefs: 00007FF7C415F769
4, xrefs: 00007FF7C415F89C
\Registry\Machine\System\CurrentControlSet\Services\, xrefs: 00007FF7C415F8A5
NtLoadDriver, xrefs: 00007FF7C415F849
Type, xrefs: 00007FF7C415F7FC
ImagePath, xrefs: 00007FF7C415F7C3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressCloseProcValuememmove$CreateHandleInitModuleStringUnicodeXlength_error@std@@
String ID: 4$ImagePath$NtLoadDriver$RtlAdjustPrivilege$SYSTEM\CurrentControlSet\Services\$Type$\??\$\Registry\Machine\System\CurrentControlSet\Services\$ntdll.dll
API String ID: 2064494904-3570498152
Opcode ID: 5d1465681f4d3f950073d4b93882c623a7883c21eb285f17b4e9a1e262e9ecc0
Instruction ID: a33f84a19d50deb63b973432363654a07ccccb0ca19d9d39e5c1612dc6c28b5d
Opcode Fuzzy Hash: 5d1465681f4d3f950073d4b93882c623a7883c21eb285f17b4e9a1e262e9ecc0
Instruction Fuzzy Hash: F8A16062F18A4697EB10EF6AF4843EC6361EB44B7CF800635EA9D53A98DF38D145C354

Function 00007FF7C4194680 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41947F7

Strings

Basic, xrefs: 00007FF7C4194957
%sAuthorization: Basic %s, xrefs: 00007FF7C4194910
Proxy-authorization, xrefs: 00007FF7C4194763
Authorization:, xrefs: 00007FF7C41947D1
%s auth using %s with user '%s', xrefs: 00007FF7C4194996
Negotiate, xrefs: 00007FF7C41946BA
Server, xrefs: 00007FF7C419498C
Proxy, xrefs: 00007FF7C41949A4
Authorization: Bearer %s, xrefs: 00007FF7C4194800
Authorization, xrefs: 00007FF7C419483A
%s:%s, xrefs: 00007FF7C4194889
Proxy-, xrefs: 00007FF7C4194906
NTLM, xrefs: 00007FF7C41946DC
Digest, xrefs: 00007FF7C41946FE
Bearer, xrefs: 00007FF7C41947F0
CONNECT, xrefs: 00007FF7C419468E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: c05bcfb0049ea7936a2e95382a4f5e96cb1fdfdeb31953fe49fadc5df4d58cc0
Instruction ID: 6e854005d1c3a800b9c432abee464aa87c26d98c65dcc2fcb118680daa02696b
Opcode Fuzzy Hash: c05bcfb0049ea7936a2e95382a4f5e96cb1fdfdeb31953fe49fadc5df4d58cc0
Instruction Fuzzy Hash: 51915B21E0CA9283FA64AF57B8C03B9A795AF55FA8F944135DACD07695DF3CE841C320

Function 00007FF7C41AE270 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AE280
strstr.VCRUNTIME140 ref: 00007FF7C41AE2AF
strchr.VCRUNTIME140 ref: 00007FF7C41AE2DB
strrchr.VCRUNTIME140 ref: 00007FF7C41AE2F5
strchr.VCRUNTIME140 ref: 00007FF7C41AE30A
strrchr.VCRUNTIME140 ref: 00007FF7C41AE36A

Strings

/, xrefs: 00007FF7C41AE33E
., xrefs: 00007FF7C41AE34A
/, xrefs: 00007FF7C41AE383
/, xrefs: 00007FF7C41AE2C5
?, xrefs: 00007FF7C41AE2E8

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: db58426608187a773fbd2a2958ecdc5d72830516e9004e40152fd23e58ffe20e
Instruction ID: 37ffc2605d4582ddffde411a45c9f28d39597c09a61cb4d66363dee637f1d8c4
Opcode Fuzzy Hash: db58426608187a773fbd2a2958ecdc5d72830516e9004e40152fd23e58ffe20e
Instruction Fuzzy Hash: A3819113A4C3824BFB65AE13B684379FAD5AF45FA8F884031DACD467D6DE7CA4458320

Function 00007FF7C41A9170 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C41A9243
strchr.VCRUNTIME140 ref: 00007FF7C41A929A
strchr.VCRUNTIME140 ref: 00007FF7C41A92B2
strchr.VCRUNTIME140 ref: 00007FF7C41A92CD
strchr.VCRUNTIME140 ref: 00007FF7C41A9349
strchr.VCRUNTIME140 ref: 00007FF7C41A9361
strchr.VCRUNTIME140 ref: 00007FF7C41A937C
strchr.VCRUNTIME140 ref: 00007FF7C41A9397
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A9424

Strings

/D:, xrefs: 00007FF7C41A9216
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF7C41A932A
Failed sending DICT request, xrefs: 00007FF7C41A9431
/FIND:, xrefs: 00007FF7C41A91E0
default, xrefs: 00007FF7C41A92F3, 00007FF7C41A93BD
lookup word is missing, xrefs: 00007FF7C41A92E4, 00007FF7C41A93AE
/DEFINE:, xrefs: 00007FF7C41A91FB
/M:, xrefs: 00007FF7C41A91C5
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF7C41A9405
/LOOKUP:, xrefs: 00007FF7C41A922D
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF7C41A927A
/MATCH:, xrefs: 00007FF7C41A91AA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: 7143a03381089a2ac95f28d5c1d740bf8713956653375e2d1bb58f9f69cf5f66
Instruction ID: 03db10668384a1530f373c30c92a640858f3dcc224f135b715f72ff2696337cd
Opcode Fuzzy Hash: 7143a03381089a2ac95f28d5c1d740bf8713956653375e2d1bb58f9f69cf5f66
Instruction Fuzzy Hash: 51816322A2C64247EA21AF27BAD02B5E691AF45FECFC84431DDCD07796DE2DE545C320

Function 00007FF7C4186190 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41861AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41861C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41861D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41861E3

Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C4180081
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C4180091
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C418009F
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800AD
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800BB
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800C9
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800D7
Part of subcall function 00007FF7C4180070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180941,?,?,00000000,00007FF7C4182023,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41800E5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418621F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186233
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186286
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418629A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41862AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41862C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418632A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418633E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186352
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186366
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41863CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418640A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418641E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186432
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186446
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418645A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418646E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186482
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4186496
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41864B8

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5d74550f0550001426cdd3e889b9050de0daf63c6a9ab3fbc75dcff549170c7b
Instruction ID: e08099db14377c614130039d25e1058f424b74039aac925d93317ce06edc5fa6
Opcode Fuzzy Hash: 5d74550f0550001426cdd3e889b9050de0daf63c6a9ab3fbc75dcff549170c7b
Instruction Fuzzy Hash: 0791C43AA18B8193E749DF21E9942ACB3A8F749F68F440135EF9D47355CF34A2A58324

Function 00007FF7C418E7D0 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 312stringCOMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418E8C5
strchr.VCRUNTIME140 ref: 00007FF7C418E965
memmove.VCRUNTIME140 ref: 00007FF7C418E995
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C418E9C1
strchr.VCRUNTIME140 ref: 00007FF7C418EA0C
memmove.VCRUNTIME140 ref: 00007FF7C418EA6B

Part of subcall function 00007FF7C417BB40: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C417BB84

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418EB84

Strings

RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00007FF7C418ECAE
:%u, xrefs: 00007FF7C418E8D9, 00007FF7C418EB98
@, xrefs: 00007FF7C418EA56
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00007FF7C418E867
], xrefs: 00007FF7C418EA45
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00007FF7C418EAFA
Resolve address '%s' found illegal!, xrefs: 00007FF7C418EAEB
%255[^:]:%d, xrefs: 00007FF7C418E851
Added %s:%d:%s to DNS cache, xrefs: 00007FF7C418EC7D
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00007FF7C418EC0B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memmovestrchrtolower$__stdio_common_vsscanfstrtoul
String ID: %255[^:]:%d$:%u$@$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!$]
API String ID: 2189764445-1753329177
Opcode ID: b940367945bb76dc5483cbadd53d103c0235a8e11011be2bee7d362466e72a1f
Instruction ID: fd5837817b0f3e4fec4a71ff7cf88c697c31deb4e38d279bd353904d457dca20
Opcode Fuzzy Hash: b940367945bb76dc5483cbadd53d103c0235a8e11011be2bee7d362466e72a1f
Instruction Fuzzy Hash: 7BD1B522A19B8646EB20AF22E4803F9A750FB45FACF854531DE9E4B6C5DF7CE505C321

Function 00007FF7C4185260 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4185582

Strings

socks5, xrefs: 00007FF7C4185320
socks4, xrefs: 00007FF7C4185356
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF7C41853C4
socks5h, xrefs: 00007FF7C4185302
http, xrefs: 00007FF7C418537E
socks, xrefs: 00007FF7C418536A
socks4a, xrefs: 00007FF7C418533B
https, xrefs: 00007FF7C41852E4
Unsupported proxy syntax in '%s', xrefs: 00007FF7C418556A
Unsupported proxy scheme for '%s', xrefs: 00007FF7C4185391

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: 9ab89eb681ace42cd3327cd2457f57be4967fd92c510a5af0fe52c79bf53d8db
Instruction ID: 6abf53a8076cba1baefecf80a4c2f3ba18671a0ba3bfc276eabd4d82f2714369
Opcode Fuzzy Hash: 9ab89eb681ace42cd3327cd2457f57be4967fd92c510a5af0fe52c79bf53d8db
Instruction Fuzzy Hash: E5A16B32E1864287EB10EF63F8806ADA7A5AB44FBCF864531DE8D57685DF38E544C321

Function 00007FF7C4196640 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7C41968AA
Failed to send SOCKS4 connect request., xrefs: 00007FF7C41969ED
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF7C419692B
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF7C4196B46
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF7C4196706
SOCKS4 communication to %s:%d, xrefs: 00007FF7C419671F
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7C41967AB
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7C4196A9A
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7C4196B73
SOCKS4%s request granted., xrefs: 00007FF7C4196C06
Too long SOCKS proxy name, can't use!, xrefs: 00007FF7C4196807
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF7C4196AE1
[, xrefs: 00007FF7C4196BD4
SOCKS4 connection to %s not supported, xrefs: 00007FF7C419690C
SOCKS4: too long host name, xrefs: 00007FF7C4196A06
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7C4196BAD
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF7C4196BE4

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 458e281d6fdca1cd6422b911785154965284bd01193e4f5c081e253ac6d9dce7
Instruction ID: 219889cd8cb9d8861af2207936c3c34bdb6227cc11025f6bfbfa3fb3a25f14d4
Opcode Fuzzy Hash: 458e281d6fdca1cd6422b911785154965284bd01193e4f5c081e253ac6d9dce7
Instruction Fuzzy Hash: 9FE1D26290C2818BEB54AF16E980379BB91EB55FA8F848135EACE47795CF3CE454C730

Function 00007FF7C41B88B0 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B89C3

Strings

RSA Public Key, xrefs: 00007FF7C41B89AF
dsa, xrefs: 00007FF7C41B8A25
dh(g), xrefs: 00007FF7C41B8B50
dsa(q), xrefs: 00007FF7C41B8A8C
dsa(g), xrefs: 00007FF7C41B8ABC
RSA Public Key (%lu bits), xrefs: 00007FF7C41B897E
rsa(n), xrefs: 00007FF7C41B89D0
dh(pub_key), xrefs: 00007FF7C41B8B66
dsa(p), xrefs: 00007FF7C41B8A5D
%lu, xrefs: 00007FF7C41B8998
rsaEncryption, xrefs: 00007FF7C41B88F5
dhpublicnumber, xrefs: 00007FF7C41B8AE6
dh(p), xrefs: 00007FF7C41B8B1F
dsa(pub_key), xrefs: 00007FF7C41B8AD2
rsa(e), xrefs: 00007FF7C41B89FB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: 5a1e0f392e81152b69c3f46ebfba3a58fea45dd8b5183e4513928a236712a41c
Instruction ID: 78b0ea46c1c15ff9ed10e38f20a995577d480c2253001be591503cfd6b0835b2
Opcode Fuzzy Hash: 5a1e0f392e81152b69c3f46ebfba3a58fea45dd8b5183e4513928a236712a41c
Instruction Fuzzy Hash: F4715F95A08B8657EE11AF22B5901B9A3A0FF89FECF844032DDCD53785DE3CE505C6A0

Function 00007FF7C416628D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C416A890: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416A9E7

Part of subcall function 00007FF7C4169580: memmove.VCRUNTIME140 ref: 00007FF7C4169653

Part of subcall function 00007FF7C416B1E0: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,00007FF7C416AAA2), ref: 00007FF7C416B2BF

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C416633E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C416636C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4166379
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41663B2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4166410
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41664CC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C41664FA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4166507
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4166540
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4166592
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41665D6

Strings

value, xrefs: 00007FF7C41662A6, 00007FF7C4166431

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memmove
String ID: value
API String ID: 585464943-494360628
Opcode ID: 2709a484131b528fb5fe829fa310d97f152698505fcb1e1ddfbbcbb50b66ae1d
Instruction ID: 2eebf0aff5739a50436d9480f9d68a9c8da504d76384f73f72e7469f85261189
Opcode Fuzzy Hash: 2709a484131b528fb5fe829fa310d97f152698505fcb1e1ddfbbcbb50b66ae1d
Instruction Fuzzy Hash: 44A19962E1868197FB109F69F4813EDA721EB85BF8F905335EAED026D9DF6CD081C610

