Edit tour

Windows Analysis Report
cwqqRXEhZb.msi

Overview

General Information

Sample name:	cwqqRXEhZb.msi renamed because original name is a hash value
Original sample name:	9d04aeddb08877a78c258b3ae7df42a924ae3ea12a0c7085035bb0469204d76b.msi
Analysis ID:	1571704
MD5:	02976832766fa022dd51cac7af80e779
SHA1:	8e5611992e678b3851ee4badc86efa6170257d52
SHA256:	9d04aeddb08877a78c258b3ae7df42a924ae3ea12a0c7085035bb0469204d76b
Tags:	LegionLoadermsiRobotDroppersearch-keys-comuser-johnk3r
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Bypasses PowerShell execution policy

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to get notified if a device is plugged in / out

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (might use process or thread times for sandbox detection)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious MsiExec Embedding Parent

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 2956 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cwqqRXEhZb.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5548 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7160 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE MD5: 9D09DC1EDA745A5F87553048E57620CF)

powershell.exe (PID: 428 cmdline: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue." MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

openvpn.exe (PID: 1252 cmdline: "C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe" MD5: 5E807B5DAD1B6C81982037C714DC9AEF)

conhost.exe (PID: 6104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7160, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7160, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7160, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: Suspicious MsiExec Embedding Parent

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE, ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 7160, ParentProcessName: msiexec.exe, ProcessCommandLine: -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue.", ProcessId: 428, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://search-keys.com/licenseUser.phpAI_DATA_SETTER_4Params

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libpkcs11-helper-1.dll

ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: cwqqRXEhZb.msi

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.5% probability

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7E520 NCryptFreeObject,CryptReleaseContext,CertFreeCertificateContext,EVP_PKEY_free,free,	8_2_00007FF6D3A7E520
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AB4D00 SetConsoleOutputCP,memset,memset,__acrt_iob_func,__acrt_iob_func,CRYPTO_get_ex_new_index,OPENSSL_init_crypto,memset,malloc,calloc,	8_2_00007FF6D3AB4D00
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A80C90 BCryptOpenAlgorithmProvider,BCryptCloseAlgorithmProvider,	8_2_00007FF6D3A80C90
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A9DB60 malloc,free,CRYPTO_memcmp,strcmp,strcmp,_close,free,free,free,free,free,recv,	8_2_00007FF6D3A9DB60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7D7B0 BIO_new_mem_buf,_exit,PEM_read_bio,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	8_2_00007FF6D3A7D7B0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFF380 malloc,EVP_CipherInit_ex,EVP_CipherUpdate,_exit,EVP_CipherFinal,malloc,malloc,EVP_MAC_init,_exit,EVP_MAC_update,EVP_MAC_update,EVP_MAC_CTX_get_mac_size,EVP_MAC_final,CRYPTO_memcmp,malloc,malloc,htonl,htonl,free,free,ERR_clear_error,free,free,	8_2_00007FF6D3AFF380
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7DE90 EVP_CIPHER_CTX_new,EVP_des_ede3_ecb,EVP_EncryptInit_ex,EVP_EncryptUpdate,EVP_EncryptFinal,_exit,EVP_CIPHER_CTX_free,	8_2_00007FF6D3A7DE90
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7E590 MultiByteToWideChar,malloc,MultiByteToWideChar,CertFindExtension,CryptDecodeObject,malloc,CryptDecodeObject,_stricmp,free,CryptFindOIDInfo,CryptFindOIDInfo,_stricmp,free,free,strncmp,MultiByteToWideChar,malloc,MultiByteToWideChar,strncmp,MultiByteToWideChar,malloc,MultiByteToWideChar,strncmp,isxdigit,isxdigit,strncmp,CertFindCertificateInStore,CertVerifyTimeValidity,CertFindCertificateInStore,free,OBJ_sn2nid,EVP_PKEY_get_bits,NCryptSignHash,SetLastError,strcmp,NCryptSignHash,SetLastError,calloc,CertOpenStore,CertCloseStore,CertOpenStore,CertCloseStore,CertGetNameStringW,malloc,CertGetNameStringW,d2i_X509,CryptAcquireCertificatePrivateKey,X509_free,NCryptFreeObject,CryptReleaseContext,CertFreeCertificateContext,EVP_PKEY_free,free,free,free,X509_get_pubkey,free,free,	8_2_00007FF6D3A7E590
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A73072C0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GetLocalTime,OpenMutexA,GetTempPathW,GetTempFileNameW,VirtualFreeEx,WritePrivateProfileStructW,FlsAlloc,GetModuleFileNameW,GetApplicationRecoveryCallback,OpenWaitableTimerW,IsSystemResumeAutomatic,EnumTimeFormatsW,SetLocalTime,FreeLibrary,SetThreadPriorityBoost,GetStartupInfoW,ConnectNamedPipe,SetFirmwareEnvironmentVariableW,LCIDToLocaleName,FlushInstructionCache,CreateSemaphoreW,CloseHandle,OpenJobObjectW,CreateThreadpoolCleanupGroup,RtlCaptureStackBackTrace,FindFirstVolumeMountPointW,GetFileMUIInfo,DeleteFiber,ConvertThreadToFiber,EnumCalendarInfoW,FlsGetValue,GetCommModemStatus,VirtualAlloc,GetLocalTime,GetNumaAvailableMemoryNode,GetProcAddress,GetThreadContext,GetFileAttributesW,DebugBreak,UnregisterWait,IsDBCSLeadByte,DeleteVolumeMountPointW,GetConsoleCP,RtlCaptureContext,FindNextFileNameW,WritePrivateProfileStringW,ReadConsoleOutputCharacterW,GetUILanguageInfo,RequestWakeupLatency,GetFullPathNameTransactedW,CreatePrivateNamespaceW,LeaveCriticalSection,GetConsoleProcessList,VirtualProtect,PostQueuedCompletionStatus,GetNumaAvailableMemoryNodeEx,LockFile,lstrlenW,IsBadWritePtr,DosDateTimeToFileTime,ClearCommError,RegisterApplicationRestart,GetNumaNodeProcessorMaskEx,GetLongPathNameW,Wow64SetThreadContext,LocaleNameToLCID,SetErrorMode,GetVolumePathNameW,GetDateFormatW,SetMailslotInfo,ReclaimVirtualMemory,SetTapeParameters,Wow64EnableWow64FsRedirection,GetDiskFreeSpaceW,SetUserGeoID,FlushProcessWriteBuffers,InterlockedPushListSListEx,OutputDebugStringA,	8_2_00007FF8A73072C0

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D0265C05-725E-4038-8426-7D1D1C311BF9}

Jump to behavior

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SecureProp.pdb, source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libcrypto-3-x64.pdb source: openvpn.exe, 00000008.00000002.2530707654.00007FF8A7A7C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: D:\agent\_work\13\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: openvpn.exe, 00000008.00000002.2531238458.00007FF8BFB61000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbk source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SecureProp.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-3-x64.pdb{{ source: openvpn.exe, 00000008.00000002.2531020609.00007FF8B83C0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\openvpn\out\build\win-amd64-release\Release\openvpn.pdb source: openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-3-x64.pdb source: openvpn.exe, 00000008.00000002.2531020609.00007FF8B83C0000.00000002.00000001.01000000.00000007.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7308870 DdeUnaccessData,DrawIcon,GetFileSize,SetThreadContext,CreateDirectoryTransactedW,GetFileTime,LoadPackagedLibrary,SetFileValidData,PurgeComm,GetMenuDefaultItem,SendMessageTimeoutW,FileTimeToDosDateTime,GetCapture,GetProfileIntW,IsHungAppWindow,RegisterDeviceNotificationW,LoadBitmapW,CancelIo,ReleaseSemaphore,UpdateLayeredWindowIndirect,GetConsoleMode,FormatMessageW,CascadeWindows,DispatchMessageW,FreeConsole,SetLayeredWindowAttributes,SendMessageCallbackW,InitOnceBeginInitialize,SleepConditionVariableCS,GetNumaNodeProcessorMask,OemToCharW,RegisterDeviceNotificationW,LocalLock,GetSystemWindowsDirectoryW,GetDllDirectoryW,EnumResourceNamesW,CreatePrivateNamespaceW,PeekNamedPipe,LocalHandle,GetCurrentThread,ReleaseSemaphore,EnumSystemCodePagesW,UpdateResourceW,IsValidNLSVersion,SetProtectedPolicy,CreateSemaphoreExW,CreateThreadpoolWait,GetNumberOfConsoleMouseButtons,Wow64GetThreadSelectorEntry,SetErrorMode,PostQueuedCompletionStatus,WritePrivateProfileStructW,GetWindowsDirectoryW,OpenPrivateNamespaceW,FindVolumeClose,LocalSize,TryAcquireSRWLockShared,SetupComm,CreateSymbolicLinkW,VirtualAllocEx,GlobalMemoryStatus,IsValidNLSVersion,CreateThreadpool,SetFileCompletionNotificationModes,CompareStringW,GetThreadIOPendingFlag,GetLocaleInfoW,MoveFileW,HeapSize,GetCurrentConsoleFont,LeaveCriticalSectionWhenCallbackReturns,DiscardVirtualMemory,SetHandleInformation,AreFileApisANSI,EndUpdateResourceW,ReadConsoleOutputW,VerifyVersionInfoW,ConvertDefaultLocale,FillConsoleOutputCharacterW,lstrcmpW,CreateThreadpoolWait,SetPriorityClass,EnumTimeFormatsEx,EnumSystemCodePagesW,ReclaimVirtualMemory,GetDurationFormat,

8_2_00007FF8A7308870

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7304E30 DefWindowProcW,InvalidateRect,BeginPaint,CreateSolidBrush,FillRect,GetStockObject,FrameRect,DeleteObject,CreateSolidBrush,FillRect,GetStockObject,FrameRect,DeleteObject,EndPaint,KillTimer,PostQuitMessage,SetTimer,GetLocalTime,GetCurrentProcess,GetProcessTimes,FileTimeToSystemTime,OutputDebugStringW,AddAtomW,FindCloseChangeNotification,EnumSystemLanguageGroupsW,AddVectoredContinueHandler,GetCPInfoExW,EnterSynchronizationBarrier,VirtualQuery,GetCalendarInfoEx,OpenEventW,GetNumaProximityNodeEx,FindFirstFileNameW,Polygon,OpenMutexW,OutputDebugStringW,CloseHandle,OutputDebugStringW,GetTempPathW,GetFileAttributesW,OutputDebugStringA,RegOpenKeyExW,RegCloseKey,OutputDebugStringW,Concurrency::cancel_current_task,LoadLibraryExW,GetStartupInfoW,SetConsoleTitleW,lstrcatW,GetStdHandle,SetProcessMitigationPolicy,TerminateThread,SetCurrentConsoleFontEx,Beep,GetModuleHandleExW,CommConfigDialogW,SetProtectedPolicy,ReadConsoleOutputAttribute,lstrcmpiW,FindNextFileNameW,GetConsoleMode,GetNumberOfConsoleMouseButtons,GetTapePosition,GetStringTypeExW,InterlockedPopEntrySList,HeapValidate,RegisterWaitForSingleObject,SetConsoleActiveScreenBuffer,CopyFile2,CreateNamedPipeW,CreatePipe,SetSystemTimeAdjustment,DeleteFileW,ResolveLocaleName,StartThreadpoolIo,CreateDirectoryTransactedW,GetNLSVersionEx,AreFileApisANSI,FindAtomW,RemoveVectoredContinueHandler,TryAcquireSRWLockShared,ExitProcess,

8_2_00007FF8A7304E30

Networking

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: openvpn.exe.1.dr

Static PE information: Found NDIS imports: FwpmFilterAdd0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmSubLayerGetByKey0, FwpmSubLayerAdd0, FwpmGetAppIdFromFileName0, FwpmEngineClose0

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF6D3A9DB60 malloc,free,CRYPTO_memcmp,strcmp,strcmp,_close,free,free,free,free,free,recv,

8_2_00007FF6D3A9DB60

Source: global traffic

DNS traffic detected: DNS query: search-keys.com

Source: powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: openvpn.exe, openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://openvpn.net/faq.html#dhcpclientserv
Source: openvpn.exe, openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://openvpn.net/howto.html#mitm
Source: powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2447195990.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.2447195990.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBeq
Source: powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2447195990.0000000005061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr	String found in binary or memory: https://search-keys.com/licenseUser.phpAI_DATA_SETTER_4Params
Source: openvpn.exe	String found in binary or memory: https://www.openssl.org/
Source: openvpn.exe, 00000008.00000002.2530851545.00007FF8A7B7F000.00000002.00000001.01000000.00000008.sdmp, openvpn.exe, 00000008.00000002.2531117632.00007FF8B83F1000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF6D3A80520: DeviceIoControl,GetLastError,_exit,

8_2_00007FF6D3A80520

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c4fc2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5918.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59E4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A72.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5AA2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5B01.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI79F4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97CD.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI982C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI99C3.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3F6.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{D0265C05-725E-4038-8426-7D1D1C311BF9}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA54E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c4fc5.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c4fc5.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI5918.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE48D0	8_2_00007FF6D3AE48D0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A948C0	8_2_00007FF6D3A948C0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B0A130	8_2_00007FF6D3B0A130
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7BD20	8_2_00007FF6D3A7BD20
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AB4D00	8_2_00007FF6D3AB4D00
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFE470	8_2_00007FF6D3AFE470
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AD6060	8_2_00007FF6D3AD6060
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A79460	8_2_00007FF6D3A79460
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B134A0	8_2_00007FF6D3B134A0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A73440	8_2_00007FF6D3A73440
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A9A3F0	8_2_00007FF6D3A9A3F0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AF3FE0	8_2_00007FF6D3AF3FE0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFABD0	8_2_00007FF6D3AFABD0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A92BC0	8_2_00007FF6D3A92BC0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AA27C0	8_2_00007FF6D3AA27C0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AF37C0	8_2_00007FF6D3AF37C0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B053C0	8_2_00007FF6D3B053C0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AF5C20	8_2_00007FF6D3AF5C20
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B157E0	8_2_00007FF6D3B157E0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A9DB60	8_2_00007FF6D3A9DB60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A71F60	8_2_00007FF6D3A71F60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE0BA0	8_2_00007FF6D3AE0BA0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B0E350	8_2_00007FF6D3B0E350
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B0FF60	8_2_00007FF6D3B0FF60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B06F80	8_2_00007FF6D3B06F80
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFF380	8_2_00007FF6D3AFF380
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B0EF10	8_2_00007FF6D3B0EF10
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A98EBD	8_2_00007FF6D3A98EBD
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFE710	8_2_00007FF6D3AFE710
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B126F0	8_2_00007FF6D3B126F0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AA6A60	8_2_00007FF6D3AA6A60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE9650	8_2_00007FF6D3AE9650
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B0EAB0	8_2_00007FF6D3B0EAB0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A75640	8_2_00007FF6D3A75640
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A916B0	8_2_00007FF6D3A916B0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B1A240	8_2_00007FF6D3B1A240
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFD2A0	8_2_00007FF6D3AFD2A0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3ADBAA0	8_2_00007FF6D3ADBAA0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B07E90	8_2_00007FF6D3B07E90
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A76290	8_2_00007FF6D3A76290
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AF6DF0	8_2_00007FF6D3AF6DF0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFA1E0	8_2_00007FF6D3AFA1E0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B1BE10	8_2_00007FF6D3B1BE10
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B11630	8_2_00007FF6D3B11630
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AC3A20	8_2_00007FF6D3AC3A20
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AFAA10	8_2_00007FF6D3AFAA10
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE1600	8_2_00007FF6D3AE1600
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A89D70	8_2_00007FF6D3A89D70
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A98D60	8_2_00007FF6D3A98D60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7AD60	8_2_00007FF6D3A7AD60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B09DA0	8_2_00007FF6D3B09DA0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B06540	8_2_00007FF6D3B06540
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AD25B0	8_2_00007FF6D3AD25B0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A921A0	8_2_00007FF6D3A921A0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A7E590	8_2_00007FF6D3A7E590
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7304E30	8_2_00007FF8A7304E30
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7308E20	8_2_00007FF8A7308E20
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7303570	8_2_00007FF8A7303570
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A73072C0	8_2_00007FF8A73072C0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7309E00	8_2_00007FF8A7309E00
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7303D50	8_2_00007FF8A7303D50
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7303A80	8_2_00007FF8A7303A80
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7308870	8_2_00007FF8A7308870
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386770	8_2_00007FF8A7386770
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A739E730	8_2_00007FF8A739E730
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7304790	8_2_00007FF8A7304790
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A730E7B0	8_2_00007FF8A730E7B0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A738C6A0	8_2_00007FF8A738C6A0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386564	8_2_00007FF8A7386564
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A73885C8	8_2_00007FF8A73885C8
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A738A4A8	8_2_00007FF8A738A4A8
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386360	8_2_00007FF8A7386360
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A739A330	8_2_00007FF8A739A330
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7308260	8_2_00007FF8A7308260
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A73A220C	8_2_00007FF8A73A220C
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A73881C4	8_2_00007FF8A73881C4
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A738D06C	8_2_00007FF8A738D06C
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7395008	8_2_00007FF8A7395008
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7396F74	8_2_00007FF8A7396F74
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7306E60	8_2_00007FF8A7306E60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7302D90	8_2_00007FF8A7302D90
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386D84	8_2_00007FF8A7386D84
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7394B74	8_2_00007FF8A7394B74
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386B80	8_2_00007FF8A7386B80
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7386974	8_2_00007FF8A7386974
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7304960	8_2_00007FF8A7304960
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7387830	8_2_00007FF8A7387830
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7395688	8_2_00007FF8A7395688
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A738F528	8_2_00007FF8A738F528
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A739D5B4	8_2_00007FF8A739D5B4
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A739144C	8_2_00007FF8A739144C