Function 00007FF7C4171890 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C41718B2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41718BA
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41718D9
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41718E5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41718F4
strrchr.VCRUNTIME140 ref: 00007FF7C4171945
strrchr.VCRUNTIME140 ref: 00007FF7C4171966
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417197F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C417198A
GetLastError.KERNEL32 ref: 00007FF7C4171993
SetLastError.KERNEL32 ref: 00007FF7C417199F

Strings

Unknown error %d (%#x), xrefs: 00007FF7C4171927

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_nerrstrerrorstrncpy
String ID: Unknown error %d (%#x)
API String ID: 4262108436-2414550090
Opcode ID: 8a26922a070a5311f4fdd5d427a84f0c3219b6707aaccc85e17a5e3c4a4b9e3d
Instruction ID: 9ff29c18a1db86fe90ecb4f8648ff1b4c652114a2c05a191aebaf945dafc9e9d
Opcode Fuzzy Hash: 8a26922a070a5311f4fdd5d427a84f0c3219b6707aaccc85e17a5e3c4a4b9e3d
Instruction Fuzzy Hash: 96313221A0875287FA256F53B854279E651BF84FB8F984035DECE17B95DF3DE8028360

Function 00007FF7C41B4820 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B4895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B48B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B48D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B48DF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B4966
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B49B5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B4A16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B4B9C

Strings

SPNEGO handshake failure (empty challenge message), xrefs: 00007FF7C41B4A66
InitializeSecurityContext failed: %s, xrefs: 00007FF7C41B4BBA
HTTP, xrefs: 00007FF7C41B4820
Negotiate, xrefs: 00007FF7C41B4824, 00007FF7C41B492C, 00007FF7C41B49D3
CompleteAuthToken failed: %s, xrefs: 00007FF7C41B4BF7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: 422a2b874066ea2487910c1f9b40b591d53a3a49f61c1c762e7e138969dbdeb6
Instruction ID: 0ccaded6bb594887f0547551ca3b5ea9bfce31606a84d0a36d2bd25093d0777f
Opcode Fuzzy Hash: 422a2b874066ea2487910c1f9b40b591d53a3a49f61c1c762e7e138969dbdeb6
Instruction Fuzzy Hash: B2C14876A04B5187EB10EF66E8802ADB7A4FB48FA8F804536DE8D43B58DF38D945C750

Function 00007FF7C41B6700 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B67B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B6819
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B683C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B689C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B690C

Strings

Version, xrefs: 00007FF7C41B68F7
TRUE, xrefs: 00007FF7C41B6971
%2d Subject: %s, xrefs: 00007FF7C41B6804
Issuer, xrefs: 00007FF7C41B6870
Version: %lu (0x%lx), xrefs: 00007FF7C41B691E
%lx, xrefs: 00007FF7C41B68DC
Subject, xrefs: 00007FF7C41B67EA
Issuer: %s, xrefs: 00007FF7C41B688A

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: 09119d801259f12b618e35cbf3773769375e3f222445dfe7a2aebb7dcc4eccbb
Instruction ID: 802a1354e60978515b128a96942985946955dd4a1d1588ed358943495911cda9
Opcode Fuzzy Hash: 09119d801259f12b618e35cbf3773769375e3f222445dfe7a2aebb7dcc4eccbb
Instruction Fuzzy Hash: 9B61BFA1A08B8286EB11AF26B4887F9A7A1BB45FBCF844535CD8D07791DF3CE145C320

Function 00007FF7C41AC5D3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 292COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AC6D3

Strings

TFTP buffer too small for options, xrefs: 00007FF7C41AC7CF, 00007FF7C41AC918
tsize, xrefs: 00007FF7C41AC7E2
blksize, xrefs: 00007FF7C41AC8A8
%I64d, xrefs: 00007FF7C41AC766
timeout, xrefs: 00007FF7C41AC995
TFTP file name too long, xrefs: 00007FF7C41AC6BF
%s%c%s%c, xrefs: 00007FF7C41AC6EA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: a0457e560e4824c1c3775565141ea9a311c98de5080d79e0dcff03ab5273a2b2
Instruction ID: 70bcd194345b2066b6df34a7dcb58c0eb1b9c8acbb14bcba0e339d78a1bfb8d3
Opcode Fuzzy Hash: a0457e560e4824c1c3775565141ea9a311c98de5080d79e0dcff03ab5273a2b2
Instruction Fuzzy Hash: B4E17F62A08A8686EB11DF65E4843B9A7A1FB45FACFC49132CA8D47785EF3CD545C320

Function 00007FF7C41AA880 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7C41AAA7C
WSAGetLastError.WS2_32 ref: 00007FF7C41AAA8E
send.WS2_32 ref: 00007FF7C41AAB86
WSAGetLastError.WS2_32 ref: 00007FF7C41AAB90

Strings

%127[^,],%127s, xrefs: 00007FF7C41AA9E8
%c%c%c%c, xrefs: 00007FF7C41AA95D
#, xrefs: 00007FF7C41AAAFE
%c%c, xrefs: 00007FF7C41AAA58
%c%c%c%c%s%c%c, xrefs: 00007FF7C41AAB5F
Sending data failed (%d), xrefs: 00007FF7C41AAA94, 00007FF7C41AAB96
%c%s%c%s, xrefs: 00007FF7C41AAA20

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: a60c4811564ddf0ebd5665b232f8d0fb7a5b9fa0a33fdb56fc324498814b9288
Instruction ID: ea4bebf4f62eeca2d7fcc6151cca39b93e02a9a12d39c64dc41d6e421c2cbbc9
Opcode Fuzzy Hash: a60c4811564ddf0ebd5665b232f8d0fb7a5b9fa0a33fdb56fc324498814b9288
Instruction Fuzzy Hash: 6C919132A08AC196F721AF55F8857EAA3A0FB44BACF840231EE8D07A95DF3DD145C750

Function 00007FF7C41AC230 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7C41AC3A8
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C41AC3C3
sendto.WS2_32 ref: 00007FF7C41AC42A
sendto.WS2_32 ref: 00007FF7C41AC4E1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C41AC519

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7C41AC2A2
tftp_rx: internal error, xrefs: 00007FF7C41AC27E
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF7C41AC521
Received last DATA packet block %d again., xrefs: 00007FF7C41AC475

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: 1bbd975cd564bb4da1e94cd4f48ca4c4eb3e157376f18eaf9909052a9df2af6c
Instruction ID: 2b074b948465365c3f49caa0432e820f025687eb4f8b222e65bb93387a1c17ea
Opcode Fuzzy Hash: 1bbd975cd564bb4da1e94cd4f48ca4c4eb3e157376f18eaf9909052a9df2af6c
Instruction Fuzzy Hash: 1B915E72608781C6D721DF2AE4803A97BA1FB88F98F948132DA8D4B758DF39D546C720

Function 00007FF7C41855B0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865A4
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865BA
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865CE
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865E2
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865F6
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418660A
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418661E
Part of subcall function 00007FF7C4186590: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C4186632

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4185632

Part of subcall function 00007FF7C41AE570: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE585
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE59F
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5BA
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5D6
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5F2
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE60A
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE622
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE63A
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE652
Part of subcall function 00007FF7C41AE570: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE66A
Part of subcall function 00007FF7C41AE570: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE684

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4185836
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4185879
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7C41859BE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4185A3B

Strings

%s://%s, xrefs: 00007FF7C418563F
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF7C418577F
file, xrefs: 00007FF7C4185923, 00007FF7C418599C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 406f3132d8d53707348b8b435c7066996388d0f99c621d29109b210fc243afb4
Instruction ID: 8c871f1cfff2d04608fca13a0846a01b08e995faf87f427a312d9c8e66eb017c
Opcode Fuzzy Hash: 406f3132d8d53707348b8b435c7066996388d0f99c621d29109b210fc243afb4
Instruction Fuzzy Hash: 99C19632B0868287EB68AE27E5903F9A790FB45B7CF954431CA8D47685DF3CE5548321

Function 00007FF7C41BB570 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BBA3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BBA93

Strings

OAUTHBEARER, xrefs: 00007FF7C41BB882
LOGIN, xrefs: 00007FF7C41BB9B3
GSSAPI, xrefs: 00007FF7C41BB706
PLAIN, xrefs: 00007FF7C41BB94A
DIGEST-MD5, xrefs: 00007FF7C41BB7A3
NTLM, xrefs: 00007FF7C41BB7F9
XOAUTH2, xrefs: 00007FF7C41BB8F5
EXTERNAL, xrefs: 00007FF7C41BB68B
CRAM-MD5, xrefs: 00007FF7C41BB7C2

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: b20d92b65dda6d04082cec67903383bd492263e0f9d9b285fa864967b0617866
Instruction ID: af55765a73fe687ad8c4effebad6b8a994c698ec1f90177dfe9eef188721037b
Opcode Fuzzy Hash: b20d92b65dda6d04082cec67903383bd492263e0f9d9b285fa864967b0617866
Instruction Fuzzy Hash: 87D14EB290968286EB609F12F4807A9BBA0FB44B68F844235DECD07B99DF7CD545C724

Function 00007FF7C419D6E0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4170F50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4170F7E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419D97E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419D988
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419D9E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419D9ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419D9FA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7C419D6E8
SECTION, xrefs: 00007FF7C419D8F8
PARTIAL, xrefs: 00007FF7C419D936
UID, xrefs: 00007FF7C419D876
UIDVALIDITY, xrefs: 00007FF7C419D835
MAILINDEX, xrefs: 00007FF7C419D8B7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: d991a50fb50f4b42701e53a507614ea57fdc0a994e2ec1112fafa5f1084d09ff
Instruction ID: e9857459c9365498a7a633cfe4d6393327c247b250585ce937561ebcf048f8d3
Opcode Fuzzy Hash: d991a50fb50f4b42701e53a507614ea57fdc0a994e2ec1112fafa5f1084d09ff
Instruction Fuzzy Hash: 63A1762291968287EB55BF26E8843B8AB91FB54FADF840035DACE47685DF3CD480C321

Function 00007FF7C41AF221 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF12B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF19F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF29D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF306
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF31E

Part of subcall function 00007FF7C41AE270: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AE280

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF346
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF35D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF3CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AF3E4

Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF52C
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF536
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF540
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF54A
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF554
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF55E
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF568
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF572
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF57C
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF586
Part of subcall function 00007FF7C41AF520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF590

Strings

,, xrefs: 00007FF7C41AF264
:, xrefs: 00007FF7C41AF247

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: 77cea86b075c19c5883de3ad62039e5b857d63d4be3bb5abbcb55c11ea9a35d6
Instruction ID: ea92a4fbb516edba4374252c915905352085c89d37d5cb02f089d3d92f8c2338
Opcode Fuzzy Hash: 77cea86b075c19c5883de3ad62039e5b857d63d4be3bb5abbcb55c11ea9a35d6
Instruction Fuzzy Hash: F8516016E08A8683E721AF36A5543B9A350BF59FACF449231CECD16652EF7CF5C48320

Function 00007FF7C41AE570 Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE585
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE59F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5BA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5D6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE5F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE60A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE622
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE63A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE652
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE66A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41855D5,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41AE684

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: b816bd71b5677e9fedbc4392f1096af1f7c54246343b0c4879003323c4abc12c
Instruction ID: c45426bd055b6bbf83185473e55acb22880f01003fe9b3b78b54459cb914f46e
Opcode Fuzzy Hash: b816bd71b5677e9fedbc4392f1096af1f7c54246343b0c4879003323c4abc12c
Instruction Fuzzy Hash: 2D31AB26A47B0287EF59EF56B19423873E0AF44FA8B480935CA8D47750EF3CE4A48720

Function 00007FF7C41C1630 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41C168D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41C16FD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41C176D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41C17DD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41C184D

Strings

krnigger, xrefs: 00007FF7C41C1641
1.0, xrefs: 00007FF7C41C1791
pqS83QAUXN, xrefs: 00007FF7C41C16B1
krnigger, xrefs: 00007FF7C41C1860

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 1.0$krnigger$krnigger$pqS83QAUXN
API String ID: 3668304517-2420232876
Opcode ID: 22b3cd600db51bcc05483c85adb28c2e3b2d82efc4b6e5bf677eb34c88eb8d67
Instruction ID: 6a4035dd41e42db33e8f954b48bf029d5257685a7c9fcc4afd581e3c34f5f4a5
Opcode Fuzzy Hash: 22b3cd600db51bcc05483c85adb28c2e3b2d82efc4b6e5bf677eb34c88eb8d67
Instruction Fuzzy Hash: 615191A1E19AC682FA25FF2BFCC5378A321AF41FBCFD14035C99E06561DE5D68848320

Function 00007FF7C41A45C0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF7C41A4600
NLST, xrefs: 00007FF7C41A46BB
LIST, xrefs: 00007FF7C41A46C2
%s%s%s, xrefs: 00007FF7C41A46E5
Couldn't set desired mode, xrefs: 00007FF7C41A45DE