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: String function: 00007FF8A73803EC appears 157 times
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: String function: 00007FF6D3A726F0 appears 77 times
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: String function: 00007FF6D3A83310 appears 49 times
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: String function: 00007FF6D3A82CE0 appears 934 times
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: String function: 00007FF6D3A83290 appears 515 times

Source: libwinpthread-1.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: libassuan-0.dll.1.dr	Static PE information: Number of sections : 12 > 10
Source: vlc.exe.1.dr	Static PE information: Number of sections : 14 > 10
Source: libgpg-error-0.dll.1.dr	Static PE information: Number of sections : 12 > 10

Source: api-ms-win-core-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found

Source: cwqqRXEhZb.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs cwqqRXEhZb.msi
Source: cwqqRXEhZb.msi	Binary or memory string: OriginalFilenameSecureProp.dllF vs cwqqRXEhZb.msi
Source: cwqqRXEhZb.msi	Binary or memory string: OriginalFilenameDataUploader.dllF vs cwqqRXEhZb.msi
Source: cwqqRXEhZb.msi	Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs cwqqRXEhZb.msi

Source: classification engine

Classification label: mal42.troj.evad.winMSI@10/153@1/0

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A735C480 GetDiskFreeSpaceExA,

8_2_00007FF8A735C480

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7303D50 GetProfileSectionW,GetWindowsDirectoryW,ConvertThreadToFiberEx,CopyFileTransactedW,AssignProcessToJobObject,IsValidLanguageGroup,AddVectoredContinueHandler,SetConsoleOutputCP,SetProcessPreferredUILanguages,SetThreadIdealProcessor,GetCompressedFileSizeW,EnumSystemLocalesW,WaitCommEvent,WriteProcessMemory,VirtualQuery,ChangeTimerQueueTimer,Wow64DisableWow64FsRedirection,SetWaitableTimer,GetConsoleDisplayMode,GetQueuedCompletionStatus,GetApplicationRecoveryCallback,DialogBoxIndirectParamW,UpdateLayeredWindow,ContinueDebugEvent,SetCommMask,GetTimeZoneInformationForYear,MoveFileWithProgressW,SetClassLongW,HiliteMenuItem,LoadBitmapW,GetUserObjectSecurity,MultiByteToWideChar,SetThreadExecutionState,ReplyMessage,IsThreadAFiber,GetCurrentDirectoryW,GetFileAttributesW,GlobalAlloc,OutputDebugStringW,GlobalLock,LocalAlloc,VirtualLock,GetTitleBarInfo,CloseHandle,InterlockedPopEntrySList,mouse_event,GlobalLock,SetConsoleOutputCP,UserHandleGrantAccess,InterlockedFlushSList,GetLogicalDrives,StartThreadpoolIo,GetMenuItemID,MonitorFromRect,LocalLock,GetProcessHeap,SetThreadErrorMode,GetTickCount64,FoldStringW,SetThreadpoolWait,CreateWaitableTimerExW,GetPrivateProfileStringW,WritePrivateProfileStringW,GetConsoleOutputCP,GetProcessAffinityMask,CancelThreadpoolIo,DisconnectNamedPipe,DebugBreakProcess,HeapAlloc,CreateThreadpoolIo,CreateSymbolicLinkTransactedW,GetProcessTimes,GetCPInfoExW,SubmitThreadpoolWork,ConvertThreadToFiberEx,ReadConsoleInputW,GetVersion,FindNextVolumeMountPointW,FreeResource,VirtualAlloc,IsValidNLSVersion,GetUserPreferredUILanguages,GetCommState,SetFileApisToOEM,GetHandleInformation,CreateFileW,LoadModule,ReleaseSRWLockShared,GetCurrencyFormatW,FindResourceExW,GetCurrentProcessorNumberEx,GetCommTimeouts,VirtualAlloc,DeleteTimerQueue,RequestWakeupLatency,VerSetConditionMask,GetApplicationRestartSettings,

8_2_00007FF8A7303D50

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLA600.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF26E70D620F878543.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

Jump to behavior

Source: cwqqRXEhZb.msi

ReversingLabs: Detection: 44%

Source: openvpn.exe	String found in binary or memory: Use --help for more information.
Source: openvpn.exe	String found in binary or memory: Use --help for more information.
Source: openvpn.exe	String found in binary or memory: tun-stop
Source: openvpn.exe	String found in binary or memory: %s General Options: --config file : Read configuration options from file. --help : Show options. --version : Show copyright and version information. Tunnel Options: --local host : Local host name or ip address. Implies --bind. --remote ho
Source: openvpn.exe	String found in binary or memory: %s General Options: --config file : Read configuration options from file. --help : Show options. --version : Show copyright and version information. Tunnel Options: --local host : Local host name or ip address. Implies --bind. --remote ho
Source: openvpn.exe	String found in binary or memory: WARNING: External program may not be called unless '--script-security 2' or higher is enabled. See --help text or man page for detailed info.
Source: openvpn.exe	String found in binary or memory: WARNING: External program may not be called unless '--script-security 2' or higher is enabled. See --help text or man page for detailed info.
Source: openvpn.exe	String found in binary or memory: %sGeneral Options:--config file : Read configuration options from file.--help : Show options.--version : Show copyright and version information.Tunnel Options:--local host : Local host name or ip address. Implies --bind.--remote ho
Source: openvpn.exe	String found in binary or memory: %sGeneral Options:--config file : Read configuration options from file.--help : Show options.--version : Show copyright and version information.Tunnel Options:--local host : Local host name or ip address. Implies --bind.--remote ho

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cwqqRXEhZb.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe "C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe "C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: libssl-3-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: libcrypto-3-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: libcrypto-3-x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: libpkcs11-helper-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: vlc.lnk.1.dr

LNK file: ..\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D0265C05-725E-4038-8426-7D1D1C311BF9}

Jump to behavior

Source: cwqqRXEhZb.msi

Static file information: File size 56194048 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SecureProp.pdb, source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libcrypto-3-x64.pdb source: openvpn.exe, 00000008.00000002.2530707654.00007FF8A7A7C000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: D:\agent\_work\13\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: openvpn.exe, 00000008.00000002.2531238458.00007FF8BFB61000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\PowerShellScriptLauncher.pdbk source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SecureProp.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\DataUploader.pdbj source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-3-x64.pdb{{ source: openvpn.exe, 00000008.00000002.2531020609.00007FF8B83C0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\openvpn\out\build\win-amd64-release\Release\openvpn.pdb source: openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: cwqqRXEhZb.msi, 3c4fc2.msi.1.dr
Source:	Binary string: C:\buildbot\msbuild\openvpn-build\src\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-3-x64.pdb source: openvpn.exe, 00000008.00000002.2531020609.00007FF8B83C0000.00000002.00000001.01000000.00000007.sdmp

Source: vlc.exe.1.dr

Static PE information: 0xA6D0A6C0 [Sun Sep 8 06:27:12 2058 UTC]

Source: vlc.exe.1.dr	Static PE information: section name: .buildid
Source: vlc.exe.1.dr	Static PE information: section name: .xdata
Source: vlc.exe.1.dr	Static PE information: section name: /4
Source: VCRUNTIME140.dll.1.dr	Static PE information: section name: _RDATA
Source: libassuan-0.dll.1.dr	Static PE information: section name: .xdata
Source: libgpg-error-0.dll.1.dr	Static PE information: section name: .xdata
Source: libwinpthread-1.dll.1.dr	Static PE information: section name: .xdata
Source: SecureProp.dll.1.dr	Static PE information: section name: .fptable
Source: UnRar.exe.1.dr	Static PE information: section name: _RDATA
Source: libpkcs11-helper-1.dll.1.dr	Static PE information: section name: .udata
Source: MSI97CD.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI982C.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI99C3.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI5918.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI59E4.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI5A72.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI5AA2.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI5B01.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI79F4.tmp.1.dr	Static PE information: section name: .fptable
Source: MSIA3F6.tmp.1.dr	Static PE information: section name: .fptable

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_044DBDA3 push esp; ret	5_2_044DBDB3
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A8D2CD push rbx; iretd	8_2_00007FF6D3A8D2CE
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7437085 push rsi; ret	8_2_00007FF8A7437086

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A72.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libassuan-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI79F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libssl-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5B01.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libgpg-error-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59E4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5918.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5AA2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI99C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI982C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A72.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59E4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5918.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5AA2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI79F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5B01.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI99C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI982C.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: GetAdaptersInfo,malloc,GetAdaptersInfo,malloc,

8_2_00007FF6D3B07970

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3467			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 944			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5A72.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libassuan-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI97CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI79F4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5B01.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libgpg-error-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI59E4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5918.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5AA2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA3F6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI99C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI982C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

8_2_00007FF8A7304E30

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

API coverage: 4.6 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep count: 3467 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep count: 944 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5596	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

8_2_00007FF8A7304E30

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q4classes/jdk/vm/ci/runtime/JVMCICompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$2.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/amd64/AMD64HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCICompiler.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q5classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$1.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/services/JVMCIServiceLocator.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q3classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$WeakReferenceHolder.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$3.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q:classes/jdk/vm/ci/hotspot/HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIReflection.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIReflection.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q5classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$4.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/aarch64/AArch64HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCIBackend.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$1.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q-classes/jdk/vm/ci/runtime/JVMCICompiler.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/SharedLibraryJVMCIReflection.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/common/JVMCIError.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIBackendFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$1.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q5classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$2.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/services/JVMCIServiceLocator.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig$DummyCompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$3.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCICompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q,classes/jdk/vm/ci/runtime/JVMCIRuntime.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QOclasses/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig$DummyCompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q;classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCIBackend.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/SharedLibraryJVMCIReflection.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevelAdjustment.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCI.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevel.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q0classes/jdk/vm/ci/services/JVMCIPermission.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q5classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$3.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/common/JVMCIError.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q)classes/jdk/vm/ci/common/JVMCIError.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QEclasses/jdk/vm/ci/hotspot/HotSpotJVMCIUnsupportedOperationError.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig$DummyCompilerFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QLclasses/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevel.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCIRuntime.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$Option.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$4.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$4.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCIRuntime.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$2.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q6classes/jdk/vm/ci/hotspot/HotSpotJVMCIReflection.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCICompilerFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QEclasses/jdk/vm/ci/hotspot/amd64/AMD64HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$WeakReferenceHolder.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIUnsupportedOperationError.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$Option.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q:classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerConfig.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCICompiler.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/amd64/AMD64HotSpotJVMCIBackendFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q%classes/jdk/vm/ci/runtime/JVMCI.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevelAdjustment.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QVclasses/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevelAdjustment.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q,classes/jdk/vm/ci/runtime/JVMCIBackend.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIUnsupportedOperationError.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QIclasses/jdk/vm/ci/hotspot/aarch64/AArch64HotSpotJVMCIBackendFactory.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/services/JVMCIPermission.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q<classes/jdk/vm/ci/hotspot/SharedLibraryJVMCIReflection.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q4classes/jdk/vm/ci/services/JVMCIServiceLocator.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/Q:classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$Option.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/services/JVMCIPermission.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: n/QGclasses/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime$WeakReferenceHolder.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/aarch64/AArch64HotSpotJVMCIBackendFactory.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/runtime/JVMCI.class
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCIRuntime.classPK
Source: jdk.internal.vm.ci.jmod.1.dr	Binary or memory string: classes/jdk/vm/ci/hotspot/HotSpotJVMCICompilerFactory$CompilationLevel.classPK

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7432DE8 IsDebuggerPresent,

8_2_00007FF8A7432DE8

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

8_2_00007FF8A7303D50

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe "C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3B1C9F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		8_2_00007FF6D3B1C9F0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A738B230 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		8_2_00007FF8A738B230

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

8_2_00007FF8A7303D50

Source: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss9a6a.ps1" -propfile "c:\users\user\appdata\local\temp\msi9a57.txt" -scriptfile "c:\users\user\appdata\local\temp\scr9a58.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr9a59.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pss9a6a.ps1" -propfile "c:\users\user\appdata\local\temp\msi9a57.txt" -scriptfile "c:\users\user\appdata\local\temp\scr9a58.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scr9a59.txt" -propsep " :<->: " -linesep " <<:>> " -testprefix "_testvalue."			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF6D3B13F40 GetStdHandle,GetConsoleMode,SetConsoleMode,_exit,SetConsoleCtrlHandler,MultiByteToWideChar,malloc,MultiByteToWideChar,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateEventW,WaitForSingleObject,free,_exit,

8_2_00007FF6D3B13F40

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A73A4CF0 cpuid

8_2_00007FF8A73A4CF0

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: MoveFileWithProgressW,GetCommModemStatus,SetMailslotInfo,EnumResourceNamesW,GetStartupInfoW,FindNextVolumeMountPointW,GetCurrentProcessorNumberEx,InterlockedPushListSListEx,TerminateProcess,GetCurrentProcessorNumberEx,GetActiveProcessorCount,RequestWakeupLatency,EnumSystemLanguageGroupsW,GetBinaryTypeW,OfferVirtualMemory,IsSystemResumeAutomatic,DeviceIoControl,ReadConsoleOutputW,InitOnceComplete,FlushProcessWriteBuffers,CreateProcessW,GetTimeZoneInformationForYear,DeleteVolumeMountPointW,GetNamedPipeClientComputerNameW,GetLocaleInfoEx,InitializeSynchronizationBarrier,GetProcessWorkingSetSizeEx,FindFirstVolumeW,TrySubmitThreadpoolCallback,GetFileSize,SetProcessPreferredUILanguages,VirtualQueryEx,OutputDebugStringA,	8_2_00007FF8A7309E00
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetProfileSectionW,GetWindowsDirectoryW,ConvertThreadToFiberEx,CopyFileTransactedW,AssignProcessToJobObject,IsValidLanguageGroup,AddVectoredContinueHandler,SetConsoleOutputCP,SetProcessPreferredUILanguages,SetThreadIdealProcessor,GetCompressedFileSizeW,EnumSystemLocalesW,WaitCommEvent,WriteProcessMemory,VirtualQuery,ChangeTimerQueueTimer,Wow64DisableWow64FsRedirection,SetWaitableTimer,GetConsoleDisplayMode,GetQueuedCompletionStatus,GetApplicationRecoveryCallback,DialogBoxIndirectParamW,UpdateLayeredWindow,ContinueDebugEvent,SetCommMask,GetTimeZoneInformationForYear,MoveFileWithProgressW,SetClassLongW,HiliteMenuItem,LoadBitmapW,GetUserObjectSecurity,MultiByteToWideChar,SetThreadExecutionState,ReplyMessage,IsThreadAFiber,GetCurrentDirectoryW,GetFileAttributesW,GlobalAlloc,OutputDebugStringW,GlobalLock,LocalAlloc,VirtualLock,GetTitleBarInfo,CloseHandle,InterlockedPopEntrySList,mouse_event,GlobalLock,SetConsoleOutputCP,UserHandleGrantAccess,InterlockedFlushSList,GetLogicalDrives,StartThreadpoolIo,GetMenuItemID,MonitorFromRect,LocalLock,GetProcessHeap,SetThreadErrorMode,GetTickCount64,FoldStringW,SetThreadpoolWait,CreateWaitableTimerExW,GetPrivateProfileStringW,WritePrivateProfileStringW,GetConsoleOutputCP,GetProcessAffinityMask,CancelThreadpoolIo,DisconnectNamedPipe,DebugBreakProcess,HeapAlloc,CreateThreadpoolIo,CreateSymbolicLinkTransactedW,GetProcessTimes,GetCPInfoExW,SubmitThreadpoolWork,ConvertThreadToFiberEx,ReadConsoleInputW,GetVersion,FindNextVolumeMountPointW,FreeResource,VirtualAlloc,IsValidNLSVersion,GetUserPreferredUILanguages,GetCommState,SetFileApisToOEM,GetHandleInformation,CreateFileW,LoadModule,ReleaseSRWLockShared,GetCurrencyFormatW,FindResourceExW,GetCurrentProcessorNumberEx,GetCommTimeouts,VirtualAlloc,DeleteTimerQueue,RequestWakeupLatency,VerSetConditionMask,GetApplicationRestartSettings,	8_2_00007FF8A7303D50
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: DdeUnaccessData,DrawIcon,GetFileSize,SetThreadContext,CreateDirectoryTransactedW,GetFileTime,LoadPackagedLibrary,SetFileValidData,PurgeComm,GetMenuDefaultItem,SendMessageTimeoutW,FileTimeToDosDateTime,GetCapture,GetProfileIntW,IsHungAppWindow,RegisterDeviceNotificationW,LoadBitmapW,CancelIo,ReleaseSemaphore,UpdateLayeredWindowIndirect,GetConsoleMode,FormatMessageW,CascadeWindows,DispatchMessageW,FreeConsole,SetLayeredWindowAttributes,SendMessageCallbackW,InitOnceBeginInitialize,SleepConditionVariableCS,GetNumaNodeProcessorMask,OemToCharW,RegisterDeviceNotificationW,LocalLock,GetSystemWindowsDirectoryW,GetDllDirectoryW,EnumResourceNamesW,CreatePrivateNamespaceW,PeekNamedPipe,LocalHandle,GetCurrentThread,ReleaseSemaphore,EnumSystemCodePagesW,UpdateResourceW,IsValidNLSVersion,SetProtectedPolicy,CreateSemaphoreExW,CreateThreadpoolWait,GetNumberOfConsoleMouseButtons,Wow64GetThreadSelectorEntry,SetErrorMode,PostQueuedCompletionStatus,WritePrivateProfileStructW,GetWindowsDirectoryW,OpenPrivateNamespaceW,FindVolumeClose,LocalSize,TryAcquireSRWLockShared,SetupComm,CreateSymbolicLinkW,VirtualAllocEx,GlobalMemoryStatus,IsValidNLSVersion,CreateThreadpool,SetFileCompletionNotificationModes,CompareStringW,GetThreadIOPendingFlag,GetLocaleInfoW,MoveFileW,HeapSize,GetCurrentConsoleFont,LeaveCriticalSectionWhenCallbackReturns,DiscardVirtualMemory,SetHandleInformation,AreFileApisANSI,EndUpdateResourceW,ReadConsoleOutputW,VerifyVersionInfoW,ConvertDefaultLocale,FillConsoleOutputCharacterW,lstrcmpW,CreateThreadpoolWait,SetPriorityClass,EnumTimeFormatsEx,EnumSystemCodePagesW,ReclaimVirtualMemory,GetDurationFormat,	8_2_00007FF8A7308870
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoW,	8_2_00007FF8A7432520
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoEx,	8_2_00007FF8A74323C8
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoW,	8_2_00007FF8A7394188
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: EnumSystemLocalesW,	8_2_00007FF8A739F01C
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: EnumSystemLocalesW,	8_2_00007FF8A739F0EC
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_00007FF8A739ECC0
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: EnumSystemLocalesW,	8_2_00007FF8A7432B48
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00007FF8A739F708
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00007FF8A739F524
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoW,	8_2_00007FF8A739F5D4
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: GetLocaleInfoW,	8_2_00007FF8A739F3CC

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

8_2_00007FF8A7304E30

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF6D3B1D3EC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00007FF6D3B1D3EC

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7309E00 MoveFileWithProgressW,GetCommModemStatus,SetMailslotInfo,EnumResourceNamesW,GetStartupInfoW,FindNextVolumeMountPointW,GetCurrentProcessorNumberEx,InterlockedPushListSListEx,TerminateProcess,GetCurrentProcessorNumberEx,GetActiveProcessorCount,RequestWakeupLatency,EnumSystemLanguageGroupsW,GetBinaryTypeW,OfferVirtualMemory,IsSystemResumeAutomatic,DeviceIoControl,ReadConsoleOutputW,InitOnceComplete,FlushProcessWriteBuffers,CreateProcessW,GetTimeZoneInformationForYear,DeleteVolumeMountPointW,GetNamedPipeClientComputerNameW,GetLocaleInfoEx,InitializeSynchronizationBarrier,GetProcessWorkingSetSizeEx,FindFirstVolumeW,TrySubmitThreadpoolCallback,GetFileSize,SetProcessPreferredUILanguages,VirtualQueryEx,OutputDebugStringA,

8_2_00007FF8A7309E00

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Code function: 8_2_00007FF8A7303570 GetTempPathA,GetTempFileNameA,InitializeProcThreadAttributeList,RtlCaptureContext,EnumTimeFormatsEx,GetConsoleAliasesLengthW,SetFileValidData,GetFullPathNameTransactedW,GetTapeStatus,GetUserDefaultLCID,PeekConsoleInputW,InitializeConditionVariable,GetTimeFormatEx,GetFileInformationByHandle,OfferVirtualMemory,GetKerningPairsW,SetLastError,GetVolumeInformationByHandleW,InitOnceComplete,AnimatePalette,TerminateThread,BitBlt,CreateFiber,GetTextAlign,GetUserGeoID,GetEnvironmentStringsW,DeleteProcThreadAttributeList,CreateThreadpoolTimer,GetModuleHandleExW,ChangeTimerQueueTimer,FindStringOrdinal,QueryDepthSList,SwitchToFiber,CreateMailslotW,GetStdHandle,GetSystemDEPPolicy,OfferVirtualMemory,GetAtomNameW,OpenFileMappingW,FileTimeToSystemTime,EnumTimeFormatsW,GetVersion,CreateTimerQueueTimer,SetPriorityClass,FlsSetValue,GetVersion,OpenPrivateNamespaceW,GlobalLock,

8_2_00007FF8A7303570

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3A9D370 socket,listen,_exit,getsockname,free,free,	8_2_00007FF6D3A9D370
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE5E60 setsockopt,bind,_exit,	8_2_00007FF6D3AE5E60
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF6D3AE5660 listen,_exit,free,free,	8_2_00007FF6D3AE5660
Source: C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	Code function: 8_2_00007FF8A7308E20 RtlUnwind,DdeUninitialize,IntersectRect,CallMsgFilterW,GetUserObjectSecurity,GetDiskFreeSpaceExW,GetLastInputInfo,GetConsoleMode,SetConsoleDisplayMode,DisableThreadLibraryCalls,GetDialogBaseUnits,FlashWindowEx,RemoveDirectoryTransactedW,DeleteTimerQueueEx,DeleteCriticalSection,SetConsoleWindowInfo,OpenProcess,SetProcessDEPPolicy,GetExitCodeProcess,IsWow64Message,DdeQueryStringW,DuplicateHandle,GetVolumePathNameW,OpenProcess,CloseThreadpoolIo,OpenPrivateNamespaceW,PlayMetaFile,GdiComment,CancelSynchronousIo,EnumMetaFile,SelectClipPath,GetNumaHighestNodeNumber,GetShortPathNameW,GetConsoleSelectionInfo,GetThreadUILanguage,GetTextAlign,MapUserPhysicalPagesScatter,WriteConsoleOutputAttribute,ChangeTimerQueueTimer,CreateThreadpoolWait,GetApplicationRestartSettings,UnregisterWaitEx,MoveFileW,GetProcessorSystemCycleTime,OpenPrivateNamespaceW,CreateEventW,FlushViewOfFile,ReleaseMutex,AddResourceAttributeAce,CreateWaitableTimerExW,CheckTokenCapability,GetComputerNameW,TransmitCommChar,GetDiskFreeSpaceExW,DebugBreakProcess,LocalAlloc,IsBadStringPtrW,LocalUnlock,FreeLibrary,CreateWaitableTimerW,SetFileApisToOEM,SetDllDirectoryW,GetCurrentProcess,SetFirmwareEnvironmentVariableExW,GetActiveProcessorGroupCount,GetLocalTime,GetOverlappedResult,CreateHardLinkTransactedW,ApplicationRecoveryInProgress,SetThreadPreferredUILanguages,GetProfileSectionW,ResolveLocaleName,SetFileAttributesW,FindNextChangeNotification,UnlockFile,Wow64DisableWow64FsRedirection,UnregisterApplicationRestart,WaitForSingleObject,GetConsoleAliasExesLengthW,VerifyScripts,CreateFileMappingNumaW,RegCreateKeyExW,RegSetValueExW,RegCloseKey,CreateMutexW,MessageBoxW,CloseHandle,OutputDebugStringA,SetDefaultCommConfigW,UnlockFileEx,MoveFileTransactedW,CreateDirectoryW,MapViewOfFile,SetConsoleMode,AreFileApisANSI,FileTimeToDosDateTime,BindIoCompletionCallback,CompareStringEx,GetDurationFormat,GetNumberOfConsoleMouseButtons,LocalAlloc,GetConsoleAliasExesLengthW,GetFileBandwidthReservation,CloseThreadpoolTimer,SetConsoleActiveScreenBuffer,GetCalendarInfoW,TransactNamedPipe,SetProcessShutdownParameters,GlobalGetAtomNameW,GetThreadUILanguage,GetCurrentProcessId,GetDurationFormatEx,AdjustWindowRect,SetFileTime,SetWaitableTimerEx,VirtualFree,LocaleNameToLCID,GetKeyState,CloseThreadpool,IsValidNLSVersion,LocalHandle,DebugBreakProcess,WriteFileEx,GetNumaProcessorNodeEx,PeekNamedPipe,CloseWindowStation,BindIoCompletionCallback,InitAtomTable,AddClipboardFormatListener,CharLowerBuffW,WriteFile,ChangeClipboardChain,DdeAddData,ExitProcess,ExitProcess,	8_2_00007FF8A7308E20

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Network Sniffing	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	36 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	31 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cwqqRXEhZb.msi	45%	ReversingLabs	Win64.Backdoor.Simda

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libassuan-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libcrypto-3-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libgpg-error-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libpkcs11-helper-1.dll	67%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libssl-3-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libwinpthread-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe	0%	ReversingLabs
C:\Windows\Installer\MSI5918.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI59E4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5A72.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5AA2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5B01.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI79F4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI97CD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI982C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI99C3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIA3F6.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://search-keys.com/licenseUser.phpAI_DATA_SETTER_4Params	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high
search-keys.com	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://openvpn.net/howto.html#mitm	openvpn.exe, openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000005.00000002.2447195990.0000000005061000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBeq	powershell.exe, 00000005.00000002.2447195990.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	openvpn.exe, 00000008.00000002.2530851545.00007FF8A7B7F000.00000002.00000001.01000000.00000008.sdmp, openvpn.exe, 00000008.00000002.2531117632.00007FF8B83F1000.00000002.00000001.01000000.00000007.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2449533867.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://openvpn.net/faq.html#dhcpclientserv	openvpn.exe, openvpn.exe, 00000008.00000000.2516655394.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp, openvpn.exe, 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2447195990.00000000049A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/	openvpn.exe	false		high
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.2447195990.0000000004AF6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search-keys.com/licenseUser.phpAI_DATA_SETTER_4Params	cwqqRXEhZb.msi, 3c4fc2.msi.1.dr	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571704
Start date and time:	2024-12-09 16:34:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cwqqRXEhZb.msi renamed because original name is a hash value
Original Sample Name:	9d04aeddb08877a78c258b3ae7df42a924ae3ea12a0c7085035bb0469204d76b.msi
Detection:	MAL
Classification:	mal42.troj.evad.winMSI@10/153@1/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 428 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: cwqqRXEhZb.msi

Simulations

Behavior and APIs

Time	Type	Description
10:35:42	API Interceptor	8x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse	13.107.246.63
	Need Price Order No.17084 PARLOK.exe	Get hash	malicious	FormBook	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	13.107.246.63
	hlhF3wf7yX.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	Utils.dll.dll	Get hash	malicious	Codoso Ghost, Hancitor	Browse	13.107.246.63
	AerF91EIjj.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.246.63
	e8pLA1OhWt.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.246.63
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.63
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	13.107.246.63

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe	Setup.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	installer.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse
	LegionLoader (21).msi	Get hash	malicious	Unknown	Browse
	LegionLoader (22).msi	Get hash	malicious	Unknown	Browse
	LegionLoader (17).msi	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll	Setup.msi	Get hash	malicious	Unknown	Browse
	installer.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\3c4fc4.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	23754
Entropy (8bit):	5.820321247795485
Encrypted:	false
SSDEEP:	384:CMEkkQkfkbkkkxnk8kkLTkwkHkOkokAkOkLkjkSkGkTkqkUktk3krkCklkFkrkJz:Cjbc4PeM87EpzLpoANhwl/60I9ySI2Yv
MD5:	23D8D5BB813F37A1364D6B49838F7B3E
SHA1:	D3A8E412F6F7C6EF1DE8A0E3D6567E8C053CA80F
SHA-256:	646B4225C435120D6452DB4377FA0382A9759B3E3DA5913C31462EC2046416B5
SHA-512:	9AD7BE18152BE9E56BF124AE8D92D38096400B0F1F596BE486A3A4390B745350077C90373FD509A20C5D2E712745D5A79DF52A5601A6A360C7FD836834AC3DD4
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@wT.Y.@.....@.....@.....@.....@.....@......&.{D0265C05-725E-4038-8426-7D1D1C311BF9}..Ifid Apps..cwqqRXEhZb.msi.@.....@.....@.....@......icon_32.exe..&.{C0C9B56F-080E-4F40-9C41-BC28B95F9144}.....@.....@.....@.....@.......@.....@.....@.......@......Ifid Apps......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{4EAB000E-DEB5-4E28-8448-068C624BCBAA}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{3A93C24E-9EC4-4B96-973D-8D64785398E1}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{983AED90-5AA4-4C2B-A9F3-2563FFDAE964}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{C04AA22D-BE6B-4EE3-8C36-F938BA4CD485}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{EADBA1F2-9A40-4915-9979-43CFCD1C35CE}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{CBCD90DF-DB36-4D67-AEDD-4171F1E02C1A}&.{D0265C05-725E-4038-8426-7D1D1C311BF9}.@......&.{8BD726EB-D80E-44BF-87C1-E0FF3732DEBE}&.{D0265C05-725E

C:\ProgramData\vlc.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Jun 18 23:44:58 2021, mtime=Mon Dec 9 14:35:47 2024, atime=Fri Jun 18 23:44:58 2021, length=984312, window=hide
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	3.857634448846057
Encrypted:	false
SSDEEP:	24:8iYlSf4v9148pZ+u3JjADPrf/8ANB3XojAD/XojADrkzyxgKdu1pNYezyxg2pxm:8iYAgV19t3JcrjHINVziNdu1pNYezih
MD5:	8AD0C6AFB96F12EC8CF3C9B2FE91F4E6
SHA1:	F972F66075CAB5E8A4DE8D0BD1816E961840B54B
SHA-256:	446D4929287D007083C80171E539B67495862FFE32E534417D276C538730FD2B
SHA-512:	49A3E4238A7C872970A5872AC8D59219FE6D60D16079F67B4D63FDACC31797918025D863E8C736A18AC260364182893A86AA809297407CE3715825944BB9871A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ....a'T.d...?..PJ...a'T.d..........................$.:..DG..Yr?.D..U..k0.&...&...... M.......OJ..X..PJ......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Yj\|....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Yw\|..Roaming.@......DWSl.Yw\|....C.....................u...R.o.a.m.i.n.g.....^.1......Yw\|..GROVIT~1..F......Yw\|.Yw\|..........................u...G.r.o.v.i. .T.e.n.d.....\.1......Yy\|..IFIDAP~1..D......Yw\|.Yy\|.............................I.f.i.d. .A.p.p.s.....V.2......R.. .vlc.exe.@.......R...Yx\|..............................v.l.c...e.x.e.......k...............-.......j..................C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe..<.....\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.r.o.v.i. .T.e.n.d.\.I.f.i.d. .A.p.p.s.\.v.l.c...e.x.e.5.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.G.r.o.v.i. .T.e.n.d.\.I.f.i.d. .A.p.p.s.\.f.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.413197223328133
Encrypted:	false
SSDEEP:	24:3UWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NK3R82r+SVbR:EWSU4xymI4RfoUeW+mZ9tK8NWR82jVbR
MD5:	1A8B62C28399515602DCA9C94C2B2490
SHA1:	384EB5E2AFB32EC137CE02833466A20048E2A689
SHA-256:	B5A234A10D8D76E65C18EA63D097512F3D53FC5739EF7A8099AC8B22FA7C9F00
SHA-512:	095BD0CB3027199DDB62FFDA863673CED39884DFE0F9B9BECDF2A1CC6674D27F8AD8D0E965C1F38E4D63140F7E0DCBCA8D443E5A48E543FE0B13DA2FF2ED5CE8
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggx2bdnv.ln1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzbnbjeg.whw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\msi9A57.txt

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.1321609710832776
Encrypted:	false
SSDEEP:	3:QtFKYpjKjKDiAl35YplflPlx3lMlRfLlYplf955:Q6mfDj0L1zmDfqLN
MD5:	0CEEC7B277191690F5704147332412CD
SHA1:	5966645FF1DE4D5D04341041904237DB5B8A2392
SHA-256:	0DAD972B0FB47B02053A204ED7140073661E01D060AAC3CB1A04633A040E5C17
SHA-512:	DECDAEF6A7E7D3D79DE352E90EC15A434498B4EC32F4E70A4407867A7B7DBBFFE2705409A6F73926FD1F0440AB30F5FE5FDD7A93C3EE35B29F873A2B70C9528C
Malicious:	true
Preview:	..H.t.t.p.P.o.s.t.S.e.r.v.e.r.R.e.s.p.o.n.s.e. .:.<.-.>.:. . .<.<.:.>.>. .C.y.o.q.R.i.n. .:.<.-.>.:. .0. .<.<.:.>.>. .