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: 17c7d70dce2cdd58923ca33766beddf6237fee72497fbd510ba1c3bf52259a9c
Instruction ID: f6d78563c62999996ca0768f4bce7939447e3b81ac2515430157973700f7f0e5
Opcode Fuzzy Hash: 17c7d70dce2cdd58923ca33766beddf6237fee72497fbd510ba1c3bf52259a9c
Instruction Fuzzy Hash: 6B41B426B0869287EA24BF57F9C41B9E361EB45FB8FC44031DA8D07691DF7CE9448760

Function 00007FF7C41A77E0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A7A38

Part of subcall function 00007FF7C4175060: realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4175075
Part of subcall function 00007FF7C4175060: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417508B

memmove.VCRUNTIME140 ref: 00007FF7C41A7858
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A79A9
memmove.VCRUNTIME140 ref: 00007FF7C41A7A72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A7A7E

Strings

Got an error writing an RTP packet, xrefs: 00007FF7C41A798B
Failed writing RTP data, xrefs: 00007FF7C41A7973
Cannot pause RTP, xrefs: 00007FF7C41A797C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$memmove$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 1952216613-1165944077
Opcode ID: c0cb9927d6e0824576f5d01c4661a791a758e9324700c055622df5f108ae8a88
Instruction ID: 1ecad9c395f982a71a0a5e4526b5848cd6b2f2b7f2ddd732f0cd2da5b610e598
Opcode Fuzzy Hash: c0cb9927d6e0824576f5d01c4661a791a758e9324700c055622df5f108ae8a88
Instruction Fuzzy Hash: 31717136B09B8597E654EF22E8843A9A7A4FB49FA4F844036DBAD47741DF3CE560C310

Function 00007FF7C41BE130 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BE1FA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BE248
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BE2AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BE3E9

Part of subcall function 00007FF7C41B2190: strchr.VCRUNTIME140(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B21D6
Part of subcall function 00007FF7C41B2190: strchr.VCRUNTIME140(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B21E6
Part of subcall function 00007FF7C41B2190: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B2210
Part of subcall function 00007FF7C41B2190: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B2245
Part of subcall function 00007FF7C41B2190: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B226A
Part of subcall function 00007FF7C41B2190: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B228C

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41BE474

Strings

Kerberos, xrefs: 00007FF7C41BE1C3, 00007FF7C41BE265
GSSAPI, xrefs: 00007FF7C41BE133
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF7C41BE2F3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 963169ac9c56b98036bf26a16841beaf6f1ed46610666076659215a0a0ce422d
Instruction ID: 252eb02533d4663db517399d89672b29da5fe59396ef8974d07de054a6113599
Opcode Fuzzy Hash: 963169ac9c56b98036bf26a16841beaf6f1ed46610666076659215a0a0ce422d
Instruction Fuzzy Hash: C9A14B72A08B558BEB50AF66E48026DB3A5FB44FA8F800035DE8D97B58DF38E445C760

Function 00007FF7C417A1D5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A21A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A23A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A28B

Part of subcall function 00007FF7C417BAA0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417BAA6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A391

Strings

Replaced, xrefs: 00007FF7C417A621
Added, xrefs: 00007FF7C417A62D
FALSE, xrefs: 00007FF7C417A36B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C417A637

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 15ef4e01452f7665c1fb64662ef4cfa0a24fb11c901d9f79467f9953aff3486b
Instruction ID: 831b0f7d7bc6cb9ad86a4fe8004fb81a8ebe9b629a6d1d6d1dee956e618a90b5
Opcode Fuzzy Hash: 15ef4e01452f7665c1fb64662ef4cfa0a24fb11c901d9f79467f9953aff3486b
Instruction Fuzzy Hash: B091352290D68247FE71AF17B5D4379A7D4BF45BA8F884135DECE82691DF2CE8848321

Function 00007FF7C41926B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C419277C

Strings

Basic, xrefs: 00007FF7C4192871
Authentication problem. Ignoring this., xrefs: 00007FF7C41928BD
Ignoring duplicate digest auth header., xrefs: 00007FF7C419282D
NTLM, xrefs: 00007FF7C41927AC
Negotiate, xrefs: 00007FF7C4192726
Digest, xrefs: 00007FF7C4192814
Bearer, xrefs: 00007FF7C4192898

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 55d8f31db4707d092a797eaed3a40aefe338ecb118a5c6be7d6350c808c31e51
Instruction ID: 4e71384b41cb62405877c39cc9d2339d68e86d7ed0bdc3a2aad099acae29ae44
Opcode Fuzzy Hash: 55d8f31db4707d092a797eaed3a40aefe338ecb118a5c6be7d6350c808c31e51
Instruction Fuzzy Hash: DF71C56190829257F724AE13BDC12BAB6D2AF11FBCF848434DEDA4A681DF3CE5548721

Function 00007FF7C417A2E3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A2E6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A391

Strings

Replaced, xrefs: 00007FF7C417A621
Added, xrefs: 00007FF7C417A62D
__Host-, xrefs: 00007FF7C417A31D
__Secure-, xrefs: 00007FF7C417A300
FALSE, xrefs: 00007FF7C417A36B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C417A637

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 0e73888632fb5fb8ad4fab0c86c8ef2fde3f729aaa96635abc87c2b74c10d1ae
Instruction ID: 1f803e1b48e0012169883c0a2e0091ab722a44e5bdd4c11f0c859febceb7dd76
Opcode Fuzzy Hash: 0e73888632fb5fb8ad4fab0c86c8ef2fde3f729aaa96635abc87c2b74c10d1ae
Instruction Fuzzy Hash: 6D71326190868247FA71AF17F5D4379A7D4BF45BACF884136DECE82691DF2CE8848321

Function 00007FF7C41A06D0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41A078F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41A07D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A0890

Strings

VRFY %s%s%s%s, xrefs: 00007FF7C41A085E
EXPN, xrefs: 00007FF7C41A0717
HELP, xrefs: 00007FF7C41A08C5
%s %s%s, xrefs: 00007FF7C41A0759
SMTPUTF8, xrefs: 00007FF7C41A073D, 00007FF7C41A0845

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: 28b9a1523ab1c7f9573c4d210a0203ca9a541d8ec4b18c0eac3cc204b677b4e5
Instruction ID: c1461fc6d83938815aeb4e553cfcef9bddf38dfe83be161d05d8e6b81e3108fb
Opcode Fuzzy Hash: 28b9a1523ab1c7f9573c4d210a0203ca9a541d8ec4b18c0eac3cc204b677b4e5
Instruction Fuzzy Hash: 35517262E08B8186EB11AF16F480779ABB0EB46FA8FC44131DACD53691DF2CD945C751

Function 00007FF7C4173637 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

ALL, xrefs: 00007FF7C4173643
Set-Cookie:, xrefs: 00007FF7C4173758
FLUSH, xrefs: 00007FF7C41736C3
SESS, xrefs: 00007FF7C4173683
RELOAD, xrefs: 00007FF7C41736E5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 17fcdf52929647573a5815f9b4f0eae3cc44ac667b3bbfd901825cf671347f49
Instruction ID: 46d5946e1adddc3308dca3979ee8afeb6596b0aa2f198b5335f66a0fcc64f5c0
Opcode Fuzzy Hash: 17fcdf52929647573a5815f9b4f0eae3cc44ac667b3bbfd901825cf671347f49
Instruction Fuzzy Hash: D9415C20B1C65243EA24BF23B9902B992956F84FF8FD40035DE8E47692DF2DE8418361

Function 00007FF7C417A6C0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A6ED
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A717
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A721
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A72B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A735
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A73F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A749
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A753
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A75D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A766
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7C41820D9,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C417A781

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e1eb5e29b948d2cb782d30ae98eafbd8cce427032c5c65a25337c535afd0243
Instruction ID: c6df157d5983bf8fc8a32ad56b7d430d8d7ff7a04529f6e11ded137bef2b5b79
Opcode Fuzzy Hash: 1e1eb5e29b948d2cb782d30ae98eafbd8cce427032c5c65a25337c535afd0243
Instruction Fuzzy Hash: 75219A3EA18A4183D750EF52F898129A7B0FB88FB9F541031DE8E53725CF79D8898724

Function 00007FF7C41AF520 Relevance: 13.8, APIs: 11, Instructions: 29COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF52C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF536
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF540
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF54A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF554
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF55E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF568
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF572
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF57C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF586
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41AE552,?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AF590

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6fbbce19483b46e1ca4d57d7359519d0b7d7fc341524bef4740b67a036dcfa77
Instruction ID: 55ba76291446448199585bbd82f574510f9da86c3bcb90123e753d326bd9c50a
Opcode Fuzzy Hash: 6fbbce19483b46e1ca4d57d7359519d0b7d7fc341524bef4740b67a036dcfa77
Instruction Fuzzy Hash: B701B33EA14901C3D714EFA6E8980286370FB8CF79B541031CE4E57225DE78D899C764

Function 00007FF7C41AE910 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AEA65
memmove.VCRUNTIME140 ref: 00007FF7C41AEA82

Strings

%%25%s], xrefs: 00007FF7C41AEA92
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7C41AEC52
https, xrefs: 00007FF7C41AE9A0
%ld, xrefs: 00007FF7C41AE9CE
file://%s%s%s, xrefs: 00007FF7C41AE95E
file, xrefs: 00007FF7C41AE92B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: mallocmemmove
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 2759278013-1832275178
Opcode ID: 320daaf6c934616595a55d50a33fa2b7f69f4412aca3ab29006d0728eedcf55e
Instruction ID: a75db42c439c47ec5eb1dac4896d783ca13a0ccf4e8a8822e71d92a8aa6ff24a
Opcode Fuzzy Hash: 320daaf6c934616595a55d50a33fa2b7f69f4412aca3ab29006d0728eedcf55e
Instruction Fuzzy Hash: 19A16262A49B8686EA65EF12B5803A9B3A4FF44FA8F944131DECD03758DF3CE444C720

Function 00007FF7C41B783C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B787F
memmove.VCRUNTIME140 ref: 00007FF7C41B78A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7978
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$mallocmemmove
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1934541353-2901970132
Opcode ID: fb4f053baeddf4ef43529120bcc07fac15e68411b770e901ffb1ae47b87aa811
Instruction ID: 1318b610920c44e7c6db9c65ca7eb9accaeffd4ba40221112d91fc1cd1398b8f
Opcode Fuzzy Hash: fb4f053baeddf4ef43529120bcc07fac15e68411b770e901ffb1ae47b87aa811
Instruction Fuzzy Hash: AD612AA5E0968247EB19AF67A0942B8A7A1AB05FFCF884535CEDE077C5DE3CD144C321

Function 00007FF7C415A300 Relevance: 13.6, APIs: 9, Instructions: 131COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7C415A365
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7C415A385
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7C415A395
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7C415A3DC
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF7C415A409
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7C415A42A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7C415A470
?uncaught_exceptions@std@@YAHXZ.MSVCP140 ref: 00007FF7C415A477
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7C415A484

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exceptions@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 4121003011-0
Opcode ID: 9351bff027a33abb8f1c6f9af12fd3abcc2ffdfd4c2c902f27f7418ce59ef7a1
Instruction ID: 829e6eb97004e82229915abcabb4f77f587428fed05a3c2ab10c06fdc20c4b7c
Opcode Fuzzy Hash: 9351bff027a33abb8f1c6f9af12fd3abcc2ffdfd4c2c902f27f7418ce59ef7a1
Instruction Fuzzy Hash: 73510F26A48E4183EB609F1EE5D4279E7A0EB85FE9B558531CE9E43B60CF3DD4468310

Function 00007FF7C416D130 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF7C416D23F
memmove.VCRUNTIME140 ref: 00007FF7C416D294

Part of subcall function 00007FF7C414BDB0: ?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,00007FF7C4159AE6), ref: 00007FF7C414BDBB

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C416D3F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C416D442
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C416D481
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C416D4D0

Strings

[json.exception., xrefs: 00007FF7C416D2A0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove$Xlength_error@std@@
String ID: [json.exception.
API String ID: 2945886334-791563284
Opcode ID: 1553eb45fc7dfcb0dc4fc860aa94863162370a03fb9cd87c59f94e876065ea5a
Instruction ID: 4168ea45ab917f132f968002a75da927d2b138547ccd53770612db74ad8fd161
Opcode Fuzzy Hash: 1553eb45fc7dfcb0dc4fc860aa94863162370a03fb9cd87c59f94e876065ea5a
Instruction Fuzzy Hash: 69B1A162F28B4596FB009F6AE5813ED6361EB54BACF804225CEAC17BD5DF78E085C350

Function 00007FF7C41A65BF Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 258COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7C41A6647

Part of subcall function 00007FF7C41A6BF0: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C41A6C26
Part of subcall function 00007FF7C41A6BF0: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C41A6C7B

Strings

Can't get the size of file., xrefs: 00007FF7C41A6829
Content-Length: %I64d, xrefs: 00007FF7C41A66A3
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF7C41A67AB
Accept-ranges: bytes, xrefs: 00007FF7C41A66DE
failed to resume file:// transfer, xrefs: 00007FF7C41A69A6