C:\Users\user\AppData\Local\Temp\pss9A6A.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6668
Entropy (8bit):	3.5127462716425657
Encrypted:	false
SSDEEP:	96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
MD5:	30C30EF2CB47E35101D13402B5661179
SHA1:	25696B2AAB86A9233F19017539E2DD83B2F75D4E
SHA-256:	53094DF6FA4E57A3265FF04BC1E970C10BCDB3D4094AD6DD610C05B7A8B79E0F
SHA-512:	882BE2768138BB75FF7DDE7D5CA4C2E024699398BAACD0CE1D4619902402E054297E4F464D8CB3C22B2F35D3DABC408122C207FACAD64EC8014F2C54834CF458
Malicious:	true
Preview:	..p.a.r.a.m.(..... . .[.a.l.i.a.s.(.".p.r.o.p.F.i.l.e.".).]. . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.O.u.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".p.r.o.p.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.K.V.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".l.i.n.e.S.e.p.".).]. . . . . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.m.s.i.P.r.o.p.L.i.n.e.S.e.p.a.r.a.t.o.r..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.F.i.l.e.".).]. . . . .[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. .[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.F.i.l.e.P.a.t.h..... .,.[.a.l.i.a.s.(.".s.c.r.i.p.t.A.r.g.s.F.i.l.e.".).].[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.f.a.l.s.e.).].[.s.t.r.i.n.g.]. .$.u.s.e.r.S.c.r.i.p.t.A.r.g.s.F.i.l.e.P.a.t.h..... .,.[.P.a.r.a.m.e.t.e.r.(.M.a.n.d.a.t.o.r.y.=.$.t.r.u.e.).]. . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\scr9A58.ps1

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.531795843558323
Encrypted:	false
SSDEEP:	6:Qgk79idK3fgmfDjplXhkvKN+KiV6IrMTl0x1LlG7JidK3fclOmDF+thkvl:QPEgxkvKstrMT9NIxB+Dkvl
MD5:	EA4BD253C1500BFABE6550E439E102C8
SHA1:	A734A4AC299183E0749655492DDD0D5952071063
SHA-256:	8BC5B5F9B666FE7CFF50539329F096F2D69BA3280084FCDA670A3314896359DB
SHA-512:	449DFAFB91AC4933267FE6B94EEAF04EE870295122F7A553C8C3B26641496B36C8A764B3DACDB2EFE45CE09CD4CC880C5F41976DB62E0DAD9481D8A6746CBA18
Malicious:	true
Preview:	..$.s.a.i.f.a.h. .=. .A.I._.G.e.t.M.s.i.P.r.o.p.e.r.t.y. .".H.t.t.p.P.o.s.t.S.e.r.v.e.r.R.e.s.p.o.n.s.e.".....$.o.i.a.w.e.j.f.i.o.u. .=. .[.u.i.n.t.3.2.].(.$.s.a.i.f.a.h. .-.r.e.p.l.a.c.e. .'.a.'.,. .'.'.).....A.I._.S.e.t.M.s.i.P.r.o.p.e.r.t.y. .".C.y.o.q.R.i.n.". .$.o.i.a.w.e.j.f.i.o.u.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256864
Entropy (8bit):	6.8622477797553
Encrypted:	false
SSDEEP:	3072:rRiE8BF4JQi1a7plM/P5aef3HWxph0LR/hSMXlk4ZqKFya5XB67TDmzyJd5nJMCC:6BQ1k9GH5oph0lhSMXlBXBW/ncHfdKq
MD5:	E0BFA64EEFA440859C8525DFEC1962D0
SHA1:	4FEDB2E7604FFEB30FC0B535235BC38BD73FEA96
SHA-256:	8E1B93631C730C9ECDADF15477CCA540A45A8935EF200A435BA84E15D4B1C80F
SHA-512:	04EA18B777EACB6CC8AF9E63E33E3B5C71307A83D69C8722CEBE538D5DC681D538E731560612F8DA64413D7EDAA872C2A91AC6B4CA58D7B3561C87893D365D6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.msi, Detection: malicious, Browse Filename: installer.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K....vv..vv..vv...u..vv...s..vv...r..vv...u..vv...r..vv...s._vv...w..vv..vw..vv.G....vv.G.v..vv.G..vv..v..vv.G.t..vv.Rich.vv.................PE..L.....$g.........."!...).(..........@i.......@......................................;.....@A....................................P.......p...............`=......l....s..p....................s......@r..@............@...............................text....'.......(.................. ..`.rdata..XU...@...V...,..............@..@.data...............................@....fptable............................@....rsrc...p...........................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	506008
Entropy (8bit):	6.4284173495366845
Encrypted:	false
SSDEEP:	6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5:	98CCD44353F7BC5BAD1BC6BA9AE0CD68
SHA1:	76A4E5BF8D298800C886D29F85EE629E7726052D
SHA-256:	E51021F6CB20EFBD2169F2A2DA10CE1ABCA58B4F5F30FBF4BAE931E4ECAAC99B
SHA-512:	D6E8146A1055A59CBA5E2AAF47F6CB184ACDBE28E42EC3DAEBF1961A91CEC5904554D9D433EBF943DD3639C239EF11560FA49F00E1CFF02E11CD8D3506C4125F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.msi, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: installer.msi, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: v.1.6.3__x64__.msi, Detection: malicious, Browse Filename: v.1.5.4__x64__.msi, Detection: malicious, Browse Filename: LegionLoader (21).msi, Detection: malicious, Browse Filename: LegionLoader (22).msi, Detection: malicious, Browse Filename: LegionLoader (17).msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.}............\|.&.....\|.$.J...\|.%.....H}*.....H}./....H}./.....~P.....H}./.....~D.........z...F}./....F}(.....F}./....Rich............PE..d.....@f.........."....!.b.....................@.....................................'....`.................................................\|...........H........4.......(......8...0I..T....................J..(....G..@............................................text....a.......b.................. ..`.rdata...3.......4...f..............@..@.data...............................@....pdata...4.......6..................@..@_RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\VCRUNTIME140.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97152
Entropy (8bit):	6.423207912198565
Encrypted:	false
SSDEEP:	1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
MD5:	5797D2A762227F35CDD581EC648693A8
SHA1:	E587B804DB5E95833CBD2229AF54C755EE0393B9
SHA-256:	C51C64DFB7C445ECF0001F69C27E13299DDCFBA0780EFA72B866A7487B7491C7
SHA-512:	5C4DE4F65C0338F9A63B853DB356175CAE15C2DDC6B727F473726D69EE0D07545AC64B313C380548211216EA667CAF32C5A0FD86F7ABE75FC60086822BC4C92E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p...............................................'J....`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14272
Entropy (8bit):	6.519411559704781
Encrypted:	false
SSDEEP:	192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6
MD5:	E173F3AB46096482C4361378F6DCB261
SHA1:	7922932D87D3E32CE708F071C02FB86D33562530
SHA-256:	C9A686030E073975009F993485D362CC31C7F79B683DEF713E667D13E9605A14
SHA-512:	3AAFEFD8A9D7B0C869D0C49E0C23086115FD550B7DC5C75A5B8A8620AD37F36A4C24D2BF269043D81A7448C351FF56CB518EC4E151960D4F6BD655C38AFF547F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...j............." .........................................................0......%C....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.659079053710614
Encrypted:	false
SSDEEP:	192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA
MD5:	9C9B50B204FCB84265810EF1F3C5D70A
SHA1:	0913AB720BD692ABCDB18A2609DF6A7F85D96DB3
SHA-256:	25A99BDF8BF4D16077DC30DD9FFEF7BB5A2CEAF9AFCEE7CF52AD408355239D40
SHA-512:	EA2D22234E587AD9FA255D9F57907CC14327EAD917FDEDE8B0A38516E7C7A08C4172349C8A7479EC55D1976A37E520628006F5C362F6A3EC76EC87978C4469CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......6y....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11200
Entropy (8bit):	6.7627840671368835
Encrypted:	false
SSDEEP:	192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C
MD5:	0233F97324AAAA048F705D999244BC71
SHA1:	5427D57D0354A103D4BB8B655C31E3189192FC6A
SHA-256:	42F4E84073CF876BBAB9DD42FD87124A4BA10BB0B59D2C3031CB2B2DA7140594
SHA-512:	8339F3C0D824204B541AECBD5AD0D72B35EAF6717C3F547E0FD945656BCB2D52E9BD645E14893B3F599ED8F2DE6D3BCBEBF3B23ED43203599AF7AFA5A4000311
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0.......>....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.590253878523919
Encrypted:	false
SSDEEP:	192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l
MD5:	E1BA66696901CF9B456559861F92786E
SHA1:	D28266C7EDE971DC875360EB1F5EA8571693603E
SHA-256:	02D987EBA4A65509A2DF8ED5DD0B1A0578966E624FCF5806614ECE88A817499F
SHA-512:	08638A0DD0FB6125F4AB56E35D707655F48AE1AA609004329A0E25C13D2E71CB3EDB319726F10B8F6D70A99F1E0848B229A37A9AB5427BFEE69CD890EDFB89D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0.......S....`.........................................`................ ...................!..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.672720452347989
Encrypted:	false
SSDEEP:	192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw
MD5:	7A15B909B6B11A3BE6458604B2FF6F5E
SHA1:	0FEB824D22B6BEEB97BCE58225688CB84AC809C7
SHA-256:	9447218CC4AB1A2C012629AAAE8D1C8A428A99184B011BCC766792AF5891E234
SHA-512:	D01DD566FF906AAD2379A46516E6D060855558C3027CE3B991056244A8EDD09CE29EACEC5EE70CEEA326DED7FC2683AE04C87F0E189EBA0E1D38C06685B743C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......g....`.........................................`................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13760
Entropy (8bit):	6.575688560984027
Encrypted:	false
SSDEEP:	192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ
MD5:	6C3FCD71A6A1A39EAB3E5C2FD72172CD
SHA1:	15B55097E54028D1466E46FEBCA1DBB8DBEFEA4F
SHA-256:	A31A15BED26232A178BA7ECB8C8AA9487C3287BB7909952FC06ED0D2C795DB26
SHA-512:	EF1C14965E5974754CC6A9B94A4FA5107E89966CB2E584CE71BBBDD2D9DC0C0536CCC9D488C06FA828D3627206E7D9CC8065C45C6FB0C9121962CCBECB063D4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0............`.........................................`...X............ ...................!..............T............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.70261983917014
Encrypted:	false
SSDEEP:	192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2
MD5:	D175430EFF058838CEE2E334951F6C9C
SHA1:	7F17FBDCEF12042D215828C1D6675E483A4C62B1
SHA-256:	1C72AC404781A9986D8EDEB0EE5DD39D2C27CE505683CA3324C0ECCD6193610A
SHA-512:	6076086082E3E824309BA2C178E95570A34ECE6F2339BE500B8B0A51F0F316B39A4C8D70898C4D50F89F3F43D65C5EBBEC3094A47D91677399802F327287D43B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0......G.....`.........................................`...x............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.599515320379107
Encrypted:	false
SSDEEP:	192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4
MD5:	9D43B5E3C7C529425EDF1183511C29E4
SHA1:	07CE4B878C25B2D9D1C48C462F1623AE3821FCEF
SHA-256:	19C78EF5BA470C5B295DDDEE9244CBD07D0368C5743B02A16D375BFB494D3328
SHA-512:	C8A1C581C3E465EFBC3FF06F4636A749B99358CA899E362EA04B3706EAD021C69AE9EA0EFC1115EAE6BBD9CF6723E22518E9BEC21F27DDAAFA3CF18B3A0034A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0............`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.690164913578267
Encrypted:	false
SSDEEP:	192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ
MD5:	43E1AE2E432EB99AA4427BB68F8826BB
SHA1:	EEE1747B3ADE5A9B985467512215CAF7E0D4CB9B
SHA-256:	3D798B9C345A507E142E8DACD7FB6C17528CC1453ABFEF2FFA9710D2FA9E032C
SHA-512:	40EC0482F668BDE71AEB4520A0709D3E84F093062BFBD05285E2CC09B19B7492CB96CDD6056281C213AB0560F87BD485EE4D2AEEFA0B285D2D005634C1F3AF0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0.......d....`.........................................`...H............ ...................!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11720
Entropy (8bit):	6.615761482304143
Encrypted:	false
SSDEEP:	192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP
MD5:	735636096B86B761DA49EF26A1C7F779
SHA1:	E51FFBDDBF63DDE1B216DCCC753AD810E91ABC58
SHA-256:	5EB724C51EECBA9AC7B8A53861A1D029BF2E6C62251D00F61AC7E2A5F813AAA3
SHA-512:	3D5110F0E5244A58F426FBB72E17444D571141515611E65330ECFEABDCC57AD3A89A1A8B2DC573DA6192212FB65C478D335A86678A883A1A1B68FF88ED624659
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......Xc....`.........................................`...<............ ...................!..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.627282858694643
Encrypted:	false
SSDEEP:	192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG
MD5:	031DC390780AC08F498E82A5604EF1EB
SHA1:	CF23D59674286D3DC7A3B10CD8689490F583F15F
SHA-256:	B119ADAD588EBCA7F9C88628010D47D68BF6E7DC6050B7E4B787559F131F5EDE
SHA-512:	1468AD9E313E184B5C88FFD79A17C7D458D5603722620B500DBA06E5B831037CD1DD198C8CE2721C3260AB376582F5791958763910E77AA718449B6622D023C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0......a.....`.........................................0................ ...................!..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15816
Entropy (8bit):	6.435326465651674
Encrypted:	false
SSDEEP:	192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2
MD5:	285DCD72D73559678CFD3ED39F81DDAD
SHA1:	DF22928E43EA6A9A41C1B2B5BFCAB5BA58D2A83A
SHA-256:	6C008BE766C44BF968C9E91CDDC5B472110BEFFEE3106A99532E68C605C78D44
SHA-512:	84EF0A843798FD6BD6246E1D40924BE42550D3EF239DAB6DB4D423B142FA8F691C6F0603687901F1C52898554BF4F48D18D3AEBD47DE935560CDE4906798C39A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@.......5....`.........................................0................0...................!..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.5874576656353145
Encrypted:	false
SSDEEP:	192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW
MD5:	5CCE7A5ED4C2EBAF9243B324F6618C0E
SHA1:	FDB5954EE91583A5A4CBB0054FB8B3BF6235EED3
SHA-256:	AA3E3E99964D7F9B89F288DBE30FF18CBC960EE5ADD533EC1B8326FE63787AA3
SHA-512:	FC85A3BE23621145B8DC067290BD66416B6B1566001A799975BF99F0F526935E41A2C8861625E7CFB8539CA0621ED9F46343C04B6C41DB812F58412BE9C8A0DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0............`.........................................0..."............ ...................!..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13768
Entropy (8bit):	6.645869978118917
Encrypted:	false
SSDEEP:	192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6
MD5:	41FBBB054AF69F0141E8FC7480D7F122
SHA1:	3613A572B462845D6478A92A94769885DA0843AF
SHA-256:	974AF1F1A38C02869073B4E7EC4B2A47A6CE8339FA62C549DA6B20668DE6798C
SHA-512:	97FB0A19227887D55905C2D622FBF5451921567F145BE7855F72909EB3027F48A57D8C4D76E98305121B1B0CC1F5F2667EF6109C59A83EA1B3E266934B2EB33C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0.......(....`.........................................0................ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12744
Entropy (8bit):	6.564006501134889
Encrypted:	false
SSDEEP:	192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG
MD5:	212D58CEFB2347BD694B214A27828C83
SHA1:	F0E98E2D594054E8A836BD9C6F68C3FE5048F870
SHA-256:	8166321F14D5804CE76F172F290A6F39CE81373257887D9897A6CF3925D47989
SHA-512:	637C215ED3E781F824AE93A0E04A7B6C0A6B1694D489E9058203630DCFC0B8152F2EB452177EA9FD2872A8A1F29C539F85A2F2824CF50B1D7496FA3FEBE27DFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...h{............" .........................................................0......J(....`.........................................0................ ...................!..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.678162783983714
Encrypted:	false
SSDEEP:	192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC
MD5:	242829C7BE4190564BECEE51C7A43A7E
SHA1:	663154C1437ACF66480518068FBC756F5CABB72F
SHA-256:	EDC1699E9995F98826DF06D2C45BEB9E02AA7817BAE3E61373096AE7F6FA06E0
SHA-512:	3529FDE428AFFC3663C5C69BAEE60367A083841B49583080F0C4C7E72EAA63CABBF8B9DA8CCFC473B3C552A0453405A4A68FCD7888D143529D53E5EEC9A91A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...+P............" .........................................................0......@.....`.........................................0...e............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20928
Entropy (8bit):	6.2047011292890195
Encrypted:	false
SSDEEP:	192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ
MD5:	FB79420EC05AA715FE76D9B89111F3E2
SHA1:	15C6D65837C9979AF7EC143E034923884C3B0DBD
SHA-256:	F6A93FE6B57A54AAC46229F2ED14A0A979BF60416ADB2B2CFC672386CCB2B42E
SHA-512:	C40884C80F7921ADDCED37B1BF282BB5CB47608E53D4F4127EF1C6CE7E6BB9A4ADC7401389BC8504BF24751C402342693B11CEF8D06862677A63159A04DA544E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...IV............" .........,...............................................P.......e....`.........................................0....%...........@...............0...!..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19904
Entropy (8bit):	6.189411151090302
Encrypted:	false
SSDEEP:	384:4SrxLPmIHJI6/CpG3t2G3t4odXLhWYhWfgy6l9ne:4iPmIHJI6vZO
MD5:	A5B920F24AEA5C2528FE539CD7D20105
SHA1:	3FAE25B81DC65923C1911649ED19F193ADC7BDDE
SHA-256:	5B3E29116383BA48A2F46594402246264B4CB001023237EBBF28E7E9292CDB92
SHA-512:	F77F83C7FAD442A9A915ABCBC2AF36198A56A1BC93D1423FC22E6016D5CC53E47DE712E07C118DD85E72D4750CA450D90FDB6F9544D097AFC170AEECC5863158
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.../..N.........." .........(...............................................P......C.....`.........................................0.... ...........@...............,...!..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64456
Entropy (8bit):	5.53593950821058
Encrypted:	false
SSDEEP:	1536:Se6De5c4bFe2JyhcvxXWpD7d3334BkZn+PI5c:Se6De5c4bFe2JyhcvxXWpD7d3334BkZU
MD5:	5C2004DAF398620211F0AD9781FF4EC2
SHA1:	E43DD814E90330880EE75259809EEE7B91B4FFA6
SHA-256:	55BC91A549D22B160AE4704485E19DEE955C7C2534E7447AFB84801EE629639B
SHA-512:	11EDBBC662584BB1DEA37D1B23C56426B970D127F290F3BE21CD1BA0A80D1F202047ABB80D8460D17A7CACF095DE90B78A54F7C7EC395043D54B49FFE688DF51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......F.........." ......................................................................`.........................................0...T................................!..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12736
Entropy (8bit):	6.592404054572702
Encrypted:	false
SSDEEP:	192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb
MD5:	DD899C6FFECCE1DCA3E1C3B9BA2C8DA2
SHA1:	2914B84226F5996161EB3646E62973B1E6C9E596
SHA-256:	191F53988C7F02DD888C4FBF7C1D3351570F3B641146FAE6D60ACDAE544771AE
SHA-512:	2DB47FAA025C797D8B9B82DE4254EE80E499203DE8C6738BD17DDF6A77149020857F95D0B145128681A3084B95C7D14EB678C0A607C58B76137403C80FE8F856
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...P..D.........." .........................................................0......N.....`.........................................0...x............ ...................!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16328
Entropy (8bit):	6.449442433945565
Encrypted:	false
SSDEEP:	192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq
MD5:	883120F9C25633B6C688577D024EFD12
SHA1:	E4FA6254623A2B4CDEA61712CDFA9C91AA905F18
SHA-256:	4390C389BBBF9EC7215D12D22723EFD77BEB4CD83311C75FFE215725ECFD55DC
SHA-512:	F17D3B667CC8002F4B6E6B96B630913FA1CB4083D855DB5B7269518F6FF6EEBF835544FA3B737F4FC0EB46CCB368778C4AE8B11EBCF9274CE1E5A0BA331A0E2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...9..b.........." .........................................................@......^%....`.........................................0...4............0...................!..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17864
Entropy (8bit):	6.393000322519701
Encrypted:	false
SSDEEP:	192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2
MD5:	29680D7B1105171116A137450C8BB452
SHA1:	492BB8C231AAE9D5F5AF565ABB208A706FB2B130
SHA-256:	6F6F6E857B347F70ECC669B4DF73C32E42199B834FE009641D7B41A0B1C210AF
SHA-512:	87DCF131E21041B06ED84C3A510FE360048DE46F1975155B4B12E4BBF120F2DD0CB74CCD2E8691A39EEE0DA7F82AD39BC65C81F530FC0572A726F0A6661524F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....v..........." ......... ...............................................@............`.........................................0...a............0...............$...!..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\dictionaries\en_US.aff

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3246
Entropy (8bit):	4.313391741874073
Encrypted:	false
SSDEEP:	48:T7emiglihmWpRlH61/98BuY3SZQU3uD4Vg1lwsbJ0EcWiOr5NSr5NK3WuhYljrHN:RigQLsAiOUoeFTQUydYVrF31pwhwoe
MD5:	D329845E5D86AFEBE0DB82B3422C70C2
SHA1:	E432BEE2397B8573444ECAE348300F06AA5DF032
SHA-256:	56E2090475E1CE11A1885CE8ECE4D4B1F1E863F69A7233CC00BAF56CDAAA9096
SHA-512:	137202D74C374EC168BC64BBD0039BE2A77DC052842367550EB8E31C9C95B58585F4D3F46F72F80D4A22229C64B8600629B3FAB4F1E9E681446635E0A7524892
Malicious:	false
Preview:	SET ISO8859-1..TRY esianrtolcdugmphbyfvkwzESIANRTOLCDUGMPHBYFVKWZ'..NOSUGGEST !....# ordinal numbers..COMPOUNDMIN 1..# only in compounds: 1th, 2th, 3th..ONLYINCOMPOUND c..# compound rules:..# 1. [0-9]1[0-9]th (10th, 11th, 12th, 56714th, etc.)..# 2. [0-9][02-9](1st\|2nd\|3rd\|[4-9]th) (21st, 22nd, 123rd, 1234th, etc.)..COMPOUNDRULE 2..COMPOUNDRULE n1t..COMPOUNDRULE nmp..WORDCHARS 0123456789....PFX A Y 1..PFX A 0 re .....PFX I Y 1..PFX I 0 in .....PFX U Y 1..PFX U 0 un .....PFX C Y 1..PFX C 0 de .....PFX E Y 1..PFX E 0 dis .....PFX F Y 1..PFX F 0 con .....PFX K Y 1..PFX K 0 pro .....SFX V N 2..SFX V e ive e..SFX V 0 ive [^e]....SFX N Y 3..SFX N e ion e..SFX N y ication y ..SFX N 0 en [^ey] ....SFX X Y 3..SFX X e ions e..SFX X y ications y..SFX X 0 ens [^ey]....SFX H N 2..SFX H y ieth

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\dictionaries\en_US.dic

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	758251
Entropy (8bit):	4.79038751246559
Encrypted:	false
SSDEEP:	12288:ja/Jivuk9SBJTgI6ecuunMM9J2QX6aCYyV9KdrbHzQnkzDBfcbEwoiiJQC:IJivGTvcuc36FK9m0i1C
MD5:	3D51E0A789AD7B97307DC64229EFE5BA
SHA1:	A8665D0D492D85B3A4F903C9C4D43CC42D416516
SHA-256:	800EA3988CE7707858D97DA15228A30A7C0C0EECDC560EACE14BC0F0965A338E
SHA-512:	86BC40B7B87E15A36498F2BE31E1C05D6CBE2F4C8290FD5DC6A5D561E3F6AC8500D5F56585760582DE89518A23C4219EBB5D53BDC9FFAD121AFF9057E95668F8
Malicious:	false
Preview:	62118..0/nm..1/n1..2/nm..3/nm..4/nm..5/nm..6/nm..7/nm..8/nm..9/nm..0th/pt..1st/p..1th/tc..2nd/p..2th/tc..3rd/p..3th/tc..4th/pt..5th/pt..6th/pt..7th/pt..8th/pt..9th/pt..a..A..AA..AAA..Aachen/M..aardvark/SM..Aaren/M..Aarhus/M..Aarika/M..Aaron/M..AB..aback..abacus/SM..abaft..Abagael/M..Abagail/M..abalone/SM..abandoner/M..abandon/LGDRS..abandonment/SM..abase/LGDSR..abasement/S..abaser/M..abashed/UY..abashment/MS..abash/SDLG..abate/DSRLG..abated/U..abatement/MS..abater/M..abattoir/SM..Abba/M..Abbe/M..abb./S..abbess/SM..Abbey/M..abbey/MS..Abbie/M..Abbi/M..Abbot/M..abbot/MS..Abbott/M..abbr..abbrev..abbreviated/UA..abbreviates/A..abbreviate/XDSNG..abbreviating/A..abbreviation/M..Abbye/M..Abby/M..ABC/M..Abdel/M..abdicate/NGDSX..abdication/M..abdomen/SM..abdominal/YS..abduct/DGS..abduction/SM..abductor/SM..Abdul/M..ab/DY..abeam..Abelard/M..Abel/M..Abelson/M..Abe/M..Aberdeen/M..Abernathy/M..aberrant/YS..aberrational..aberration/SM..abet/S..abetted..abetting..abettor/SM..Abeu/M..abeyance/MS..abeya