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: 10c0a979b65f08cc15498c6ce44cf9d90577da4f0f3dc8a2f29d318d7b8e75ae
Instruction ID: 2998ba98704ae253361e3c3733350fb69b6c4b9a4e3fc4ae5199facfe255df97
Opcode Fuzzy Hash: 10c0a979b65f08cc15498c6ce44cf9d90577da4f0f3dc8a2f29d318d7b8e75ae
Instruction Fuzzy Hash: 52B14462A0868287EB21EF27B5903BAA391FB55FACF844035DECD47755EE3CE4048761

Function 00007FF7C418D570 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418D5CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418D6CE
WSAIoctl.WS2_32 ref: 00007FF7C418D827
setsockopt.WS2_32 ref: 00007FF7C418D84F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418D946

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7C418D6E0
We are completely uploaded and fine, xrefs: 00007FF7C418D8BA

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: c97ff2764eb9abc10c78751ab1a26cdd260a621c13f0bc5a69d94aa7c03da542
Instruction ID: 44632397d1c51eba41f9e0c3698a1131b11b4e66bfdf7660d89f84b3a5df9b81
Opcode Fuzzy Hash: c97ff2764eb9abc10c78751ab1a26cdd260a621c13f0bc5a69d94aa7c03da542
Instruction Fuzzy Hash: B3B18332A18BC686EB65AF26E4843F97790EB45F6CF490135CE8D0A785DF3C9495C321

Function 00007FF7C4164170 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41652DE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C416530B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C4165318
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4165352
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41653A5

Strings

value, xrefs: 00007FF7C4165244

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: a9e94ee63b0b310fc4eab13a7bc9c1f8333fa726b298396fd78009db813e2004
Instruction ID: ded96ebb403679d3468faebf8203ebaec73c3b78df2dc0efe6e57eef7d37a29a
Opcode Fuzzy Hash: a9e94ee63b0b310fc4eab13a7bc9c1f8333fa726b298396fd78009db813e2004
Instruction Fuzzy Hash: BD61B962E18A8197EB10DF6AF8843EDA320FB45BB8F905335DADD026D5DF6CD081C210

Function 00007FF7C41B96A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B96E8
memmove.VCRUNTIME140 ref: 00007FF7C41B970D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B97DF
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9823
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B989E

Strings

TRUE, xrefs: 00007FF7C41B97FD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freeisupper$mallocmemmove
String ID: TRUE
API String ID: 2733518094-3412697401
Opcode ID: 869b286a8562243a2dc2af0a4f5f10069b667ddebb95ff4c394edabfe5814a3e
Instruction ID: d02e2e6088dc1b0a1c51a47271d6a148a822e01144b626c58bb8ca6fd3ea5b3f
Opcode Fuzzy Hash: 869b286a8562243a2dc2af0a4f5f10069b667ddebb95ff4c394edabfe5814a3e
Instruction Fuzzy Hash: D5513991E1D59607FB1AAE276199338AF92AB01FB8F844235CEDF066C5DE6C9046C730

Function 00007FF7C41AA6D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7C41AA73C
htons.WS2_32 ref: 00007FF7C41AA752
send.WS2_32 ref: 00007FF7C41AA7F8
WSAGetLastError.WS2_32 ref: 00007FF7C41AA80C
send.WS2_32 ref: 00007FF7C41AA84E
WSAGetLastError.WS2_32 ref: 00007FF7C41AA858

Strings

Sending data failed (%d), xrefs: 00007FF7C41AA812, 00007FF7C41AA85E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: a77234836eeb555a5599773943b433859fefda66074d56d9591f49550c15f242
Instruction ID: 4cde5e863e49acd01553a5e4482ac067317d3a20da267b48881c521bce45e4b9
Opcode Fuzzy Hash: a77234836eeb555a5599773943b433859fefda66074d56d9591f49550c15f242
Instruction Fuzzy Hash: 4D419D33B08A8686E700AF76E890AA9B7B0F754FADF844532DB8903654DF7CD456C321

Function 00007FF7C41B75AE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B75B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Part of subcall function 00007FF7C4181260: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41812B2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 04f0c141c4cfea5df78b8faf89fa86bb0122a7f39375358164ac5b1886210a7c
Instruction ID: 2aaac45814d2ea0afda46a2048efc8e2576d0c1999f7f414e6f0f144aec593b9
Opcode Fuzzy Hash: 04f0c141c4cfea5df78b8faf89fa86bb0122a7f39375358164ac5b1886210a7c
Instruction Fuzzy Hash: F33160A5E0978246EB11AF66A4841F9A7A1BF05FECF881435CE8E17356DE3CE5048321

Function 00007FF7C41B76AD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C41B77E1
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
GMT, xrefs: 00007FF7C41B776E
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: a2b53581e720ff5f6dfdef2285f83dc4384e675a08f7cc3c507daedf0c1c9dbe
Instruction ID: fe37a1530412bcafbea3890c9bcd5639f4f8f79fa6c8b840c953526436d1383a
Opcode Fuzzy Hash: a2b53581e720ff5f6dfdef2285f83dc4384e675a08f7cc3c507daedf0c1c9dbe
Instruction Fuzzy Hash: F871AFA5E0868246EB11AF26B4881B8ABA1BB05FACFC85435DEDD07755DF3CE545C320

Function 00007FF7C41B75E4 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
GMT, xrefs: 00007FF7C41B7646
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7C41B7699
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: 12534195ffa5c9beeb2986686d6235db7548f28a39cc05cc72896feb1d994309
Instruction ID: bfc081af260135c287433ff529353a0cfc9a6564a5b47cd6a8a9210992260280
Opcode Fuzzy Hash: 12534195ffa5c9beeb2986686d6235db7548f28a39cc05cc72896feb1d994309
Instruction Fuzzy Hash: 765171A5E09B8246EB11AF66A4801F9A7A1BB05FACFC85435CECD1B795DF3CE544C320

Function 00007FF7C41B7844 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B787F
memmove.VCRUNTIME140 ref: 00007FF7C41B78A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$mallocmemmove
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1934541353-2901970132
Opcode ID: e1f745866b5c4e1e683164d36f8c919ba13697180480088411e544155e11ecc7
Instruction ID: ec79878db8116bd05d6121c9a0baefd0eef448afe51f2ec494595230113e9e75
Opcode Fuzzy Hash: e1f745866b5c4e1e683164d36f8c919ba13697180480088411e544155e11ecc7
Instruction Fuzzy Hash: FF419EA5E0878246EB11AF67A4841F8A7A1BF09FFCF880535CD8D0B795DE3CA5048321

Function 00007FF7C41A57E6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A580D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A58C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A58D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A5908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A597C

Strings

SYST, xrefs: 00007FF7C41A58A6
Failed to figure out path, xrefs: 00007FF7C41A5982
Entry path is '%s', xrefs: 00007FF7C41A58DE, 00007FF7C41A5915

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: f3e426b46d3c5621932b550090c5e61df1bff909508fe1342d8d742137858285
Instruction ID: 2563d01636ad45b8e7050c607e41a6c754b17c745915c76e42f02652d7d162c0
Opcode Fuzzy Hash: f3e426b46d3c5621932b550090c5e61df1bff909508fe1342d8d742137858285
Instruction Fuzzy Hash: 2A416F66A0C68283EB21EF27F4843B8A7A0AB45FBCF944431CACE07656DE3CD5558321

Function 00007FF7C417A890 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A90A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A914
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A91E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A928
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A932
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A93C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A946
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A950
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A959

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 61f5e34218c9dc2db27eb6049c06cd5524dd797484f4da480b9bd73a9c6c4470
Instruction ID: 95c34a62fb3cbe6b5595596f49853b1717007593fa1655fa565a02e1f474b67f
Opcode Fuzzy Hash: 61f5e34218c9dc2db27eb6049c06cd5524dd797484f4da480b9bd73a9c6c4470
Instruction Fuzzy Hash: 5C31E93AA08A5187DB10AF52F984229A7A4FB88FE8F444031DE8D57B59CF7CD855C714

Function 00007FF7C417A7B0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A7F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A801
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A80B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A815
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A81F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A833
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A83D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417A846

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f1756db53465c883b7b81199deeb61188d3ae09f91e078a5a4cf0558defa9243
Instruction ID: 12613732400dc68298694197ec0ffad243d562ad9f3da5ec8bfdb6ec948719f1
Opcode Fuzzy Hash: f1756db53465c883b7b81199deeb61188d3ae09f91e078a5a4cf0558defa9243
Instruction Fuzzy Hash: 91218C3AA18A4183D710EF52F894029A3B4FB88FB9F544531DE8D53729CF7CD8998B64

Function 00007FF7C41B3590 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7C41B29A3), ref: 00007FF7C41B3638
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7C41B29A3), ref: 00007FF7C41B367A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7C41B29A3), ref: 00007FF7C41B371F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7C41B29A3), ref: 00007FF7C41B3732
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B3C17

Strings

Failed to encode DOH packet [%d], xrefs: 00007FF7C41B3771
%s?dns=%s, xrefs: 00007FF7C41B3708

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$memmovestrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 3074239552-3030351490
Opcode ID: 2c03bc1997f523299094536f4990a63d2eefedde17de69325f5e9b2f03302375
Instruction ID: 150fb499ef54ad1a8a52400458b64ab5c0c968020062ce6fad216298a931ca6e
Opcode Fuzzy Hash: 2c03bc1997f523299094536f4990a63d2eefedde17de69325f5e9b2f03302375
Instruction Fuzzy Hash: AC02C4D1B08BC747F711AEA3B8D43B9A795AB45FACF800031DE8C87786DE68D8548360

Function 00007FF7C41868E0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 165fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186A30
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186A4B
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186B85
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186BA0

Strings

..., xrefs: 00007FF7C4186AF2
..., xrefs: 00007FF7C4186B08

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: 3bd78302e365f6a0ea1b40fef920c6215afb3068ea0a8d95755b19bfad6d37f0
Instruction ID: 09df3a3af88afd61cfcdb835df1c9182c0516c1b8411b02592187494146da3a6
Opcode Fuzzy Hash: 3bd78302e365f6a0ea1b40fef920c6215afb3068ea0a8d95755b19bfad6d37f0
Instruction Fuzzy Hash: 1371E122A0CA8586EB64EF22F4843F9A791FB84FACF844131DAAD07690CF3DE155C751

Function 00007FF7C41B951A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9823
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B989E

Strings

TRUE, xrefs: 00007FF7C41B97FD
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C41B9641
GMT, xrefs: 00007FF7C41B95CE

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: eb731feedfcf1da49ec39010d8bc7e3870902d5d8f54c959c1332a6d56668022
Instruction ID: 3c52f704c82644b20d01599037585fa8c9982aa7efa898e89d583b65ecc94dc1
Opcode Fuzzy Hash: eb731feedfcf1da49ec39010d8bc7e3870902d5d8f54c959c1332a6d56668022
Instruction Fuzzy Hash: 7061E6A1E5C69647FB119F26B584279EFA5AB01FA8FC48032CACD42A94CF3CD543C720

Function 00007FF7C417A19C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A1A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A391

Strings

Replaced, xrefs: 00007FF7C417A621
Added, xrefs: 00007FF7C417A62D
FALSE, xrefs: 00007FF7C417A36B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C417A637

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: c3249e628972fe1041a8df1911c7a8da5d181588550de72b267bf2518eea5214
Instruction ID: b3c85d4ed58035e55e07100de39f0560b1706f07d64ffab8bd558da481dd75ac
Opcode Fuzzy Hash: c3249e628972fe1041a8df1911c7a8da5d181588550de72b267bf2518eea5214
Instruction Fuzzy Hash: 2E61216290968247EA71AF16F5D4379A7D4BF45BE8F880136DECE42691DF2CE8848320

Function 00007FF7C41A02F0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A033A
memmove.VCRUNTIME140 ref: 00007FF7C41A0451
memmove.VCRUNTIME140 ref: 00007FF7C41A04C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A04EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A0500

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7C41A0350

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freememmove$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 531908557-1446904845
Opcode ID: a6abf8f3d2351e1634614ce9c4225a0237ff731a281200c3553a691033f992f8
Instruction ID: 80d013c7187ce2139b9675a6734f698766406ce191e306fc10d7196d71073045
Opcode Fuzzy Hash: a6abf8f3d2351e1634614ce9c4225a0237ff731a281200c3553a691033f992f8
Instruction Fuzzy Hash: 26518D66A187818BE6259F66F5806AABBA0FB09BA8F840135DF8D07751DF3CE154C720

Function 00007FF7C41A3200 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7C41A33A6

Part of subcall function 00007FF7C41BA3F0: memmove.VCRUNTIME140 ref: 00007FF7C41BA498
Part of subcall function 00007FF7C41BA3F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BA4A9

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7C41A33B4
*, xrefs: 00007FF7C41A3374
FTP response timeout, xrefs: 00007FF7C41A3413
QUOT string not accepted: %s, xrefs: 00007FF7C41A33CF
We got a 421 - timeout!, xrefs: 00007FF7C41A33E5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastfreememmove
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1540152464-2335292235
Opcode ID: 19f1072efc5d263bb8d49e0bea5ecca88e78c60b981eac4cb62ed558518ac789
Instruction ID: a50888e70078e4e6059f50d45b3cdb02aaead87e4caa212202b7d19a5339cc0f
Opcode Fuzzy Hash: 19f1072efc5d263bb8d49e0bea5ecca88e78c60b981eac4cb62ed558518ac789
Instruction Fuzzy Hash: E7519522A0C6C687FB64BE17AA843B99391EF45FACF844135DD8D876C1EF2CE4458320

Function 00007FF7C415D150 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C415FE7A), ref: 00007FF7C415D192
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7C415FE7A), ref: 00007FF7C415D1AB

Part of subcall function 00007FF7C41BF450: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C41BF460

Part of subcall function 00007FF7C41599F0: memmove.VCRUNTIME140 ref: 00007FF7C4159A28

Part of subcall function 00007FF7C415B4B0: memset.VCRUNTIME140 ref: 00007FF7C415B50E
Part of subcall function 00007FF7C415B4B0: VirtualAlloc.KERNEL32 ref: 00007FF7C415B5C1
Part of subcall function 00007FF7C415B4B0: VirtualFree.KERNEL32 ref: 00007FF7C415B5F8

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415D281

Strings

NtAddAtom, xrefs: 00007FF7C415D1A1, 00007FF7C415D220
ntdll.dll, xrefs: 00007FF7C415D18B
EtwB, xrefs: 00007FF7C415D305

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Virtual$AcquireAddressAllocExclusiveFreeHandleLockModuleProc_invalid_parameter_noinfo_noreturnmemmovememset
String ID: EtwB$NtAddAtom$ntdll.dll
API String ID: 3436220888-110230545
Opcode ID: 1ab1ccd4d0d69a446b641fadbc565db57db18c3ac7868d880cfa33c290467ac0
Instruction ID: 46154ddad9838a570d58c36cb5c3296c99c28d4067429ebed5d84319916e2b23
Opcode Fuzzy Hash: 1ab1ccd4d0d69a446b641fadbc565db57db18c3ac7868d880cfa33c290467ac0
Instruction Fuzzy Hash: 665194A1A1CA8242FA50EF17B5C12B9E761AF85BB8F804132E9DC47795DF2DE541C720

Function 00007FF7C4194190 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C4194276
strchr.VCRUNTIME140 ref: 00007FF7C4194289
strchr.VCRUNTIME140 ref: 00007FF7C419429B

Strings

Expect, xrefs: 00007FF7C41941F7
Expect:, xrefs: 00007FF7C419421E
Expect: 100-continue, xrefs: 00007FF7C41942F8
100-continue, xrefs: 00007FF7C41942B6

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 047e40fe297b46cabe1ecddffda5fb322298e00397aef5b41865f27287172663
Instruction ID: 7af4404be22a9c24eeda6c9edb8d0c353876c9a79bd7d62d057bab26f9e7d17f
Opcode Fuzzy Hash: 047e40fe297b46cabe1ecddffda5fb322298e00397aef5b41865f27287172663
Instruction Fuzzy Hash: 1841DB21B0C69287EA14AF17B9C01B9E7A1FF55FACF885034DACD47786DE1CE5418724

Function 00007FF7C418C560 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C418C6AA

Strings

ioctl callback returned error %d, xrefs: 00007FF7C418C66F
Cannot rewind mime/post data, xrefs: 00007FF7C418C6E0
the ioctl callback returned %d, xrefs: 00007FF7C418C655
seek callback returned error %d, xrefs: 00007FF7C418C5FE
necessary data rewind wasn't possible, xrefs: 00007FF7C418C6B5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 39c1dd0ed6d769d3a27ecf688da1777881465d5c2c2e1b531ce13f2971bbdfeb
Instruction ID: d200e060966f18a68ec817a49cade8736ae9f2bdcac27f801a9c7d8a96dd1aff
Opcode Fuzzy Hash: 39c1dd0ed6d769d3a27ecf688da1777881465d5c2c2e1b531ce13f2971bbdfeb
Instruction Fuzzy Hash: D8418461F1464243EB54AF2BB8C43A95391EB85FACF992031DE5E4B389DF3DE4908721

Function 00007FF7C41B96AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B96E8
memmove.VCRUNTIME140 ref: 00007FF7C41B970D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9823
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B989E

Strings

TRUE, xrefs: 00007FF7C41B97FD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: isupper$freemallocmemmove
String ID: TRUE
API String ID: 3395529846-3412697401
Opcode ID: 6e2a312f7264301fc328b4bb0916dd13341e01a1834138ae3a22b8865ed1ffea
Instruction ID: 3b9b868e14108bf21bbbcd80f88be5ea829d3c109cb8fffb3b4883d10afb013d
Opcode Fuzzy Hash: 6e2a312f7264301fc328b4bb0916dd13341e01a1834138ae3a22b8865ed1ffea
Instruction Fuzzy Hash: 0231D291E1D69607FB12EF27A588338EB92AF11FB8F844631CDDD06AD5DE6C9442C720

Function 00007FF7C4159750 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QEAA@H@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C415977D
??Bid@locale@std@@QEAA_KXZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C4159797
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41597C9
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41597F4
std::_Facet_Register.LIBCPMT ref: 00007FF7C415980D
??1_Lockit@std@@QEAA@XZ.MSVCP140(?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C415982C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4159857

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Concurrency::cancel_current_taskFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 762505753-0
Opcode ID: dbd056e22e8ae923a9a04bdf3b6951bfb71e4ebb2be4ae5a6029800f8ece9bf7
Instruction ID: 0a98ecc4cdf4a7ec217daf6db1055ee1144626708a8af98bf547819504cba828
Opcode Fuzzy Hash: dbd056e22e8ae923a9a04bdf3b6951bfb71e4ebb2be4ae5a6029800f8ece9bf7
Instruction Fuzzy Hash: 96316126A18F4587EA24AF16F8901AAB360FB88FA8F880531DADD07765DF3CE545C710

Function 00007FF7C4186660 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C4186695
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41866C1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41866C9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C41866EB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7C41839DC), ref: 00007FF7C4186702

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF7C41866D4

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 99a8fc28fd41b36636c9351d92cb5898f0b195db1409375db5caa7ad086f6004
Instruction ID: 5bb96159ee777650f458f9c1d389e434a140ec6d68d8e77ea00c9bac20474cfe
Opcode Fuzzy Hash: 99a8fc28fd41b36636c9351d92cb5898f0b195db1409375db5caa7ad086f6004
Instruction Fuzzy Hash: 68115176A0868283EB10EF66F4D4178B3A0EF85F68F944031CA9D47694DE2CD884C721

Function 00007FF7C4186590 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865BA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865CE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865E2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C41865F6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418660A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C418661E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A,?,?,?,?,?,00007FF7C4176C88), ref: 00007FF7C4186632

Part of subcall function 00007FF7C41AE540: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C418664B,?,?,00000000,00007FF7C4182093,?,?,00000000,00007FF7C417F60A), ref: 00007FF7C41AE555

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: db116b48cdf21281288c452aa2df48d9d5f04e5da2147752e411edb5be9255b1
Instruction ID: 75c50d3a4effa7ee1697ada94f89c78b3040f0681d5c26c8bc9a647f6a163cf9
Opcode Fuzzy Hash: db116b48cdf21281288c452aa2df48d9d5f04e5da2147752e411edb5be9255b1
Instruction Fuzzy Hash: 1F11563A908F81C2D700DF62F9940E873A4EBC9FAAB580135DE8E4F655DF7490958624

Function 00007FF7C417B7D0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B7DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B7E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B7F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B7FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B805
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B80F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B819
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417B823

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b4c637166226f908ca7614a4df428112cb1f806a0a1b56943a648c2d882b5e45
Instruction ID: 18f77a641cdb1d3c6f32b930d0b574cccf8246553d4357b75d8ed313bd511181
Opcode Fuzzy Hash: b4c637166226f908ca7614a4df428112cb1f806a0a1b56943a648c2d882b5e45
Instruction Fuzzy Hash: 54F0E43EA1490183D714EFA2F8980286370EB8CF79B541031CD4E57225CE78D899C664

Function 00007FF7C4183140 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C41839BB), ref: 00007FF7C4183157
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C41839BB), ref: 00007FF7C4183188

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 5999482c936808d4642822292bc54379e319eca18679f5962f2758f0b61e2b10
Instruction ID: de9062f18d9c5a13b6dc06a5160d5c865e06d0f0009868c7a9d2b4f72f5c2b2f
Opcode Fuzzy Hash: 5999482c936808d4642822292bc54379e319eca18679f5962f2758f0b61e2b10
Instruction Fuzzy Hash: A6918D26609BC18AE7559F39A4803AD77A0FB55B28F4C0235CFAC0B3D6DF2991A4C731

Function 00007FF7C415A740 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C415A785
GetTempPathW.KERNEL32 ref: 00007FF7C415A793
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415A850
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415A8F7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415A93D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415A994

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$PathTempmemset
String ID:
API String ID: 4077062065-0
Opcode ID: fb75f9253393b173646aa1ac5d3690752823f4b179ca8e42eb084277ce8a0629
Instruction ID: 24e965435edfe7a7436a162515710da0a5018f1ffa0cc803c764bd70f5eafd80
Opcode Fuzzy Hash: fb75f9253393b173646aa1ac5d3690752823f4b179ca8e42eb084277ce8a0629
Instruction Fuzzy Hash: C161A761F54A5196EA10AF6AF4843EDA361EB44BF8F901231DEAD13AD4DF7CD445C310

Function 00007FF7C4191910 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41919A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41919B1
memmove.VCRUNTIME140 ref: 00007FF7C41919CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191B2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4191B35

Strings

1.1, xrefs: 00007FF7C419191F

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$memmove
String ID: 1.1
API String ID: 1534225298-2150719395
Opcode ID: fe1da9542f221b18c3303a5c35e50988aa1c1793b399c35cbb7a46c5c388fc77
Instruction ID: f8dba19fc61b7983e2b9f8221b5a0054493783ed385a457a30e477b69e55c043
Opcode Fuzzy Hash: fe1da9542f221b18c3303a5c35e50988aa1c1793b399c35cbb7a46c5c388fc77
Instruction Fuzzy Hash: B4518C76608A8587E6649F22F9803AAA3A1FB58FA8F844035DE9E47754DF3CE0958310

Function 00007FF7C41B72CC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B730F
memmove.VCRUNTIME140 ref: 00007FF7C41B7335
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7408
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7479

Strings

Start Date, xrefs: 00007FF7C41B744D
Start Date: %s, xrefs: 00007FF7C41B7467

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$mallocmemmove
String ID: Start Date: %s$Start Date
API String ID: 1934541353-2389359183
Opcode ID: c9e2efa5dfa6a7b53bbc7187c49897ec94178b335a5635ea864843e6ceffa653
Instruction ID: 2c7453baf78cfd72a7824e7752a9848863da6240433d7da8e191494b86c0dce4
Opcode Fuzzy Hash: c9e2efa5dfa6a7b53bbc7187c49897ec94178b335a5635ea864843e6ceffa653
Instruction Fuzzy Hash: A2413B91E087D207EB19AE17A194278AB52EB05FBCF885235CDAF07BD1DD2CE0458331

Function 00007FF7C4159860 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C4159950
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C415995E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C4159997
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41599A1
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C415D0DE), ref: 00007FF7C41599AF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C41599E0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 36962e6e1c41f84e7d09a4a5b41cda3f9730425a30b6e7c9463c23d70f400235
Instruction ID: 8b9139201005762b45ac4e1d4488b86aece70d185fc1d6bf2354143e238be50b
Opcode Fuzzy Hash: 36962e6e1c41f84e7d09a4a5b41cda3f9730425a30b6e7c9463c23d70f400235
Instruction Fuzzy Hash: C241D462B19B4647EE20AF1BB5843ADE751AB44FE8F840635DEED0B785DE3CE1418311

Function 00007FF7C41896D0 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL ref: 00007FF7C41897B5
VerSetConditionMask.NTDLL ref: 00007FF7C41897C4
VerSetConditionMask.NTDLL ref: 00007FF7C41897D6
VerSetConditionMask.NTDLL ref: 00007FF7C41897E8
VerSetConditionMask.NTDLL ref: 00007FF7C41897FE
VerifyVersionInfoA.KERNEL32 ref: 00007FF7C4189811

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 8ca0b634b30a5c5383ff0c27130a537037aac35180e346ccc1c7c4174451451e
Instruction ID: c910fc66b338ac6d92b6a226fd0e3c0229fa9805652fe4edf77b00b0bed85821
Opcode Fuzzy Hash: 8ca0b634b30a5c5383ff0c27130a537037aac35180e346ccc1c7c4174451451e
Instruction Fuzzy Hash: 2241A432E2C68287F630AF12B4647BAF390EBD5B18F955235E9C903A54DE3DE4819F10

Function 00007FF7C41B77FF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 78424f098365d97856e1e1c738fb7f8dca34e9c6a9bfeb47b1ae303c81492500
Instruction ID: ae01f9df9e06af9244bfcd7a52d65272ab294412d89eda118142427dfba46775
Opcode Fuzzy Hash: 78424f098365d97856e1e1c738fb7f8dca34e9c6a9bfeb47b1ae303c81492500
Instruction Fuzzy Hash: EC4183A6F0878246EB11AF66A4841F8A7A1BB05FECF884535CE9D07785DF3CD544C321