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\clipboard-40-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.328040373865125
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKEk/2wqNmEyvsYEE3r7UXGEoW7yR/bp:6v/78nMtIj9yx/6cl1
MD5:	C58286125E5CB909DAE9107DFD8F2006
SHA1:	21380AE4E18FC176759885416684A0B19C7F7C82
SHA-256:	A65F53D774AFC38308625E6C165B2EAD4F1DD03D25896548B42F2F21CF901D2B
SHA-512:	4E00ED5AC90F78C62BE0507A2DB2ECD57F4505DD79870AA4C1BF485B13E076D5CC29BF4EC9FB0625FEA9F186BF0C21C5F5D7D40BBD6A14C4CC9C6D840800FE1C
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`......%..w..v&&&A\..N...ey........&.-..... 6L.++..... 9...Z......\|......n..Tl..1..PO...!...../.O".o.....j..x..g..3.4..033K..2.!R S..,H.....l.......IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\documents-folders-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	294
Entropy (8bit):	6.181656360209844
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKahknMBpLYoTn40eWuD1hidlYfelDblbp:6v/78nMtehFBpsWnLuDWvYQf
MD5:	09C1CB2C3931F1E4FA7039678026BFAC
SHA1:	72526E215BA70B6C0C53A14E30177B3C9C9B3AC7
SHA-256:	10E4A6EB6992319CA1EB35C7366E3B7A6F1ECA743456282DCF64E76528705D23
SHA-512:	79C273D66BC3D650643EE84C9C3BE4438848F23DFAB09EF345F93E45EE440147B858E4556B281F166A0640F6EA65A3D8F8D660B2466C9F7CE63DA42035C50E30
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..A~.Z!...\.(_.......4+.+.'....,.0.d.>MR..{..%....F3...<..Q.LL..b(.!d........s.....6..h$.... -!y.....e.L......5......Ib.8I........ddg.4...d@.J...@......W...N.r....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\download-folder-9-32.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.2752538251619265
Encrypted:	false
SSDEEP:	12:6v/7iwnMtI5NdBM926zd5296hYRSOGdZret7SnP4BZKPw2n:ckANbMH2OASOG/retb6
MD5:	CBECFA8E3A39AD187D0B5B611E8530D3
SHA1:	1F98EC988EB2326A7905EA0CB0DADB11DFF98456
SHA-256:	9B54F74F911E5F78A187B52EC94F2049180BF2FBFD043B3E56E5F1D4BF6654A0
SHA-512:	F68AFB9275F37AA3FB42879D0147B30367A8CE15DEDBC967557D9DEBE12F649665D6E86F32BE3E66640FE95243F7A275656CB5A440A6676BEC74DD2041F5C8CC
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDATX.c`..P...)!&.IIN......\XQN..H.H=U-W.....b....gee...@>".r.....H....v\|.A...c9)....2.Rg.......9...d,+%u...Ev...s.JH... ...W8.....3.9@NZ.6/.O<..O....CR....w...,..a.9..-.1.l....r".%(.:@^F.)zV......YI........O3.(......,."....+%.....2....Q...N.....H...PjeeaQ.......:d%..$...r.....L....b.HKH.G.........@1.t1`H...@_.cbb.G7....Q..{C.4 &"..T....,.j.....$.r>..t.gC%y...\\A.,.....&..Tw.4G.....e9..w.(+.k.\#.h%V...........Hv3...4......De.j....0..agg7gcc..f.c..DT.....P.Q.$....L.......F...P..#.v\baFk."..(h@.%P"... .@f....,.....Hp.3E$.....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\employee-id-1-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	329
Entropy (8bit):	6.420308355307663
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyK2z8phbkbsxZG9leYdylfqCJ+k3iIp:6v/78nMtqYPoNl8fqCJlii
MD5:	0674729E929FD791FC0D0AEF5B2FB5D9
SHA1:	0A321E40FEA01E9FF341BAF78FCEE0D81963D84C
SHA-256:	CF909DDCDF9BAD76EC0640275CE54B73F20EAE0A5E80ED7DC9F48AE982ACA8DF
SHA-512:	59A317D283E2638593A82E149BDC3B8BC7E9FF0F5A575F3BC51845FCDF01174EB1E4B498C9B21897B73A461A1B2F9E068168920EF7A98F593DA61A99A83F15CE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..........A....'P.W...io.;.....@...2.&.R..YAV.5.bl. .Az.6cS...".fcc..f(P.).Y.. ,)..KH@...Allj....q.@..k....%X..II.$..B.J..F.F..fFFF...P..{.3...@.......^.F..V.@qIl..L.l&XS"1XA.......I.`p....^..>.......IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\eraser-16-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	324
Entropy (8bit):	6.491766680808101
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKll8n/sk3c7jBQxWgqbrTSMHmxHuESGmO2+vi8A9hN/sup:6v/78nMtboUKcuWgqbf5EHLSGmS6jD/N
MD5:	59CE25E2011AC621D8C76D5EBC98E421
SHA1:	27D9D254EDE7482CCBAE645E52CBB2BFB14EAB74
SHA-256:	5BE77F5B2BB5A057E27733A28E36E535076D2EF12A6263B13D2EAA6ED9E59B09
SHA-512:	3934D94EBC886D6386272D33782E8A7833945725AB227F3CB854FB2185A0539F2E43E9EC9E85A595C73F73E6BB57B289200A7E15F02240536ABF24CEA752603D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c` ....9.........DD.*.+..a.I.sdk&..l...9K.f......!.h.ax..4K.K.$..`.s0012r.8..2.A.qqr...YLXd..vfff1.. .@-..o.4......!.5....L.!85.0..$&-!q.(......#d.@C...........4.Y3.e.@.<........37..H3.:........n....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\fonts-folder-3-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	267
Entropy (8bit):	6.19077973468042
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKzEj/0GGou28UK+L+WVmMFntkDqnXEuOp:6v/78nMtih228RnumMV+DqXEu8
MD5:	4E4AB21E8FDEE3C90C277F6EC23BF8CD
SHA1:	2CA13EA94FE3CAEDAB3A2BE44FC18CD2A523CECA
SHA-256:	956D447717A91521D4A0B48486189795B0F0E83F11C05E32F8FE666529D040C3
SHA-512:	EC6CA34F6D975D1E3E433D3B8BA9CCE9FB6742D3F17B2DCC27B7201A98EA23479C33FD209B2584A8F5C633B97802D757E4D2BC1397FA7BFA3D802291D699C78D
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..P..}.,...............M3..4@H@....8.?fffqJ.@.........0.:>^....011.......f.V...3.*..h..c...p1.....$A.#clj.z...@TB..P..%O..2.......sET....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\list-document-32.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.83761150187215
Encrypted:	false
SSDEEP:	6:6v/lhPKwnMRtyKIj7eaYGwoGn9iGUl/nf+wB417DbsLRtAJNfEYopHnt41dSoEs4:6v/7iwnMt8jsoi9lkwDsAsYopOdt7SaY
MD5:	09EFF4F4D770599A874BC2D94065A8CC
SHA1:	265B40063ED9EE376C5991AA39E5772AD68C406F
SHA-256:	A9238998CC2DCF53933685F7D92686C81F9433167087AD4820E121FAAEA460B5
SHA-512:	C3E01B97D92C5AF4F6A023374D4EF8A23BACA485DF82A2ADAE753650062FE857CA2FECF5AC33E720F8B92C2AFAD0C2FCD5B141475C11FD451C6DB82A9D26A349
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<...JIDATX.c`.L...+PAF......J....Gq..lll.$9.....?B..-@...r..-.c.Q......4w....=.....!A..@_......}lj...Zh..i...0s..].+M...>M..L..@...........M.0w..Y....M...r.0$....C?...@....."..-M...0G.B...@4]......y.[.....a.. *$<....MLXd... +%u.9=.S.]......`..4.....MRL\|.....s.0{.%....9...3.y......$..&B.(.M...p4..&.....t.00..8........r...8.0....;zg..(....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\safe-31-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	374
Entropy (8bit):	6.671134871061204
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKKy/nDjX8HfN2qmvwKliLbUpyfp1HZAp8TFEWdp:6v/78nMtOybjsHfN2ikinU6p15dKWz
MD5:	4A4930AE3498DCE09DDD80775E1FD7E4
SHA1:	548E0FCCD0C382778F26D2DE411560B30BF23ED4
SHA-256:	C21F5FC164884D7AE90D306B8098CA4A4FDDC028D63B04E75E06823293960D3E
SHA-512:	68ED2585AB02E9B3ECBC481C55FF3B42721D9689502A9E0FBDA162FF8C9AF78FCD98B0DDA683EE1224A14C5543271DC953CF788F5DF8AF38AD757CD81B88A6FE
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..&F&^A~.z!...b0H-H..X3.......r0.##...4r...c.9..Q..}.r..3.,.............@.s.s.r..[.K.<.i...4#.%$.1...Q..D...$'......B........I2...Y.$.......b...j..X@......b.....>+..}...PC&)..&)..r....y....N...}J.f....A....Cu::...p.I.0.<..P.=L.............IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\star-folder-1-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	301
Entropy (8bit):	6.433970126002673
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyK9Ej/0GGou28UKwrQdo/0ek1kCjFO75gD5NhUmuVp:6v/78nMtsh228RwrQq/Vk5O+Dimu7
MD5:	6212A7A0F72777E1702FF69655C11014
SHA1:	340F31181297EEFD1E7C710A53D34812F3FE5586
SHA-256:	5E0D0CC1E5A7CCDF0754A131C00FDEFB345E763047D00CF458B485A660F8C961
SHA-512:	819DCB658A57907C700366518E19814D2FF57DBC0902843FD1E5C0D140AEF9163A5EA0370A98EF93EC4D997DA362A96B9D204B30C2F45249B00BB2E92AD05FE8
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..P..}.,...............M3..4@H@....8.?fffqJ.@.....xy3....D3V...\....x.......h...#.+.....r.P!....$y.]7Ia '-s...Y).KX..FE&.....\|nN.?....+PDHh..h..<...8t....<.J.......sr......IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\swatch-1-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	275
Entropy (8bit):	6.241760254713669
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKxWuGoM+kPJzlX8jjbnbbvkLV+Vm+p:6v/78nMttpM36H8LV+Vms
MD5:	F7515A8ECBF2AA3AA9C57DFF3B05753E
SHA1:	F51571132ADA200E233E5279014F6E396800C8C4
SHA-256:	5BEBE21F8829533D8118E9B47DD49E2317C735A472477B583211670782312665
SHA-512:	9AE9D82588858A39C6B56B99AD2703CA2652EB99358B234A632D47C38E1FE48E1548DB7CC763352FA1AF4E49B0A4CF3DDA9B8425BBFC94FAC4B7D1E957294988
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`@........B.....$..CW...e.*.+...j.`..2..f...U.0..D..!..V.....`.@~... ....."....5.....(6...m...$F......^@NHD....(N. ..(dg&$....... 1l6..Lc..:.qo....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\sync-folder-1-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	358
Entropy (8bit):	6.674957154010901
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKaX2j/0GGou28UKztI9ohN9y6EHnqywm1jgWHopHbp:6v/78nMte0h228R5mvHnRwpWHopV
MD5:	D0301F65CE574CFB8601F381A04FC2DC
SHA1:	B970384F7B4D11280A41498CD99B73FFA8EED575
SHA-256:	D1E2AA31652F8CCD1F8C6BE5F7DBE5056407DA790EA8604BA776FD9856546BCD
SHA-512:	17CE1CA8593D575544EFDE570A30BD5D78DD7D35FF03C25D990ED11A5521D95BB6FCB7FAE899D93B7C46C8F5CC7C2533763A1D4DF31D7CFEDB8256801D0AEE56
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..P..}.,...............M3..4@H@....8.?fffqJ.@.....E..&..... 1.Q.5.j.xy3.......U..,...N._....9).[ ...2.ab....0... #)u.......d..4@DHx0j...{.."V..l..$.(..WL...LL.r...ar...I...p.....n...,.0.XYY.y....L&)!...L...BrR......=f.Y....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\text-document-10-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	282
Entropy (8bit):	6.2049316386300095
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKOhknMBpLYoTn40eWus7vrGVr3gWndp:6v/78nMtKhFBpsWnLusHGVrgWz
MD5:	0943B8C4B397211B1C73B2288D2B0655
SHA1:	2437C95E1CBDD6240D84EEB88C57CAFDFA5AE792
SHA-256:	4221BB09453A0ED7183FB675B374F17B5F28BA7097AFBABBCCEBBB05EC557911
SHA-512:	DF7BF3F6DEF5CA7E227EB2BF3F1E313F066C3AFE178D584860D6D6325B03DBFE6949C0C72643C3E0D8748767182892D7FAB4D090C1E86FC7D1911D58EF13FC3E
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..A~.Z!...\.(_.......4+.+.'....,.0.d.>MR..{..%....F3...<..Q.LL..b(.!d........s.....6..h$..I5...4@BTl-r....W.d..]...>....... %3!.P..?...T"1\3.t..Wn%.....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\icons\upload-folder-5-16.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	325
Entropy (8bit):	6.5022763903385785
Encrypted:	false
SSDEEP:	6:6v/lhPUnMRtyKFEj/0GGou28UKs/5Ln9R/ZVfFMXqfXMsnM2Sup:6v/78nMtkh228Rs/550yMshSc
MD5:	ACFF953EC211AF6260069114D88B5D5E
SHA1:	DBCCE1D8B99F2AAF2411FAEE55885CE4B0C87343
SHA-256:	67D52CE987D7BB34817359BB689C69DD769FB3D147D136C65F16F94FDA16E2EF
SHA-512:	6C069BA0EB35774A23A3FB8B46119069F510AD7F0B3F9FB5B98E3667C91EDA0E4D5508E79480010B829C86E35B7A62CBAB6B0350169AFF8FA58CDD5D7869D650
Malicious:	false
Preview:	.PNG........IHDR................a....gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....IDAT8.c`..P..}.,...............M3..4@H@....8.?fffqJ.@......Q..}.K...7...\|<.i0o....cS#./P...n.......I&..i....\VR..A.8..A.....`....;A4.7w$Q^.%,.. ....W...=.......L\.XXX.XYX..F#>..JH .J...IVR..........4.....IEND.B`.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libassuan-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	158192
Entropy (8bit):	6.276215721465373
Encrypted:	false
SSDEEP:	3072:CHpTY9D4S6S8AFezF9bqtdf1i+PTHnlLee0cw1XbCzoll1e+Asrm+P0w:CHpTnF+qe3yCzolfe2rm7w
MD5:	04932B84E5CD4EA826840EE8EDE549B0
SHA1:	6FE6F09021D4341537EA0C9010048D37462A0782
SHA-256:	74DF283D6DDE5FC5DB3073619F712A80C9DEBE38291D3EF91EDCD3C220601407
SHA-512:	35E5C73E59785DF4E30BBE0B8B27960C9F38E3CF4944E0470622DF20424B421387648172427C17AD3502FAC3E2DF4D1C21F2B9B1E5261B6707A528D79F9F3C00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...#.....:......P..........e.............................................. ......................................`.......p.......... ............>...+......................................(...................(t...............................text...............................`.P`.data... ...........................@.`..rdata...*.......,..................@.`@.pdata..............................@.0@.xdata.......0......................@.0@.bss....p....P........................`..edata.......`......................@.0@.idata.......p......."..............@.0..CRT....X............2..............@.@..tls.................4..............@.@..rsrc... ............6..............@.0..reloc...............<..............@.0B................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libcrypto-3-x64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4700448
Entropy (8bit):	6.762778198451197
Encrypted:	false
SSDEEP:	98304:GF+qQZELs+X7bVqGoFkzfwnxPhSVM1CPwDvt3uFGCCLh:a98Ks+rbVqGoFkzInx11CPwDvt3uFGCq
MD5:	D1229452CA48896B048BDB0D12A5C505
SHA1:	D2B73383DDADE5BBD42669049BFB6265892572B7
SHA-256:	D9E31123FB00BA631FCCD9E697CD5F4DA4A4D09CB62F5B6F2F4C49EED8A8E27E
SHA-512:	5401A94C8E998A6259AFE7AD930E914CA3F5AAAED4F706EF6151136E568B06BA8C3BB27AB04F95CBBB40FC879A75C0B7C442A586D54816E7109F8FB2755BC6CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............vI..vI..vI..I..vI;DwH..vI;DsH..vI;DrH..vI;DuH..vI..wI*.vI..wH..vI..vI..vI.GrHl.vI.GvH..vI.G.I..vI.GtH..vIRich..vI........PE..d.....f.........." ...'..4...........4.......................................G.....G.G...`...........................................A. ....TD.@....@G.......D.HI....G. )...PG.\.....?.T.............................?.@.............4..............................text.....4.......4................. ..`.rdata.......4.......4.............@..@.data....t...pD..J...^D.............@....pdata..HI....D..J....D.............@..@.rsrc........@G.......F.............@..@.reloc..\....PG.......F.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libgpg-error-0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	252912
Entropy (8bit):	6.26449546686269
Encrypted:	false
SSDEEP:	6144:azN0KgZEaVmFI2qmDsHVf1JJKDo7wv52DP3dBrmSF:m0KgZcFIHmJU1BrR
MD5:	EFE675C00C0543DD08AD96E4D7DD022C
SHA1:	539A1724C5DB6279D239E28BF0BC1D06751CDF02
SHA-256:	EF3A3677540AA47F1543C475E4531CE8BE0C70FBE3B75957C0AD6A0993A4ECA5
SHA-512:	9E35D053D2C2CD5B3A70ECB88023B3854A7837D4FD0498622C9238A5D8EC0E2DDD51070A8525E2ED066B76E67FFB4602BBE7BBF1057D23373A71287AE7B2C126
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...#............P.........(k.............................0............... ..............................................................P..p .......+... ...............................B..(....................................................text...H...........................`.P`.data...............................@.`..rdata..............................@.`@.pdata..p ...P..."...6..............@.0@.xdata........... ...X..............@.0@.bss..................................`..edata...............x..............@.0@.idata..............................@.0..CRT....X...........................@.@..tls................................@.@..rsrc...............................@.0..reloc....... ......................@.0B................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libpkcs11-helper-1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1338880
Entropy (8bit):	6.763525768084445
Encrypted:	false
SSDEEP:	12288:jObPlLMRvGUu7Yvhml/vbtfeu+Vpd57t4CH+FTl27+OPpvJMY/bgpTevdNSgZUL:6/DtfeuGB7tHH6mpvyeU
MD5:	620AB43D26993ECF4FDB7DE335DAB824
SHA1:	1BE53B4BA81ED9BFAE9197735ABC6445D827A003
SHA-256:	E5342CB5F415A5E99249170B334C5360454E49848142F02B4AB697DD81F8EF88
SHA-512:	718501D4209A706B81A8C1FB3E4CFD12055E7E62ED06BBDCD2540E2B4105C5A09E9A87C9477F771E294687E25D3698DC0AB1A2E43B70DF32145D59B2D38BDEFB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....]Og.........." ...).h...T............................................................`......................................... y...........................u..............0...0...........................(.......@............ ...............................text....f.......h.................. ..`.data................l..............@....pdata...u.......v...2..............@..@.udata....... ......................@..@.reloc..0............Z..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libssl-3-x64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	829216
Entropy (8bit):	6.300815379570505
Encrypted:	false
SSDEEP:	12288:/qxOwtce9UEE1KK2+SwtLde4UE8b35Vv8RAmpdEVB3SP:/It9BE1XYZJyxdEVB3SP
MD5:	18232E66F7998529421B051E678C38A4
SHA1:	3C040DA458F9231D3077193AC4A1F68144B8E2C2
SHA-256:	B9E15674A3DC28D604F3A03398F2F421C3654C1376D5AAD3A4835538E1C61F1A
SHA-512:	31258C52357B648093AD9AEC5760F0012202F596DD14F6C3A50DAC37286CB811F0CCE3BC418502767686FC199679DDC8D1F3DC790F19B8040D0229BC5DB636A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q..q..q..x.'.c...O..s...O..\|...O..y...O..u..:...u...L..r..q..*...L......L..p...LK.p...L..p..Richq..................PE..d.....f.........." ...'..................................................................`.........................................`0...K...{...................r...~.. )......X.......T...........................`...@............................................text...(........................... ..`.rdata..............................@..@.data...8=.......8..................@....pdata...r.......t..................@..@.rsrc................b..............@..@.reloc..X............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libwinpthread-1.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	66544
Entropy (8bit):	6.309954882128114
Encrypted:	false
SSDEEP:	1536:Xoun2j59yXrmGv5jqGcZJt7im3YtQrmEKP0m:XUyhAJt7im3YtQrmEKP0m
MD5:	4F8C576F1515282FF03306B01DE7F75D
SHA1:	52CECE362F99E1B65732F54275F9CA984338882D
SHA-256:	C27F1770F0648A3FEB826C6D480CECC37D8D807F193F45B721EB466688FF3998
SHA-512:	7DDE6F439314C79C485A3B2EB7213FE17FC822377984B77CFA4012E2AB0BAC4C0A5B2951727497D2017DBA2140646E71A169BFA720E0C19D54FE4FF81552E59A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...#.....L......P..........d.............................`................ ......................................................@..P.......P........+...P..T...............................(....................................................text...P........................... .P`.data...............................@.P..rdata..............................@.`@.pdata..P...........................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....`.... ......................@.@..tls.........0......................@.@..rsrc...P....@......................@.0..reloc..T....P......................@.0B................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.base.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	18367853
Entropy (8bit):	7.968497771189572
Encrypted:	false
SSDEEP:	393216:BLz4LssSDaG2WEXljHcVPZBfJgPWFp93OKqNZNJyXgjrHKzMR:CLJSuCCVHaiPWFpkNzcXgnHKgR
MD5:	C6C96A3F5AC8A949A7F920D83D4C8B3F
SHA1:	2D6B7E5973DA5B3A469C4D6B426A02B7AA4FF9E2
SHA-256:	753BA6FDC8F9C1DE1627D0ABBD03E97E2E97AEF3E5823A6C8C036B68D48C301E
SHA-512:	EE9FFC7C6B996B9DD9421E23444F9F3D72E002E6CD50E7816325DE7392E49240D6B239139D5C2C7F7FF01EDE0F35077B95C77C60995E94405A38E1E8F5B263AB
Malicious:	false
Preview:	JM..PK.........o/Q................classes/module-info.class.9.\...o....@.(D...= ..hP....n...yw4.`.Q..5v.^.+..#.b.b.Fc..!...=.....~7.;3.y3.f..K..&.t.....3..\.F.6...R..!Oa.Y ...<.5sRR.H.m.!.@.(.:.9M.P......h2.kT.IF\.xY.fN.f.X..z.V'#....)4...)N...$.q."+.T.z...Z4......Q......-2.....}.!.....VPHF....&N-#u.x8....g..N.[4:...UZ.kI...@..O=.c...e.R.....-..6.._.e2.i.2....7.j!.Lf~..V..a..@.~<E..U..Mr@)X..IL. Qa/.%.iZZ..n....Z.t/...ei...#^..p&5..P..2..FN)#..f.p.8I'.z.. B.R.j....?Qg.A...w...&......J..Ng4.X.....f.6.q..e.,.d.e.,....Jm.x/...~y...A.A....).AkP..)..JE..4.Rp.~V.)>.......2qI\...t.6.lU_@YL...5.q..(#_...).......q...W...M...L...:.....\|.....o6...$ ..!(..V..SeD..^y.ZC....Z.#..A'..31.mH.....%..(..TAu=.!f....`.h..H...e...q.$./..]{....M....x.2M...q.1@..KR.X....,.B.ed\ys..rBy$!.&.G..<.Y....M.h...S.A..0..M....s*...\.^e.kg...,j..........%$%......6..ZcF...<.5.....`0%)..)..3.D.k.`Y.....P.....@..........p....[..........0.Y.j....d...Z..U\|`83f.0W..Q.8..U..i....[.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.compiler.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	124409
Entropy (8bit):	7.718272830707501
Encrypted:	false
SSDEEP:	3072:1i6Z6wsvoYmg/SeP7rXuLU20fGqZLdlC8IvgvGR:7XsAySk7rXu+fGqZLdlWvCGR
MD5:	5A4FE8E78A6C9254B36919DA9CE7799F
SHA1:	27276BC48C907C856F0EB72CF6F3A48FA3A92E44
SHA-256:	44E1E786291E335C6E4DCC9B2EACA365F06EEB8534A0CF8912DAC550091C4F46
SHA-512:	5C8B22AFC7B07B8DC595E6998819A4544603B6A8B3100EA653F42826B340C5930A872C01BA90269A783FC955C7024DB26088D4333D22DE5A632B0EF4734D7CD8
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmP.N.0..-....P(...P.. q.q@BB.?`R................av=3^.....;.3...e....A[ Bg.p.. 4..x:....{(............t.@+w.kO&I.\|...+..P..eh.J..f]..H..F......si.......l.(..j.&6..U...Hd.=.hMw/.......LY...UX.9.X.ma.P..Y..+&x.7fO.V....I.2!4.bb_...E.fz..E4;=^.%\|.2...7.........%L.e\5...-....U..v0.84z.......80...PK....mp2.......PK.........n/Q............;...classes/javax/annotation/processing/AbstractProcessor.class.Xit.....%{$y...N..e ....&.....8.1.N........D..3#..-;..JI..RJ..6l.F...ZJY....t.....R...l......9>.....w.}W........J.P.TQ.2..;.a.1.[..[.w..O...Lo.@ ^..F.a....P...#..e...v..&...w=GOx[.K.#P.Y.z..H..>)}..J.....^kJw].y..".b...@.L.3..xFrKZn....j..U,.B..".....~.....$..z.H.j..",Vp...p2y....L5v..^..C.j..u.....T.&P:..2.@u....q.C..CX..I.O...d.n..!.U.V .;.....Uh.O..o...b....K..A.C=...\..F...2..B..W}.W+U..U...k.....I..Bb..!..m....Qq.V..8n..*...u}. r..N.d..9...Q.V.yX'.8{......,......M..+..o.j.:_....%.7.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.datatransfer.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	51389
Entropy (8bit):	7.916683616123071
Encrypted:	false
SSDEEP:	768:GO5DN7hkJDEnwQm0aCDOdC4Lk1eo8eNEyu/73vVjPx5S+3TYWFwSvZt6xdWDvw:GO5h7hkREnyvo8QBuDNjfvD1/3vw
MD5:	8F4C0388762CD566EAE3261FF8E55D14
SHA1:	B6C5AA0BBFDDE8058ABFD06637F7BEE055C79F4C
SHA-256:	AAEFACDD81ADEEC7DBF9C627663306EF6B8CDCDF8B66E0F46590CAA95CE09650
SHA-512:	1EF4D8A9D5457AF99171B0D70A330B702E275DCC842504579E24FC98CC0B276F8F3432782E212589FC52AA93BBBC00A236FE927BE0D832DD083E8F5EBDEB67C2
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classeP.N.0..../.$...pAM.D.p..!!..X...m.d'.....P7...biw..Y.?._...pM.m..X.q..2.D8o...o.0.J.s...,...".'..>..F..r..M..G.L......!.je.BG....:v.;..a@...Y...3..?.Y....\.m.).CBwn......'.N..+G+^#.j...R.A..qV.1o...p.....\|._.-N$.!.;X....\|....G......qi.W{PK...^0.........PK.........n/Q............-...classes/java/awt/datatransfer/Clipboard.class.X.w.W....c...-.Ii...#.P..........@(`.......3.....R...........<....h..W.z......=.=~....l..DN..............;y.@7..#....2.P.._.WR.b.Km..f......9w1T...A.....d..b.r.Ie.Gq,..U+.kcC.be..eTe......K3.usU.2...Pe.4T.aYz....>!..q..3.dL.Q..fh/#..P.t.;.f,.."..7..v.(..K7}.2nZ;.Mg..OuzU..c.....!wR.xz....7...tG..d.ED..3...fs.{n\...x...r.!.#X.6.Ke.v........1n.P......#..P...J....)^.dt....k...k...F5...e$.d...=~Do.t.2....KX....B.#Ha..U2n.j...+fh&....&.zk,.....>...aQ......kj...:.h.Q.uTv.B ......N......r'..x..D.4.`k 76fZ....fG..#.....7.4.:w..6....#...x..>lfh.B'.....'l..V.....5..H..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.desktop.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	12133334
Entropy (8bit):	7.944474086295981
Encrypted:	false
SSDEEP:	196608:h6fa1BzmQR9sZTGVq8B4ISiOCC0SabOyigGRA7OtuPZIWeXB:6a1gk+8B4IS8S2OyiJRA7OtYZaB
MD5:	E3705B15388EC3BDFE799AD5DB80B172
SHA1:	0B9B77F028727C73265393A68F37FC69C30205BD
SHA-256:	BE59AC0E673827B731CF5616B41DA11581A5863285FEA1A0696AA4F93796BCC3
SHA-512:	CA44B3E7658232FCC19C9AD223455F326D34B17384E566B8CAF0F7409D71B2B86F4089BF4A35128EC6CFFE080DF84C69C72C22B230FB0F2F8CB345442318F737
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.X...e../.l.!..!.#..M..."..g..#.B.........0;{.AAD.EE..QQQ.aG....{.]....7......~.{....k...{....<HD...4.......x%?G.4_St.Z...\..].+c..t.t........iC./...gZ..].8C..D'M...\3.+~5......z.<.f1..2.v./.As.Lv.....`2.M%...d.h..S`....YC.....D.u0-l.V#.5.,.e..)[..[.v..............d.I...A........A+&."..8g.)"..E..1!.Z.]....Ak..5.......<'..L8bC..V4.U2.~$...i....)."I...O...d:......@..S...w0m...-....2..x....z.....O....k.8.}....P.....=..I/...<../.d..k....43VL.i...........C.S\|`..!b.8....3.Ey..S..e..+.../T..j...g..B.@q9.."..>.LU..2-i....-.!....Z....g.BGl.j..R...Z.D.YJ.Kd...9 l.FN4.Rk.22..b..Rn...u..x.,...j.I.aZ.....X[{L.e..Z#..`.Z...8..[.p..0.(...j..W..-M...V..H7.c.KN...5e.."...t[um..R...UF.c..1.....z\|z.EeO..j..k.V..\x.8.....et;.9.^.Pa..+......U....Iu.q.t....HY.g...q.......omK...FKr1.F..F?.i.d../.]....68..L.........W..s.CU.\|y.....zE..Q\...82..W.i[.#Q..xm......P..u.<.#...yC...,........~B..\|sF.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.instrument.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	41127
Entropy (8bit):	7.961466748192397
Encrypted:	false
SSDEEP:	768:L0xH2Z5C7/c8GqFsHWShYYptTpmPSB4gTQSq4Yz1jHoAsbjX:wxH66/crqiH3tTVTsSVYz1jIAsfX
MD5:	D039093C051B1D555C8F9B245B3D7FA0
SHA1:	C81B0DAEDAB28354DEA0634B9AE9E10EE72C4313
SHA-256:	4A495FC5D119724F7D40699BB5D2B298B0B87199D09129AEC88BBBDBC279A68D
SHA-512:	334FD85ACE22C90F8D4F82886EEF1E6583184369A031DCEE6E0B6624291F231D406A2CEC86397C1B94D535B36A5CF7CB632BB9149B8518B794CBFA1D18A2478F
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classU.M..0..../..........LL...A.$.t.\x..e,U.N.N..7o.....=B+..,.@..:.`.....`....L.,.".B.M......:...._..uBGf.5.M..g..."..8K\..B.".z..\|=6.=1.KB..v,.yJ0/......[.r..OU`....Q}...kP.94oh...b..K{...].'PK........#...PK.........n/Q............2...classes/java/lang/instrument/ClassDefinition.class.SMo.@.}.8q.4M.@.h..b;... ..d.RP$.c...#g...#@.....@.G..........7o.......@.-..J.T.eT..'.......tt.=.P9.C_t.J.5... ...Y...z\|.(..TE...e.....(.......v?pg....<...I.1.:....H.U...1.)..p...P.......\|...04..Q..2...%..8~.......#..p"...n..<.Uq..=..:.c..1.2...x.o.w..#....^?q.I..:..Y...6...N..c..>2.k.U...L..&V.H...%....y...[.~GJ...B/M......%...t....+.I.E....H..}....m..j_..8C...:.n...(*..z..Z.Q...$....a.}..T.xW.$....52...T.o..mSL_~.L.FM....W.z.I.]....)..e.....A..$..xH...Td...0i..."...0X....PK..X..~........PK.........n/Q............7...classes/java/lang/instrument/ClassFileTransformer.class.S.n.@.=.8.M.n..b^-/..G..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.logging.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	113725
Entropy (8bit):	7.928841651831531
Encrypted:	false
SSDEEP:	3072:6jB5A+VPT8IdtpHAUfEzhLpIrxbt2rlnH6:6ZRTPHgU2pItshH6
MD5:	3A03EF8F05A2D0472AE865D9457DAB32
SHA1:	7204170A08115A16A50D5A06C3DE7B0ADB6113B1
SHA-256:	584D15427F5B0AC0CE4BE4CAA2B3FC25030A0CF292F890C6D3F35836BC97FA6D
SHA-512:	1702C6231DAAB27700160B271C3D6171387F89DA0A97A3725B4B9D404C94713CB09BA175DE8E78A8F0CBD8DD0DD73836A38C59CE8D1BD38B4F57771CF9536E77
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuQ.N.1.=W......n\1.D.5$&....T...2%....\..~..3(......9.6...o....%..:L...x.=..p..L.......".Gm........Z9.R+...}x..$.Y,,..-..z..{.v.K..:9m[.dl....Q#t..F$:5c..h..^x".8 \N..A!....O....@.0.Z....p]......0_(.mB...=.J..<.k"4....g<......M$,....:Kz\|..^.........8q..{...}.G....p.S.W...l.M.....PK..R...).......PK.........n/Q................classes/java/util/logging/ConsoleHandler.class}S[o.A...KW..jk.....jy...K.b.R.mH\|.......2.K....h...G..,..K...s..r......7....d.u....C...y3..j..2...1..!wx..2T:.T...b.^..`.D[...0....n.cXy#C..e...=.E.....]..%L..<x.....W........z..u.s..a.e..Zq..-.E@n.!..)....F...\.E...<...[.;W..t.i%.mT".w.x..(.m,...r.....tZ..vPepFI_...D..b..0.U...S;....XP.@..C.#Cq..}aNy_..ZG...q#m<;..g2b.]"..Y.....[7."+..#"wOtb..-..."..@..(.>Y0......C.h...?.~..8A.Mp.....N....Z$ .E...."o.E.uz3;..m.P.z.....7...?.'.q>...2mN.gLv...q1..[}..@~..M.....K..sS.....PK....0w........PK.........n/Q............,...classes/ja