Function 00007FF7C41B2190 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B21D6
strchr.VCRUNTIME140(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B21E6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7C41B174F), ref: 00007FF7C41B2210
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B2245
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B226A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B228C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 09fcb98d92bfef1b38a307838263e2e2f9408317be4124244ab103acd07d7bcc
Instruction ID: 576443f1438904739000933b452ba7140e7bfcb89f91393b148138bd4c4ebcba
Opcode Fuzzy Hash: 09fcb98d92bfef1b38a307838263e2e2f9408317be4124244ab103acd07d7bcc
Instruction Fuzzy Hash: 5331A321A09B418BEA15EF53B994239A7A0BF59FA8F884634DEDE43795DF3CE0448710

Function 00007FF7C41BD740 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BD7E9
memmove.VCRUNTIME140 ref: 00007FF7C41BD805
memmove.VCRUNTIME140 ref: 00007FF7C41BD81C
memmove.VCRUNTIME140 ref: 00007FF7C41BD837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BD86A

Strings

PLAIN, xrefs: 00007FF7C41BD74B

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memmove$freemalloc
String ID: PLAIN
API String ID: 1763039611-4000620671
Opcode ID: b10b9066c4d3f1c7e6c0a2835e675c916a0bc63785c293c3333b8396dbac5d3c
Instruction ID: 2f2ca68bfa9d81614b3296cbee84a92eafc900ab65605de35dcb581a5b149405
Opcode Fuzzy Hash: b10b9066c4d3f1c7e6c0a2835e675c916a0bc63785c293c3333b8396dbac5d3c
Instruction Fuzzy Hash: F031B2A6A18B8187EB149F56F4802AAA790FB45FECF858231DEDD07795DE3CD045C320

Function 00007FF7C41B7575 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 68be9139d06aed788b7f01af6084bcb7c55820e106f79e821250ab345ea006c6
Instruction ID: 929f6eba3b5d8a41ca64582fd4b99fe9d98fa36eac2f9527ecfb9fed12988a82
Opcode Fuzzy Hash: 68be9139d06aed788b7f01af6084bcb7c55820e106f79e821250ab345ea006c6
Instruction Fuzzy Hash: A6318FA5E0978246EB11BF66A4841F9A7A1BF05FECFC81435CE8E0B346DE3CE5048321

Function 00007FF7C41B75C6 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41B86F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B873C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Part of subcall function 00007FF7C4181260: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41812B2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 8acd2b2183489202ced536d79ab0b39d779f81e066b6cb87f589aac4f3a7f05d
Instruction ID: 9b2e75eab58546a6754a5e441bc744f1f540f204388c33b867a691e00b050b0b
Opcode Fuzzy Hash: 8acd2b2183489202ced536d79ab0b39d779f81e066b6cb87f589aac4f3a7f05d
Instruction Fuzzy Hash: D83151A5E0978246EB11AF66A4841F9A7A1BB05FACFC81435CE8D1B756DF3CE5048321

Function 00007FF7C41B7593 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41BA200: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BA235

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B79E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7AB2

Part of subcall function 00007FF7C4181260: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41812B2

Strings

Expire Date, xrefs: 00007FF7C41B79BD
Public Key Algorithm, xrefs: 00007FF7C41B7A68
Public Key Algorithm: %s, xrefs: 00007FF7C41B7A82
Expire Date: %s, xrefs: 00007FF7C41B79D7

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 828263107c973a52bd7dc1c32e44adbc0a9479c1194506ede1e812c1e885db99
Instruction ID: 8a9d0e99b06a401c579f0ad578ec455abd074cb9cabfd039ebd1dd6959c62bf4
Opcode Fuzzy Hash: 828263107c973a52bd7dc1c32e44adbc0a9479c1194506ede1e812c1e885db99
Instruction Fuzzy Hash: 3E315FA5A09B8246EB11AF66A4841F9A7A1BB05FECFC81435CE8D1B756DE3CE5048321

Function 00007FF7C417A2C8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41979A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41979C1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A391

Strings

Replaced, xrefs: 00007FF7C417A621
Added, xrefs: 00007FF7C417A62D
FALSE, xrefs: 00007FF7C417A36B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C417A637

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: 105b8874935812e2aff1cd21f97673062ff850a84840f16d0ed545420a55c15b
Instruction ID: 4531091c09a754e184f125e5c94c9e8d4745a86638b6d34ac6ec1ca61951a96f
Opcode Fuzzy Hash: 105b8874935812e2aff1cd21f97673062ff850a84840f16d0ed545420a55c15b
Instruction Fuzzy Hash: 6761436290868247FA71AF16F5D4379A7D4BF44BA8F880136DECE42691DF2CE8848320

Function 00007FF7C417A1BD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41978F0: strchr.VCRUNTIME140 ref: 00007FF7C4197926

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C417A391

Strings

Replaced, xrefs: 00007FF7C417A621
Added, xrefs: 00007FF7C417A62D
FALSE, xrefs: 00007FF7C417A36B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7C417A637

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: b9e8fbb2191dc8f3b6de4991fbc3a798a1b13c12353468e4b7ca3de1991f83f3
Instruction ID: 0df6ec7410dabc232c0a4df1cb941223df907358533748379dc665c734da4a6a
Opcode Fuzzy Hash: b9e8fbb2191dc8f3b6de4991fbc3a798a1b13c12353468e4b7ca3de1991f83f3
Instruction Fuzzy Hash: 5461326290868247FA71AF16F5D4379A7D4BF45BE8F890136DECE42691DF2CE8848320

Function 00007FF7C41625F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,00000000,?,0000006E00000006,krnigger,?,00007FF7C4168561,?,?,?,?,00000000,00000004,?,00007FF7C416E634), ref: 00007FF7C41626EB
memmove.VCRUNTIME140(?,?,00000000,?,0000006E00000006,krnigger,?,00007FF7C4168561,?,?,?,?,00000000,00000004,?,00007FF7C416E634), ref: 00007FF7C416271C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,0000006E00000006,krnigger,?,00007FF7C4168561,?,?,?,?,00000000,00000004,?,00007FF7C416E634), ref: 00007FF7C4162788

Part of subcall function 00007FF7C41BF110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF7C4159D11), ref: 00007FF7C41BF12A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C416278F

Strings

krnigger, xrefs: 00007FF7C41625FB

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemmovememset
String ID: krnigger
API String ID: 2090792099-2019574909
Opcode ID: f56364c33ee02cda50da5278a082771777d7f33f475fb778417025f208343d38
Instruction ID: 57bbd919cacca01507e6413609ce9df894606715f84788dc3453d48eb3efb950
Opcode Fuzzy Hash: f56364c33ee02cda50da5278a082771777d7f33f475fb778417025f208343d38
Instruction Fuzzy Hash: EF418E62A05A8296DA20EF66F4846FAB361FB44FB8F948635DEAD076C4DF3CD0418310

Function 00007FF7C415D550 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF7C415BC0D), ref: 00007FF7C415D593
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,00007FF7C415BC0D), ref: 00007FF7C415D5AC

Part of subcall function 00007FF7C41BF450: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C41BF460

Part of subcall function 00007FF7C41599F0: memmove.VCRUNTIME140 ref: 00007FF7C4159A28

Part of subcall function 00007FF7C415B4B0: memset.VCRUNTIME140 ref: 00007FF7C415B50E
Part of subcall function 00007FF7C415B4B0: VirtualAlloc.KERNEL32 ref: 00007FF7C415B5C1
Part of subcall function 00007FF7C415B4B0: VirtualFree.KERNEL32 ref: 00007FF7C415B5F8

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C415D682

Strings

NtAddAtom, xrefs: 00007FF7C415D5A2, 00007FF7C415D621
ntdll.dll, xrefs: 00007FF7C415D58C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Virtual$AcquireAddressAllocExclusiveFreeHandleLockModuleProc_invalid_parameter_noinfo_noreturnmemmovememset
String ID: NtAddAtom$ntdll.dll
API String ID: 3436220888-2104360511
Opcode ID: c76f0293900980a49d6f95ae73909f0695d0476e80c07e642a3f51c5fd6532c6
Instruction ID: 5a6ea0240abbe9ae1c4503a84401a1cf1364f3d50952c99a3535bb505f35b027
Opcode Fuzzy Hash: c76f0293900980a49d6f95ae73909f0695d0476e80c07e642a3f51c5fd6532c6
Instruction Fuzzy Hash: EB51B1A1A1CA8246EA11FF1BB4C02B9E761AF95BFCF844132E9DC07695DF2DE445C720

Function 00007FF7C41601C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C415FFAF), ref: 00007FF7C41601FF
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C415FFAF), ref: 00007FF7C4160218

Part of subcall function 00007FF7C41BF450: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C41BF460

Part of subcall function 00007FF7C41599F0: memmove.VCRUNTIME140 ref: 00007FF7C4159A28

Part of subcall function 00007FF7C415B4B0: memset.VCRUNTIME140 ref: 00007FF7C415B50E
Part of subcall function 00007FF7C415B4B0: VirtualAlloc.KERNEL32 ref: 00007FF7C415B5C1
Part of subcall function 00007FF7C415B4B0: VirtualFree.KERNEL32 ref: 00007FF7C415B5F8

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41602EE

Strings

NtAddAtom, xrefs: 00007FF7C416020E, 00007FF7C416028D
ntdll.dll, xrefs: 00007FF7C41601F8

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Virtual$AcquireAddressAllocExclusiveFreeHandleLockModuleProc_invalid_parameter_noinfo_noreturnmemmovememset
String ID: NtAddAtom$ntdll.dll
API String ID: 3436220888-2104360511
Opcode ID: d2b859f1e009a814df8432da27535a0239d1d34c25f15a97c323365082d91dcb
Instruction ID: 5a3d6240100d4c0b8983b8f143374acf212be0db07a9ab7b4a8fb796062dcaba
Opcode Fuzzy Hash: d2b859f1e009a814df8432da27535a0239d1d34c25f15a97c323365082d91dcb
Instruction Fuzzy Hash: 6451D7A1E0CA825BEA21FF17B5802B9E761EF55BB9F844131DADC03695DF2CD441C720

Function 00007FF7C41AF5B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AF628
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AF65A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AF6CA

Part of subcall function 00007FF7C4197B00: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7C417B94A,?,?,?,?,?,?,?,00007FF7C417B717), ref: 00007FF7C4197B11

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AF745

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF7C41AF61E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: fb9cf86e1d87f337f74305104d8a96855daf963f4c08b9f5edbbbbd47057ea34
Instruction ID: d0696925232ce1ed237fa1107097a1c00260d98fab32c3c8fe6509e758239f02
Opcode Fuzzy Hash: fb9cf86e1d87f337f74305104d8a96855daf963f4c08b9f5edbbbbd47057ea34
Instruction Fuzzy Hash: B641C327A0CAC647EF21AF66A8843B9A791EB05F68F880131CACD47681DF2CE445C731

Function 00007FF7C418F150 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418F1BA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C418F22B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7C418F28B

Strings

:%u, xrefs: 00007FF7C418F1CE, 00007FF7C418F234
Hostname in DNS cache was stale, zapped, xrefs: 00007FF7C418F2B2

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 30f4b286e65abd6d7fc31f5b4629415f953def889318dab476ccff86c46fa3a7
Instruction ID: a8e396d4fd871eb8e7fef34aacb035fa55021831ea09949b5b37e68d4498bd1a
Opcode Fuzzy Hash: 30f4b286e65abd6d7fc31f5b4629415f953def889318dab476ccff86c46fa3a7
Instruction Fuzzy Hash: 6341B66261868686EA20EF12F4807B9A751FB84FACF854232DE8D477D5DF3CE505C721

Function 00007FF7C41B4220 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41B4180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41A6
Part of subcall function 00007FF7C41B4180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41C7
Part of subcall function 00007FF7C41B4180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41E2
Part of subcall function 00007FF7C41B4180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41F0
Part of subcall function 00007FF7C41B4180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B4202

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B42A6

Strings

HTTP, xrefs: 00007FF7C41B422A
NTLM, xrefs: 00007FF7C41B425E, 00007FF7C41B4310

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 7eecec4a21eeec18d08a19482d5dda511772f5599cc2e22536078b012c814ca1
Instruction ID: f2b0c812a7128db878295f529dac4e848f6c45ebfc05c61ada6a280b78fa66ce
Opcode Fuzzy Hash: 7eecec4a21eeec18d08a19482d5dda511772f5599cc2e22536078b012c814ca1
Instruction Fuzzy Hash: F8613976609B8187EB609F16F48066AB3A4FB88B98F948035DECD43B58DF3CD454CB50

Function 00007FF7C418B8D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C418B978
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418B9F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C418BAA2

Strings

allocate connect buffer!, xrefs: 00007FF7C418BA1F
CONNECT phase completed!, xrefs: 00007FF7C418BAE3

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 7292c7f4589929211f525f3208713e384cd27a7c535d5f5684635d08606b8b1a
Instruction ID: b798e26b15957cb5384336e920f89612e8d8f27f5bba0fad681664dcc7f465fe
Opcode Fuzzy Hash: 7292c7f4589929211f525f3208713e384cd27a7c535d5f5684635d08606b8b1a
Instruction Fuzzy Hash: 7551A372A08A8287E724AF26E5C43B9B790FB84F9CF854035DB9C07281DF79E665C315

Function 00007FF7C41B7143 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7479

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7C41B7271
GMT, xrefs: 00007FF7C41B71FE
Start Date, xrefs: 00007FF7C41B744D
Start Date: %s, xrefs: 00007FF7C41B7467

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: db19e39b6feace25649166895e1a5d98f0f31a4d6086190d6751805879c37284
Instruction ID: 94e7760ffbc12a65ff9f0212f16afd9a87054a5a8c3ef8f94bbfa191ea489f56
Opcode Fuzzy Hash: db19e39b6feace25649166895e1a5d98f0f31a4d6086190d6751805879c37284
Instruction Fuzzy Hash: AD5190A1E086D246EB21AF16B9841B8EBA5FB01FA8FC45432DEDD06B54DF3CE545C320

Function 00007FF7C415A150 Relevance: 7.6, APIs: 5, Instructions: 118COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z.MSVCP140 ref: 00007FF7C415A1A9
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF7C415A1DE
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF7C415A21B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ.MSVCP140 ref: 00007FF7C415A284
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7C415A2BD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sbumpc@?$basic_streambuf@?setstate@?$basic_ios@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1457788575-0
Opcode ID: fbe773d02921a54d09308367aba1710b4ea42d966e3e6d7e70aa3d3d1990f801
Instruction ID: 96a00480080c8969812e4a6a99d6add67bc5af6801d4eef81799f179d7cca68a
Opcode Fuzzy Hash: fbe773d02921a54d09308367aba1710b4ea42d966e3e6d7e70aa3d3d1990f801
Instruction Fuzzy Hash: 69414122708A8182DB20DF1BF4D0569A7E0FB99FA9B558631DE9E47B64CF3ED442D310

Function 00007FF7C41B72D4 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B730F
memmove.VCRUNTIME140 ref: 00007FF7C41B7335
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B7479

Strings

Start Date, xrefs: 00007FF7C41B744D
Start Date: %s, xrefs: 00007FF7C41B7467

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freemallocmemmove
String ID: Start Date: %s$Start Date
API String ID: 2537350866-2389359183
Opcode ID: 85f6d2e1423dc2ff000ca6c9c36f9adea0ad985e0a8a1a9b54e280fe8467a956
Instruction ID: 6e7765927069f05499ebffd13c352689f49ec084fe2ea959273601cd91af0a01
Opcode Fuzzy Hash: 85f6d2e1423dc2ff000ca6c9c36f9adea0ad985e0a8a1a9b54e280fe8467a956
Instruction Fuzzy Hash: 1921C7A5F0878207EF16AF17B5841B89A62AF05FFCF885531CD9E07AD1DE3CA5458321

Function 00007FF7C4160720 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,0000006E00000006,krnigger,?,?,?,00007FF7C416CD48), ref: 00007FF7C41607EC
memcmp.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,0000006E00000006,krnigger,?,?,?,00007FF7C416CD48), ref: 00007FF7C4160863
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,00000000,0000006E00000006), ref: 00007FF7C4160949

Strings

krnigger, xrefs: 00007FF7C4160728

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memcmp$_invalid_parameter_noinfo_noreturn
String ID: krnigger
API String ID: 722167722-2019574909
Opcode ID: 8347b73323c924c5f366444d99d874456e5fe1c44e35bd20c2cedbd8beb7ed96
Instruction ID: fdd20d64617586b386bfd0a6b122ed5d97c5e62a5957b2ee533d75a73018b7ed
Opcode Fuzzy Hash: 8347b73323c924c5f366444d99d874456e5fe1c44e35bd20c2cedbd8beb7ed96
Instruction Fuzzy Hash: 5771BF62E146519AF700DF66E8802EC6B75FB04BBCF944225DE9C27AC5DF78D482C350

Function 00007FF7C415F530 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C415F689

Part of subcall function 00007FF7C41BF110: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00007FF7C4159D11), ref: 00007FF7C41BF12A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00000000,?,00007FF7C415EC85), ref: 00007FF7C415F5D9

Strings

gfffffff, xrefs: 00007FF7C415F56B
gfffffff, xrefs: 00007FF7C415E78D

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: gfffffff$gfffffff
API String ID: 1934640635-161084747
Opcode ID: c14b87df5a70e15060f047ebb869f1e06dce841c9a6559346a0da078351c4470
Instruction ID: e3e3a8ea28b10978f5554a36b3f590aa1e1f3b1ec1c30227cd84bf7782734a6c
Opcode Fuzzy Hash: c14b87df5a70e15060f047ebb869f1e06dce841c9a6559346a0da078351c4470
Instruction Fuzzy Hash: 5751D472A15F4582EE14EF2BF4802A9A3A5EB48FD8F984531DA9D87794DF3CD0918311

Function 00007FF7C41A27E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41BA3F0: memmove.VCRUNTIME140 ref: 00007FF7C41BA498
Part of subcall function 00007FF7C41BA3F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BA4A9

WSAGetLastError.WS2_32 ref: 00007FF7C41A294A

Strings

FTP response aborted due to select/poll error: %d, xrefs: 00007FF7C41A2958
FTP response timeout, xrefs: 00007FF7C41A2997
We got a 421 - timeout!, xrefs: 00007FF7C41A296E

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ErrorLastfreememmove
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1540152464-2064316097
Opcode ID: 9f066cd5a5b1acf09b4620f26a2488e4271ed0b3a035cd256a71543fcbb835d8
Instruction ID: d621e23a9dc06abaf30784f78dfee873a3b6d5739b44f66a7a604fc048b6847d
Opcode Fuzzy Hash: 9f066cd5a5b1acf09b4620f26a2488e4271ed0b3a035cd256a71543fcbb835d8
Instruction Fuzzy Hash: 69416323A0869286F760EF27B8807B9A390BB49FA8F844135DEDD87795EE3CD445C711

Function 00007FF7C41B98E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B990B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B9DAF

Strings

TRUE, xrefs: 00007FF7C41B9DB9
FALSE, xrefs: 00007FF7C41B9900

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: e05dcd7b6ee22e2502415310ff091b308b5b7c404dc86d87d5d917bf74894835
Instruction ID: d1c43fbf4759c008880409e324a805ae06ac0877af9d6dd30b520b248acd797b
Opcode Fuzzy Hash: e05dcd7b6ee22e2502415310ff091b308b5b7c404dc86d87d5d917bf74894835
Instruction Fuzzy Hash: 464107E6F1965546FF519E97B4C4278B791AF45FB8F884572DECD0A3C1DE2CA0428220

Function 00007FF7C41B965F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9823
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41B9837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41B989E

Strings

TRUE, xrefs: 00007FF7C41B97FD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: e3c3392a004ef3c09e48db3281f402f3f095738fd1941a37f1990b669eff5ad2
Instruction ID: a325d2e51329326f60e6f1697c2af4c21e3eaaf0d9a49cf7338498725dd4970f
Opcode Fuzzy Hash: e3c3392a004ef3c09e48db3281f402f3f095738fd1941a37f1990b669eff5ad2
Instruction Fuzzy Hash: 1B31E462E1C59646FB12DF26A484378AFA1AB01FBCF884631CEDD46A95CF6CD146C720

Function 00007FF7C41A25C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF7C41A2612
accept.WS2_32 ref: 00007FF7C41A2631

Part of subcall function 00007FF7C4194E90: ioctlsocket.WS2_32 ref: 00007FF7C4194EA9

Strings

Error accept()ing server connect, xrefs: 00007FF7C41A264E
Connection accepted from server, xrefs: 00007FF7C41A265F

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: 7ff70f4ad8d2cd13633b03cbabb969c1d54f0ebfa78f648ca0eb761ec235ebd7
Instruction ID: 9f187f131764214b39413440e3e0f260706b110ed7e552233859063d0f96a3f6
Opcode Fuzzy Hash: 7ff70f4ad8d2cd13633b03cbabb969c1d54f0ebfa78f648ca0eb761ec235ebd7
Instruction Fuzzy Hash: B131782160968183E764AF22B4847A9A391FB48FB8F844231DEAD477C5DF7DE5458710

Function 00007FF7C41738E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4173972
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417398E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41739AB

Strings

:, xrefs: 00007FF7C4173966

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: de8b1d35f95f0cf425a30a2b9d9c8609923abfb74013c565a682ec7367b0af30
Instruction ID: 4f2e1f027b76551be04f6be03c027e81e9f4eabaf240284bf9b5b531c534d314
Opcode Fuzzy Hash: de8b1d35f95f0cf425a30a2b9d9c8609923abfb74013c565a682ec7367b0af30
Instruction Fuzzy Hash: 16214125709B8686EB519F16F5803A9B3A0BB84FB8F884135CBDD43785DF3CD9548720

Function 00007FF7C4192290 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7C41922F4
strchr.VCRUNTIME140 ref: 00007FF7C4192307
strchr.VCRUNTIME140 ref: 00007FF7C4192319
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C419234B
memmove.VCRUNTIME140 ref: 00007FF7C4192375

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strchr$mallocmemmove
String ID:
API String ID: 2308450275-0
Opcode ID: afb24b68f66daa9267dce40b0e74ef577e67ab3330023623cd14dc50a4cc86de
Instruction ID: 3de46aefde6a3f38c65543ae53bdc21621de83e0f44523d21dc0136ed4063683
Opcode Fuzzy Hash: afb24b68f66daa9267dce40b0e74ef577e67ab3330023623cd14dc50a4cc86de
Instruction Fuzzy Hash: 5C21071160D68103EE59AF137A902B8E7D29F59FE8F8C4430DECD07786DE2CE5068220

Function 00007FF7C41917A0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4191BB5), ref: 00007FF7C41917D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4191BB5), ref: 00007FF7C41917E1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4191BB5), ref: 00007FF7C419185A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4191BB5), ref: 00007FF7C419186B
memmove.VCRUNTIME140(?,?,00000000,00007FF7C4191BB5), ref: 00007FF7C4191894

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$mallocmemmove
String ID:
API String ID: 1934541353-0
Opcode ID: de031bcac70b0d8b79bde074c503ca9352c94363f97c0062c1d75282567ec92b
Instruction ID: a48c441f5d791771d379da891debb5b6df8c7dc605d42b8efaf4638a8ce890a2
Opcode Fuzzy Hash: de031bcac70b0d8b79bde074c503ca9352c94363f97c0062c1d75282567ec92b
Instruction Fuzzy Hash: 77316E26A08B4583FB14AF12F984269A391EB19FF8F844231DEAD077D5DF3CD4818310

Function 00007FF7C41B4180 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41A6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41E2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B41F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B0C15,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B4202

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c55b47ff98ff71b8dcfe126950ecd9cf07a01c38d5f978087ac166fe28a85fa8
Instruction ID: 1ea683c52efcb50f12242908279af24180270438a54a8f6e85dd64972fc1828b
Opcode Fuzzy Hash: c55b47ff98ff71b8dcfe126950ecd9cf07a01c38d5f978087ac166fe28a85fa8
Instruction Fuzzy Hash: A911833AA04B4183DB04EF66E99412CB3A4FB88FA87444125CE8E47769CF38D895C764

Function 00007FF7C415E210 Relevance: 6.2, APIs: 4, Instructions: 209COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C415E393
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C415E4EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C415E4F6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7C415E4FD

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memmove
String ID:
API String ID: 15630516-0
Opcode ID: 478693d68ef957c57a478e87678d86ac095535cdf851ebd2e1e7c7afe5b06665
Instruction ID: 58fb2a6b93d0b1d273d57aad068a4e271eddb16f61b0fe2e0cd7345fafe3f7bd
Opcode Fuzzy Hash: 478693d68ef957c57a478e87678d86ac095535cdf851ebd2e1e7c7afe5b06665
Instruction Fuzzy Hash: 2F918262F18B418BEB00EFAAE4843ED7362AB44BACF404635DEAD17685DF389455C350

Function 00007FF7C414B120 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7C414B15E

Strings

SUBSCRIBE, xrefs: 00007FF7C414B2BA
cmd, xrefs: 00007FF7C414B248
evt, xrefs: 00007FF7C414B32C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: memset
String ID: SUBSCRIBE$cmd$evt
API String ID: 2221118986-2026259723
Opcode ID: 041c07be9038c6e4c0dc93aa56f2911c09a7b2b48fe85634d9032a5c2ff79ff7
Instruction ID: 00aa15fda8ff7b98a51a06ebbdb45033dd6777a8b2c5a35dd62ccd1ce26a0fe7
Opcode Fuzzy Hash: 041c07be9038c6e4c0dc93aa56f2911c09a7b2b48fe85634d9032a5c2ff79ff7
Instruction Fuzzy Hash: C891B063608A8086EB159F1AE0C02ADFB71F790F98F945522EBCE07699DF7CE940C710