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.management.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	896846
Entropy (8bit):	7.923431656723031
Encrypted:	false
SSDEEP:	12288:3xz+ej0yUGnip25kAyyrAm0G4hcpbLIWFWb4YNlgWUz4u5cnLXlAVz/Q+9Ec8zCU:3cZpcryy8mp4hpSxWUQuV//yDXX
MD5:	C6FBB7D49CAA027010C2A817D80CA77C
SHA1:	4191E275E1154271ABF1E54E85A4FF94F59E7223
SHA-256:	1C8D9EFAEB087AA474AD8416C3C2E0E415B311D43BCCA3B67CBF729065065F09
SHA-512:	FDDC31FA97AF16470EA2F93E3EF206FFB217E4ED8A5C379D69C512652987E345CB977DB84EDA233B190181C6E6E65C173062A93DB3E6BB9EE7E71472C9BBFE34
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.S.N.A.=-.............^PQP4F..\|..]{.........S\|...(cu/..i.d.z...[....'.M\|`.M.GrI.).1.4...8...V.b.EE.Rg...zV.K......Os.W.S?.e.GY.Q`.od..d..Zf....2>.B.29.D.3L7...M&....8.;..2...}..n..n.g...S. ?..._V..Q..9mBo0L..~dD.t.c.ric..2r5qLvr..V....Sm..I}.}.a..Od$2e..M.v.m..w....L..s.C.;...#.f..Ln.......5..9.2....5......P......M.$V.\|;...'mw.Vl.2....D..1%.l.a..o...O....!.......h...9V.L.x..?..n]/.6......iVe..{.4.K..s.[....y..\|2....3,`.a.....H69.a.;09.5K.C....a_.G.`Jm...ER......9I.D.n...Wp........%..WI...tf..pg5..SN.8y..Y'.:9....U.pq.....}.]X..aE....^t..x.l...^....m.#.......a."r.l.2..Lf).y.^.h..u....PK....N.i.......PK.........n/Q............0...classes/com/sun/jmx/defaults/JmxProperties.class.UMS#U.=.aH.4.4.....J2...h..6v.L2q.......tS.)F........\.....Y..h2...*...{.......w..8Ha.....p.C.c..C;..^+S...F.0..xNt....J5.$.b.og..9l.g....Q..k......"..I....b....-..^.n..<x..4.$pY.(..,\~.F..0...Z<`X[...(p...u^.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.management.rmi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	92135
Entropy (8bit):	7.945919597257173
Encrypted:	false
SSDEEP:	1536:Jxw6Uq67COVGkuLH5Sr6DPHoXsUJWLgUpDYC+ZJk3kJoPUFX:Jxw6v67bXr2g/WRVtwi0Jw+X
MD5:	22F603FFB69D73089DDE462D567E88C9
SHA1:	7ACF3CADC41F208280B8F115C2EE58FE16FDB538
SHA-256:	27047E3D872637D62DD251A1E7CBE0AE5F1DD1F0F275A06405E6C673421681C6
SHA-512:	AA7ACDB5DD69CE5C8C62E4A89F65F94DD9316F9364E30EBEB66A542FC418FC586EC41B0D13D41548EB05B4B96E22113B879D20B9F146B935D8B6CB3826E78A51
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.Q.N.0.}C..............J..U..W...%....G.....G!.......g.o..=.o./...qH(I...~,..... .>#.Y.$S..%Wi`..1M....'A...i.v{..ah..)..J.Q,.-....'.S..OR...i../.1..J..3s.....I..>*..7.>.....m.P....9.-..~S.n.5.R<J.i...17y...?..6.a...Y#..G.>........-B.F.L.D...5....GE.E..B.P....yJ.....A.........xMc..9.]..1c.E.n.q.]..b.e...&..\^v..Vm..M...g...=.-c...>.PK......a.......PK.........n/Q............6...classes/com/sun/jmx/remote/internal/rmi/ProxyRef.class.UmS.U.~n.YI......j.$@.VZ...k.64%.4V@.\aqs7nv).........?8~.G9.{.$1....{..y.9.9.....O.E<O#.!.I..H1.90.M.6.Q.=.u.!u...w.a(....5.hH..@g......q.<2\.t<nX..0m.mZ...}..&mW./V..y...!w.u.E"....pF.Y.c...d.]n6..:....:...x].-.+.k...L2..p-...........c....%..o8..\..%...KRi.a.O.#T..%"l2g<...(nW.9/...{....+.d..\n...M\c..q..).f..P....u.s-..P....r.../d0.[q...l...-..b...h.....9.,...o}.&.g....oI..:...0..\|d..KN...,K..:..bW`....p>..=.;..L...69......P.....L..L...?........?.k...?.%..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.naming.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	460349
Entropy (8bit):	7.928980735357845
Encrypted:	false
SSDEEP:	12288:y8d3lQXYWlLLH56T4J+1hdWvHBmgmhhs+RGJ1:y8d3RWlXeMqdWvHczs6o1
MD5:	B396D42998F877CBDE5B93A1B238B5C5
SHA1:	ED864130A63A807EFC16CE9F97F8C24750A14C35
SHA-256:	734130C3E9D7A12A75BBB194C9FD29DFC85FD802B42B3CCD2C617C86FC905473
SHA-512:	8E44D12F37DE7A1F7453299FA0A3ACC566C2959A1C482DA936108BFB6514650AA3E2400AC090B65F2FE3FA53BCFF4F676D129695B10334B4160B45EF3B440043
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.Sio.1.}..KO.f{p.Hi8J.-..DU.T...3..5.9...........G!f...$..J...g...........3L............ ..CA{2.h.R.V.(...V..l0...M[..oF"..1...\v..q..a...s9#.q..K}..#.eyh;>.^.F.Q..m...8(..<..AA=..XdX.q.p..L........ur....u......[.s}.<..ju...wU.%.C07..B.......42l....$..U$S...&...#.g.w....,.a.+....^...0S...u."m...ciK...J.B..H.A.\|.&........U.OZY%..c*j...W+.O.V.M...dG.j......y.r.....$.s....P...ab?n...UMI...{#.uwR.aC...w....e.>R:..LE.......z.(..l=....2.1Z?:...n...t~..;..-;{..Y...\|./.:..<.&...N.%....8.)..9..%\..,S...e<.[...?PK..._./....$...PK.........n/Q............=...classes/com/sun/jndi/ldap/AbstractLdapNamingEnumeration.class.Y.x..u........S.,a....JF..."#.h.$.X...v....5.1....PB...Ml -N...%...i.;.>..WhC.I...G..A....h..d.M.o.....s.....]..W^..........A.)..a.[bv\|{...N.U(j..n.BaC......B.F..BK81.J.[v.#.X..j..O.I;.v.e.=..o.....F.q.+.s..QP[E.,...f..w.Q'.0...v..... .l..s5.a.B0...R-.Nz+5.Jo`(..KG..".pX...K..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.net.http.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	718964
Entropy (8bit):	7.932673218886782
Encrypted:	false
SSDEEP:	12288:i0TENWrWZbbneYeeZXg4ao0K/3JCypyudOQjsDv+X/A4zEs6HtZrvZ:AA6Z/teKX50K/ZPov+Xo4zEV/7Z
MD5:	5A11C4A6D94E1C67F84D2D22B7012B11
SHA1:	273C3A253F6845441C6B4D0AA000BD0860574EA8
SHA-256:	AF1946B6683575D724430220DB7C948AF2598E69091F74459CCA1F97A15C2A54
SHA-512:	841460A10900517CEB80F734F1492AEEE83287ECB521BB5107BECA3684189521D56F9CD2B17A136C521884124CD1F307CE51F63DABCAC60247960BBBFAC046BA
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classu.MN.0...@..K!...8A.*......n2m.$v....b..8..IAt.F..x.gKo>..?.<..It..y...n........I...Ul.1+.5B}r.....Y..L.A.......T.x....J..:I........T&,..W.XI?.8&.T.r.f.....Z.....Ch..u..S....\n...5/.g9.....d:gc...t..e.<.m...F.C..C..:.=. .mA.M....M......(__~.PK............PK.........n/Q................classes/java/net/http/HttpClient$Builder.class.T[O.A...(..r..Q...^X....E....%D..vw..e...b.Y....?..e<;.(......w.7...?....(c....Z.+ .~..]..s#..........b...sN.._..!.=...@.8..T/......\|..P`(...h}..P.....D.........F.....n....F..z.7...%.a.rO.U/..Tk.#.J'.p.L..C.."....\&.....i.]N.....i..8..H...,..L..n.Qm....)..)o.k.b..K...l.6oq?1'^i.h....~..9........e....<..v....t.;u.m.R]...+Whn.8e..@...>b.v.2......g.;5.iz..).{f.;.:.lr.fj2L8...z..PDB/0.:3[.}..p:....z...j.k.4.o.D.\|E.?.."..zzcy.We.-..K.mI...]'U..8...V;e...&.....i..Uo..ioXm.^7....1....B......:n...[.oc.....,b..]L.......dp...>..)..cZ...%..../...~......s.^....)..\|.Y.q...v.....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.prefs.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	54624
Entropy (8bit):	7.943156238505704
Encrypted:	false
SSDEEP:	1536:QAcQb2JQBFv0vQ1ffh80OUisaBL00Yfcfd8tjsH5:QqjcY1fJIUXCQx0lr
MD5:	224D8C26B9454FFE244D354BC030CAB9
SHA1:	E531A7BAF213D72964CE4DD83A11AEEAE5713F00
SHA-256:	43622935A7EF06E30D1BDA7E77CB76488DA9E721728AE0B8ACDB1F9C7B91C943
SHA-512:	E0754FFF5801CEB2B1512AD0DDDF0D74C4C2AE97EE70A467E7D83E3AE5870A6ECC6F250B849108923AA8CA94EA3505C4CC7C9BEEBFC192B2DFF1E99A943DCBB4
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class]N.N.@.=W..K....--$.=;.......J.!3....r...Q.;.&.Y.;.qs....'.9..N..:.qV.u."....zS.......h...h.M.}g.u..w...-.~Q.C.....<D.p.o#^...2a.PI..{..T>..$..r...?.ps..T.U....YxVf......T..X.....\..5......J.).}tn.g...T...=......PK..t?u.....9...PK.........n/Q............3...classes/java/util/prefs/AbstractPreferences$1.class.S]O.A.=.nYZ.(....Rd[.._/%D$..R.h.x..C.\w..,..H_1A%>...Q..M.iL7...;.;g...?~...q..dmX.r.c.;...k.W."....-.#...4...<.J+.}.@..2..=0j..#o..`..C.p\|....C.i.\...k.Y...c..6..F.M.......P.p.c6..L.*......X.....f..%#..\.u.S.n.&....a...0.....>...... ..f...mr..D.w..l.2L...^.I..."../.bo..2$...t..&..F.'...2...CKDoy..h=....L.i.J..a....J.apGs...?J.....\0..;..p.G.y~.P.......F...0.<.)..].........C%.......x@t..Q.4..Q..RU4../BEU....m.\)...2T..w.......R.@..s4Z#D..Be.+X.;./4.......k..4.....Q...8R.W.a..r.v..3.~.m}..=...}..dt..#.P.!3...Ix!...D.T.......R.......L_.2.....<4.!<2...E..PK..]5\.H...`...PK.........n/Q.........

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.rmi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	385108
Entropy (8bit):	7.9135425794114935
Encrypted:	false
SSDEEP:	6144:WLo6BW4jXxBTXH4nfLyHInEmCC+Z/GTdy6ixx7KoLUTzROUBczZoUDYbwyKdlO5k:YvxhBDHauHIEDC+ZOTKL1IzCzZoUDYbK
MD5:	C4BF3C85D5A2B5A2482D29682F937339
SHA1:	2ACCDEEAD4904C6EC919771CE49943C9D6E8A9E9
SHA-256:	25FDC4D19B9F9BFF599212307C35ADE3C5B14D8FA326352837E2AC1919A27679
SHA-512:	51908DB9F980EAABB144C3BBD38563DF0DE3AD9AD286FD4D4F5C41B4F2D70CF278395E123D8C26A64742858A4B629902532C0AF097D020EDA92A7031AF586B66
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classeR.N.1........E....ogX.n.411.../Pg..L.i....\^..>..Lwg.b'=?...z.........8eX.M6dO.K..cX.......J.T.....'.Q...).7..E..q...+.c.!..D.^..WFs,3.4.,O9V.....\9o.pt.....K..Z..'.+8"j...09.&.....g.......q<...H{UJ......Kx../6K.......z.].....C.g.Ka........\.<.!..dWq)..e)..Ik...t...T.+.J..F;S.m.a..4..g.>...Fd..U..C.<..Q....,..4...E.Wt.#..p!l.=....v=Qf..7...k.}T..........n..p.M_.V......F.<.E.............b...U..;.;.R^..;.AL.(...({....8Tw..PK..{;\l........PK.........n/Q............R...classes/com/sun/rmi/rmid/ExecOptionPermission$ExecOptionPermissionCollection.class.V.S.W..]..aY.....hQI".UAJ.V......k.\..f7f7......K_./}.C....L.38..8...C..7.........#.:.>d.....;...9y......\|!....n...2.^R...g3.=.>.3).4..6u..mZ1.vh.fw1...#.....kY[....5i..:.!A.j.....H.P)a..*ld....5.dB....i..J...v...W.)O/.-..X.$.ay......K?.2O0.1.[.v........U#........$.)n..q...Qh..lG=..:.M#..g4{.V...6Amn....H .le..hF2"c+v.p............e40.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.scripting.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	44965
Entropy (8bit):	7.9310029341229376
Encrypted:	false
SSDEEP:	768:T/6WAhx73PjgF6wN1l861Z/T6dKl4U1mQUva+qD160eYG3ichd66N3LgRBG:+73PjgTaK4U85i++1bmi+66N38RBG
MD5:	A64194B2F7AD00E12C9E5AE260B57B3E
SHA1:	2617AE8B733B5E7B31180A3EED1DDFFD1B5CF631
SHA-256:	BC08974AF0D13B1B362A651329036C24CC54028F1D0B3EB327350B51E2270FA5
SHA-512:	68FE47540C844FE28B92C0AE4E8FF5C77F60A4AD0C5F1F3857412DF36E11A6053697B823E7C3D653E012F1923502DBBAAA9B03803A24344DC5C384853A3D44F8
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMNAN.@....PJK!9q@\|.YQ......\|`.,a!.E......x.....>x.....o.7H...eM.g.>..D....\|..I..W.y...c....".L.3.J..+j../:...(.D..v.c.'......:.p.+....67V/..]..aL8\..Rzi...w.G..+.z.........uM.......d.]_m.....c........<._.S6....I..p..i...PK..=..+....F...PK.........n/Q...............classes/com/sun/tools/script/shell/init.js.<.s....@47.]+.......K.......];i&CK.."u$e[.......AYI{.6.....]...<....^=.V.:.Z...G...>....0Q.u6-....AU..mT6..E...I..P..Z7.....}....z.............W'/^.~w..4U.4Z.j....Um..\|.Kx..z. .?....{....>.....U?g.....\.E. /.\|]N..\..h64....X.`.U..Z5.... .R..j...QU.p9-.]h5......^UI...k]vx....e....^.f.U....'.Z?./.j...s...V.c.O.<...ROTV_5{.\|p..i.~....-........v..v..+.).a......<T2....H.,t....6..l..9>X/u.64..n.O...s......Q.R.Z...j.g.r..G.....^O.&V.%.e."X.=\F..u].e>.e+........n?~T..,...,]..].-.:.0..................L.K..^...$..B..:........p...~.H.l:.M....5.u1k./-.7B.^.%.f.. ...w?....8...\g.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.se.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	7.650310282866788
Encrypted:	false
SSDEEP:	48:pEEdhj3vrYL8RjLRg2EJrb/cl3gxo7RA1LXn+q3JusEL/dv0DjGqt:+EdhdKvJX/Agxo7RA1LZZAL4Gqt
MD5:	3B4DCB7D28ED3DA5F09ADE9FDE137D3B
SHA1:	0EEDA129FA837E4D5E54F678249C7265C96BE4FA
SHA-256:	4BD4726EB7772FD1A202DF3EEF6367ED66688E0603C4B970D22AC8EB560F2A04
SHA-512:	BBC8165555B54BCE7E2342CEE798F93245B0F5A4B6E9CD9CCBB28F7EF42E8B4E3DD729DB95E7B027CE955DB27FA3B8555D8015B568CF8672A4BEC9DC6028EC1E
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classe..V.1....2.!.xC.&...A7.....=.68.4IF`..gr...P..k.9...K.OU.........p"0_..hh...\|.B..@P....h5..FbJ`..A....,..t....9,\|U........:.....F..X..&.H..X.Xf...2.I,./K.J.NN.....I....Be%...o8]q...Bg....].D`..:.A.x&0.1..B`i...N\|.K...^..`.:/#U..O.:.%v...."..e4..uv.-.E..+-q.k..}.k)RE...../~...zN_s._G../..P.D./...}]].?.....c.Gh.I.......X..M.;.-..s..f.0W.....S.s.&s....e.3..o...G._...PK..U.FO........PK.........n/Q................legal/COPYRIGHT.VMs.6...W..L.I{ir.$n....N...J.A..@).I..}...e.i{.@......C?F..f.....KC?.}.kCwQgHz.S.ds"..Y.MZ.K.X%.&..3z%..M.B..2.S\|t0...:..6x.}.;..i..D..Ye\|..&..wI..Xo....h.['..!..B.\HC.W.g.8.z$.q.....Kob...=.p.].>.Ld.....H.........H/a.(.sa?E...oR'G.!3......j...A..'.....V2..m..5H.....ex.z...m..........a.l.6..7{........v.3]..(..g.\|E.fg"^d..zc".-.dJ.[..M.6*t.uS.BKy...Ys`./.k.......yaZ..........U'.....&.n.&...P....F9..J.1bo.6..I.]%....x..../.1...[.u....ey...-.Ag$H@.BD....xHL.>..V...>

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.security.jgss.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	698330
Entropy (8bit):	7.957481640793777
Encrypted:	false
SSDEEP:	12288:vSE51vUGc5P3jM18B7OcsnbmTk2baTrPxLLu3S6qj8fM7vX:qE5t9UPzI4OjbmTk2GPxvu3SXj8e
MD5:	372B6F9949895C86164FDF3A1E99CAC6
SHA1:	B9D3ECAFAE368E7ACDADCC347DE6FFC08D031CE8
SHA-256:	934114BA650D81262CFE3CFBA0D5A190520C05CDDDCD9A7A875E3E1D951AD71D
SHA-512:	2DB6F0FEAAD1DD724447CE6E1E1CE92C5293AAB8A661031BB4B343564703BA033410EB0BE56B223F2F8901CDF158530503C0F5B6459D7918253C3AC7CF99F029
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.R[O.A..."."..........P..w.LH..d.;l...lfgYy.w....G.g/.i.L2sn.d.......>.#aq..t$.At.j ..?.g(..a%.N".T.....I...a....;....._".H..R..V.C......iNy..@.I.G..,.x..Q...11O.H..a...Q....K..)7.u..p..:.K.IX._..."lLG3-.Xj...Q.v...)7."#u$F.......u.;...o..........a......3...}...]u5.jW...R#....;.&...P../...K...8...^._.z.$...`-p.<...Vg.'u...[..<I.+.[B.D......t.R0..(.c....^.../.%s.D....{G...-\.9...qd.7........S..B..a/..r!..^.v..\.v.B.+.7....;h.zu.m..+`X.5...#.........S}..PK..CU\.........PK.........n/Q............?...classes/javax/security/auth/kerberos/DelegationPermission.class.V[s.......,.....".f-a!..+.Ip.M.q....0...x..h...,s..Il..vl.v..0.I..B.L.-....C^...<'...T.....8..;.}.w...............`...$L$...}.Z...Y.\|;\.>f.v.9.W. .=W .....a...qm.X...T.........l c.].=.L..pV....?+}/.>..9g..m..P.TV..-..ZDj..@.@.^.B...{...K?......[.r....B.Qeub....W`.+.C.*.up.~..vb...&.......$Q^.,'XG...+......xD...0.(....\T.nxb.(...,;.ob/..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.security.sasl.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	81698
Entropy (8bit):	7.940663737798511
Encrypted:	false
SSDEEP:	1536:PNkjPGGpYd4vOGnXOTbAuy88LVeMdC/FEM9ZndTL8kSCXWO5o4HMSKSg63WiWdYG:Jd4mIXpHdAVgkuO2GXKuHVWlZlV8i
MD5:	BDD7FCA80A0E7436DC46FADE0C8CD511
SHA1:	C491F4A649B8DB593F26D25133DD104D8985AE60
SHA-256:	F783A14F1FD9E804553F54E8B97E38A5BEB8C25ADF096FD380FC1BEE391153AA
SHA-512:	6DD0A97BC791E78C28E1D1D949911B94DB3E2B08E5055283AD0195E0897E7984FACB517FF8E6C7B6E78E310819AFCBEAC9876B0FF35370AD96539C3E8B28C134
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuP.N.@.=..r.h...-$........,..t[.7...?..2N....Mf.\....O...&4...C9V.kR..:...\,..W.....{w...2.2.u&......y.n9n..Q%...\_.Rg6j..~F......<S<.E..uo.G..jF....B..4a........;............{o.&K...S.h....P.J.....G..;..3..B..g.x.i 3Bk.b?Y....5P...q.">..q.C.+...E.6..:..l....gl.\...#.........PK..... .......PK.........n/Q............5...classes/com/sun/security/sasl/ClientFactoryImpl.class.W.w.......,lc.hB.b._.@.C...&26.6.nH..X.UV+.$i..6....> }.m }..b....9.9.I=).7...-.9m.W3........[.n.h.....G.7......HJ5."..Gu....0L..).ij....U..AT#(.f.#....Z.6..HV."....N..9.=.....d...g.....$..0....A... V..6/...B.9.....).......5A..:.`...Y)C3tT.u.....l..O`Ky.s....z...R.Z......o..o......`.@cy{.'..6.T....GX......4...?vpW..=..... ..a.1.;.Y..6G-..2.wX91.s.#..J...D$V..U..n.7.-EUA..Cw`.V.t2...V......U..M`}.'.v. .....wu.W.C.....R.a........W...GR.d.O.i.7j.HE!..n..CK.-#..../..u7.G..M.8.e...."...<.a....p.+.".G2j6{.G.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.smartcardio.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	58645
Entropy (8bit):	7.913344050895434
Encrypted:	false
SSDEEP:	1536:r6aikQmg/FHrHESArP6j+qjHQT3K4n5pBCZ9xkQ8AgIDAJ4WY8gOY5nIlSjI:e7mqECMbnVAXDq
MD5:	4C54BF6DD5C142E6C8C1A360C985167C
SHA1:	7449C89D087ADC871E26218F6AD82FD1FF5BC01D
SHA-256:	0AF33A68F7B71F12FA3B7F27BC69B80A86633F25EB82830076ACFC3170538EC0
SHA-512:	2C5050F04B4F7AD373CDD33B3874A38AA317C996DF27630D4AFCD6F2ACCEC6A5ACEE3ABADFCF8D0182104651BA68239FA13E4658398F9F92D0E1C6D4B4F4568A
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classu..N.1.E.Cd.D.A..gF.t...$...i%Ef..S...........6i_.=..........B;W..H.....GB.b..$_".3]fLs.B....}t...=._.#.G@..[.FdV.../m..U....M....h..\......Aqj.d...\.Z..:..r-...O.....e/l)... .^..........?Lv@....\|..+Woq...\..S...].f.a.9.B.:{..PK..F......k...PK.........n/Q............#...classes/javax/smartcardio/ATR.class.Vko.e.~.t......R,....V.j..m.ta.e......v;....%..5.D.D..1A0.....\B..o..'..A.wf...J.0...y.s.s......2.."...P.a4...jOY5&z.....#.G7tg.@.+..".F............e....t%sK.3.X.f...V!....{...r..U.....V.+J..1..<...5.6.uX/.l;...m...Z..Yy..C.<o2..\.Ql.s.:c.......h3...e..E.2+..Z.=[g+..P..1l....f.im.4..sZw&9#M..iWv..#.....(..T..!..5RUG/..I..k...eN.......t....D&U.AJT;..d6...`g..d=Z]<..........lc.J..{R....WY....f.jY....D...2.Y.n....(.a.....j......[..b.>..@.#....hu..Y..`K.dQ.Q..7C..,...vD...0aa...M.............YG#J.+);..;.]....M..+....."....16.Y...,;d.3.Y...D...;..G.W....3..g.....VqX.[....5......

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.sql.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	76011
Entropy (8bit):	7.806124696487568
Encrypted:	false
SSDEEP:	1536:WwNmF73X9Xw+OM8661csaSLwEqv4RO8zIYaHlrez:NYlpBj866taSLwEqB3DrA
MD5:	E910C6B0413AB8D4CD0A5EBCCDA387EF
SHA1:	6782B1D03ED398C4AA558C219294C6367F7C8479
SHA-256:	2A24C132034F0894A0AA38A2DFA546F6D20113783B791EDCC9831DFC144256FA
SHA-512:	A729C0449FD21D633E5F70B8FE98876E96FE7559DE0E4E137A55B329403B624D6F298B2D4BBA061AD4049DE224CC2A2C3B6FA2BDCB13430BE78E84992D537B2B
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.MN.0...../....@]A7l.;$$..I.eHb..m.=........Hx..........p.K.05.&......D....]l.._.n?........\|...s..A......_...C....(.3.0&0O.\dVD.6./..M+S.vD..!..\oe....g..#.....y...&..ID.BI.Bk."r%..x.....B...f.t..NP.........}.........~/l..s.g~..8.S..PK...p......k...PK.........n/Q................classes/java/sql/Array.class...N.0.."2............FH.h..Dg...,#s.3.j^..>..[1@....dY{.''_...O.0.P.....Q#\|u.. .....Bs.g.....p.e..........#P..9g...l.@..}.\|.P....,...<...@.+z.C ..h!.O[`..>U#.F.....Y..Q...\|+.h%K/(.....i.l....MGi...j...\."....-..~.T<......\o.q.y...d....d....a.......5....v\......2....)._....k.K.7.J...R...R..\.2.RP..z..P...T.&.U.+.-.4...Ag...Y\|..w..PK...?mb...&...PK.........n/Q............+...classes/java/sql/BatchUpdateException.class.W.s.W...+.k..8vl)..$N#._q.I.7qS.i.(vR...).F..JdI.V.(.\|5..\|.xf.....q2..2.e.7...x.7.x...sw..m..0c.....w..s..OO....$~.C.....-.=...X.......K..f...s.-.er..@,.R&Y#.26o.3....3..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.sql.rowset.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	190817
Entropy (8bit):	7.967262446791647
Encrypted:	false
SSDEEP:	3072:SiFe3M5fvodBY6aFvCLY3HQgZlTlJtlGwNa+Uk3/+y9L:o85XoHaRMCHQelhHlZVlGy9L
MD5:	435A6696E8BABB8D66B3D838FAED2BF9
SHA1:	4EB408C7D7E6A347CC6F331CAEC10DE7F55FBC57
SHA-256:	3F55459BE1A9E300D872F712039F975A3C5BCCFDC498CD0A603A465DE8633300
SHA-512:	D3D8D34400230FDDBBCDF469786869FCDF50491CDDF70B58ADCB33E959A5ED8649E374E714FFFFA7AA2D4884042F09B0FCB7963402B65BD48E1634D099E2B2BA
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classeP.N.0.......hy.......{CB..0...I\...[.....G!6.E.Z...v......W8e.F.../.GU.ch.!.'>...,8.K.h5KDj!.P.\8g....M&...m....9W..1.m..:+.X...NlTi~6..i..u2\e.Dh..6..uq,ml1....x",X.5S..d.X...&.!...._-.1t...l$.!.R..8`...D{b(CA[.1..,.[.=.@$4{A.s....>..O.}....s`.....:...kl.......a.......ep....n..K..FY...q?..PK....:.:.......PK.........n/Q............/...classes/com/sun/rowset/CachedRowSetImpl$1.class...N.1.....K..RN=.(.$.e.R.....AE.....Wt.X.h.....V.D..E...UuvI..Ua%....o<...??..X.4....B/a.....RN..ja.....vpZ.f....-.z..y.W...3.C.B.F?lB..=q..UMgs.@x.aKRI.L....i.`.B..}..............jiwk{...Z.&.U.=.L(U..2.Q.c6..!a"..9...G.G..+o..L......Fi.O...o3...R...D6D.~.xl...r.aK...w.g.9a&v.....9w.By"}....'........\|..(...R..`.+R.j.pO.;./.......PF.1..4a..:..H.\.I[.!..e.JO.i..fmp....k..}.&..5..........t.{X.B.....k2J.hg.s..sZV..h...a.....*.y.h.s{])..\|Wk.1.5...3P6.=<~.=..1....-.".}.8..T........./k@./x<v...r@<J......E.............

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.transaction.xa.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	4035
Entropy (8bit):	7.63515724105447
Encrypted:	false
SSDEEP:	96:Yq0GYT9RMGlLOkhw8KvJX/Agxo7RA1LZZALaGXDHHs:f0GjlkhDKdNsAlsnI
MD5:	FF54FAF2ABD3B1BD2B868FEC043BB19D
SHA1:	C6EBE8364D84B85478C164A6A6A09FEB4394F6A6
SHA-256:	D73340591C1D956650175CDF0B12F5523EE5D5644ECDAF663DD7F44EBC28290E
SHA-512:	F6225B4F0FD673226F20D8BFC9A99851FE230C7DF59472FE07269B83A52F52E5878A39B9B2C55D8435E98C140F16BC383AEA01D4AEDED5BC4531084D491A3B37
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMMI..@..v..x......7A....(.L.....>.G....:tuWWQ....`.....z.C..u.Dp..q...<K".84..J."a..Bm2.c1!..#..YF..Q'4....$.6...r..2...B.X... ..S.[..2&8w...n.\|....(...w.....f...(._B.?8..j.<...PK..Z...........PK.........n/Q................classes/javax/transaction/xa/XAException.class..MS.P.....R.a@.?...