Function 00007FF7C41672E0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4167331
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C4167395
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7C41673F5
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7C416741C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID:
API String ID: 1346393832-0
Opcode ID: 459bc56baa2307dabe0566609e61d8a9bcd0a7c11ae33fb80533a5eb964d6e75
Instruction ID: a43cade5d60e92c30c7e95ab08ffe5c28177b387af4d1070694b8c5c0c8846fc
Opcode Fuzzy Hash: 459bc56baa2307dabe0566609e61d8a9bcd0a7c11ae33fb80533a5eb964d6e75
Instruction Fuzzy Hash: 3E31A572B16A4596EF149F7AF9943BCA2A1EB08FACF944531CAAC46685DF2CC4908310

Function 00007FF7C41588F0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bc0a16d4cb62e86545f407a98a6dde0dc38dd90124aaab3f61addeeb6d7dd4
Instruction ID: 68ad16698dad6d0088dd8ad58bd37c271782236943da385f0bcd93a7e4b583c6
Opcode Fuzzy Hash: a0bc0a16d4cb62e86545f407a98a6dde0dc38dd90124aaab3f61addeeb6d7dd4
Instruction Fuzzy Hash: 77515432709E8186DB249F29E4903ADB3A1FB84FA8F944136DA9D837A8DF38C454C710

Function 00007FF7C415B1D0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF7C415B247
DeviceIoControl.KERNEL32 ref: 00007FF7C415B2AE
DeviceIoControl.KERNEL32 ref: 00007FF7C415B311
DeviceIoControl.KERNEL32 ref: 00007FF7C415B369

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 81d9f1483e453468423db8d9f668962ad74a42bea1564c4c17fb2d4ee1cb611d
Instruction ID: 6e2f81897e69661bf24364b20a3e9ce402864ba504a6bccd226bebb06ce8701f
Opcode Fuzzy Hash: 81d9f1483e453468423db8d9f668962ad74a42bea1564c4c17fb2d4ee1cb611d
Instruction Fuzzy Hash: 14512932A14B51CAF750CFA1F88079D77B8FB48768F541229EE8936B28DF388695D710

Function 00007FF7C41BA720 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF7C419CA0B), ref: 00007FF7C41BA77E

Strings

%s, xrefs: 00007FF7C41BA754

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 68a222f82cbefa7a31b8b5b9a89755378a2a9d3060f378f2fc893755967ffe9a
Instruction ID: ab963e67a8d2e0862e5e388ad180ff0caa30807700bc28472f6d8748f8f68fce
Opcode Fuzzy Hash: 68a222f82cbefa7a31b8b5b9a89755378a2a9d3060f378f2fc893755967ffe9a
Instruction Fuzzy Hash: 36416D32A18B8582DB51AF16B4801AAB7A0FB84FE4F940135DFDE03BA1DF3CE4958350

Function 00007FF7C41A61FD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41A6234

Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186B85
Part of subcall function 00007FF7C41868E0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C4186BA0

Strings

Wildcard - START of "%s", xrefs: 00007FF7C41A623D
Wildcard - "%s" skipped by user, xrefs: 00007FF7C41A629D
%s%s, xrefs: 00007FF7C41A6204

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 68c79d9f8685977b8fd2e58d4de856bc2582f55d6b7197173a0892e73739d585
Instruction ID: 7e46cc6f6df5d84ef3c1fdd55433865d1cb30844ea93734d5f930b904d10f2f4
Opcode Fuzzy Hash: 68c79d9f8685977b8fd2e58d4de856bc2582f55d6b7197173a0892e73739d585
Instruction Fuzzy Hash: 8A413E77A08A41C6E711EF26F8C41ADA3A0EB54FA9F894136DECE4B785DF38D4418360

Function 00007FF7C4181260 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41812B2
memmove.VCRUNTIME140 ref: 00007FF7C41812ED

Part of subcall function 00007FF7C4176650: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4176665

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C4181322

Part of subcall function 00007FF7C4176760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180D50,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4172451), ref: 00007FF7C4176787
Part of subcall function 00007FF7C4176760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7C4180D50,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4172451), ref: 00007FF7C4176793

Strings

%s:, xrefs: 00007FF7C41812CC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$malloc$memmove
String ID: %s:
API String ID: 2623842526-64597662
Opcode ID: 724bd0d041cde6986d9352ef7a8be5dea3b6ec4ec80e7a607b6d1f8295141846
Instruction ID: 08bf6ff38a6bcddfeaaffbbde3abc7e78979cdd554c0e6c781d54d886a75de7f
Opcode Fuzzy Hash: 724bd0d041cde6986d9352ef7a8be5dea3b6ec4ec80e7a607b6d1f8295141846
Instruction Fuzzy Hash: 6721B136A08A8592DB10EF12F9845AAB3A4FB94FF8F890132EE9D47795DF3CD4418350

Function 00007FF7C41756BD Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754D5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754EF

Strings

I64, xrefs: 00007FF7C41754E5
I32, xrefs: 00007FF7C41754C5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: a02f73a90c7c0692c47790adf952e930571e4e7b0585de9adbf82b8f4155d246
Instruction ID: 83ebd9eb3b7a9dd414b67df41a8306255a7d8bfcce8a824076b9b0ceb1f97cda
Opcode Fuzzy Hash: a02f73a90c7c0692c47790adf952e930571e4e7b0585de9adbf82b8f4155d246
Instruction Fuzzy Hash: 3421A732A0C96387E7216F23E4D0279BB95BB45FBDFC94131CA8D42695DF2CD9008761

Function 00007FF7C419C140 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41814D9,?,?,?,?,00007FF7C418087B), ref: 00007FF7C419C168
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7C41814D9,?,?,?,?,00007FF7C418087B), ref: 00007FF7C419C18E
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41814D9,?,?,?,?,00007FF7C418087B), ref: 00007FF7C419C1AF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41814D9,?,?,?,?,00007FF7C418087B), ref: 00007FF7C419C1C0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 16d705c0d537d8f37a35db3bfe792707df8038135f1290d3f72b44fe6f3f6244
Instruction ID: dac7e9331b538bcc0b3cbb89f13632dda8e05db1e206d03d5d7f986193000bdb
Opcode Fuzzy Hash: 16d705c0d537d8f37a35db3bfe792707df8038135f1290d3f72b44fe6f3f6244
Instruction Fuzzy Hash: 7D115421B0974283E664AF1779C423AE292BB58FD8F940035DECD83B54EF3CE4404754

Function 00007FF7C41BD210 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7C41BD24D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BD25D
WideCharToMultiByte.KERNEL32 ref: 00007FF7C41BD28C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41BD299

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: b4dfc76fb4ffe8b74755340cf98a3e6bc1de8f27de0bcb328b8a65d396000607
Instruction ID: 5866ac3528ff7503f7bf1070a32febd3b16b89bf92d8f78fcabb8b3992e42080
Opcode Fuzzy Hash: b4dfc76fb4ffe8b74755340cf98a3e6bc1de8f27de0bcb328b8a65d396000607
Instruction Fuzzy Hash: 85115B75F19B4287E724AFA2B884129B7A0FB88FA4B884078DF8943B14DF78E5018754

Function 00007FF7C417C150 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF7C417C102,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C161
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C102,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C16A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C417C102,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C417C174
closesocket.WS2_32 ref: 00007FF7C417C192

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 13ae87c21b03a96f4284f069c892ead7f13f4d96cebde648dbf7dfdda4d2666b
Instruction ID: a842e652efc71494a8629a6f24fc88481cc238a021d1d26114ad751a7c10ced2
Opcode Fuzzy Hash: 13ae87c21b03a96f4284f069c892ead7f13f4d96cebde648dbf7dfdda4d2666b
Instruction Fuzzy Hash: 43015216D28B81C3E714EF72D8A01786360FFE9F7CB456321DEAD011A5EF68A5D48210

Function 00007FF7C41755AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754D5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754EF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4175532

Strings

I64, xrefs: 00007FF7C41754E5
I32, xrefs: 00007FF7C41754C5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 5e9b7fc5d59fb97cd3103a4cc5fb010cb093e5f5babbb57e9840e2dc9a12f222
Instruction ID: 55b303c0a65596a0fc5b1fd92d9e27dff8ddcbeef91599bc9f958f2cd70e5292
Opcode Fuzzy Hash: 5e9b7fc5d59fb97cd3103a4cc5fb010cb093e5f5babbb57e9840e2dc9a12f222
Instruction Fuzzy Hash: FDF0BE21B0C95383EA215F23FCE0234AAA87F05FFCFC84131C99E826A0CE2CD6008321

Function 00007FF7C41755B2 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754D5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7C4175388), ref: 00007FF7C41754EF
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C4175532

Strings

I64, xrefs: 00007FF7C41754E5
I32, xrefs: 00007FF7C41754C5

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 72901347a25ec95e74bafb9b4714a115c983e94f641e046fd4929650202537a2
Instruction ID: f5b2225a6ac3c8fa4f20abeb39075d506a545899c677dd81ebbcbd74ec7373ab
Opcode Fuzzy Hash: 72901347a25ec95e74bafb9b4714a115c983e94f641e046fd4929650202537a2
Instruction Fuzzy Hash: 13F05421B0D95383E6255F13FCD4675AA957F45FFDFC45131C59E866A0DE2CD6008321

Function 00007FF7C41AE78F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C41AE885
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C41AE8E7

Strings

%ld, xrefs: 00007FF7C41AE7BC

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: 38183f6c23e3f5cc6f6ce419ad43cb8d5eb4deebc27017360f06e826f22308e8
Instruction ID: d9d13fbb484e918fdcd37aded6f97d6628d4a60b53eb975eda64f81f096cb669
Opcode Fuzzy Hash: 38183f6c23e3f5cc6f6ce419ad43cb8d5eb4deebc27017360f06e826f22308e8
Instruction Fuzzy Hash: 11314123A4974283FA66EF56B5943B9B790AF44FB8F890031DE8D03695DF2CE445C721

Function 00007FF7C4179540 Relevance: 5.3, APIs: 4, Instructions: 287COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C417980A
memmove.VCRUNTIME140 ref: 00007FF7C417993C
memmove.VCRUNTIME140 ref: 00007FF7C4179958

Part of subcall function 00007FF7C418DFD0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C4176D53), ref: 00007FF7C418E00C

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: freememmove
String ID:
API String ID: 2988784210-0
Opcode ID: 461c04e6690a4ce89df63b87f33bc10f55199f92787717babd3f006f8c6690b0
Instruction ID: 725ef12f36454b82930e03a0bc0a18e67d07d2dad4ee559a60014c99e1e42758
Opcode Fuzzy Hash: 461c04e6690a4ce89df63b87f33bc10f55199f92787717babd3f006f8c6690b0
Instruction Fuzzy Hash: 37C15C32B14A0286FB149F66E4807AC63A1BB45BBCF844635CEAD577C8DF38D849C750

Function 00007FF7C41BD160 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7C41B0298), ref: 00007FF7C41BD191
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C41B0298), ref: 00007FF7C41BD1A4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7C41B0298), ref: 00007FF7C41BD1CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7C41B0298), ref: 00007FF7C41BD1D8

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 152a6bb7aa9d611f0cc7e00812e726ccf876fcab62857e3e300adc677bbb16a7
Instruction ID: 18a438ca6524256a6cbd188c898d6763421d575ae4380f5c348e952659b3a1d9
Opcode Fuzzy Hash: 152a6bb7aa9d611f0cc7e00812e726ccf876fcab62857e3e300adc677bbb16a7
Instruction Fuzzy Hash: 64115135B0874283E724AF5AF84012AA6A4BF89FA8B884575DF8C47B59DF3CD5408710

Function 00007FF7C41B4730 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B082E,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B4756
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B082E,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B4777
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B082E,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B4792
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7C41B082E,?,?,?,?,?,?,?,00007FF7C417F0D3), ref: 00007FF7C41B47A0

Memory Dump Source

Source File: 00000000.00000002.2228656520.00007FF7C4141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4140000, based on PE: true

Associated: 00000000.00000002.2228634157.00007FF7C4140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228724936.00007FF7C41C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228760618.00007FF7C41E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228788941.00007FF7C41E9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C41EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C421F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228811225.00007FF7C4224000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228878993.00007FF7C4225000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4140000_CCuITQzvd4.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5d01fbbf49883c846bc1987000b92bcc026d30680c79aa65ddc81439ed4a2619
Instruction ID: 8a2f8f5c7b9cac43fb0f184e31c1cc7f123a38e76dd7a0eb0919576bd796ac80
Opcode Fuzzy Hash: 5d01fbbf49883c846bc1987000b92bcc026d30680c79aa65ddc81439ed4a2619
Instruction Fuzzy Hash: DB11A83AA04B4183DB04EF66E59412CB3A5FF98FA87504026CE8D43769CF38D894C790

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CCuITQzvd4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\pc_name_list[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\pc_username_list[1].txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
CCuITQzvd4.exe

Function 00007FF7C41426B0 Relevance: 67.6, APIs: 24, Strings: 14, Instructions: 1077
registrystringCOMMON

Function 00007FF7C416CDC0 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 217
COMMON

Function 00007FF7C4188C30 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Function 00007FF7C4168EF0 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 280
COMMON

Function 00007FF7C41710A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134
COMMON

Function 00007FF7C4150A00 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237
processlibraryloaderCOMMON

Function 00007FF7C4189530 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre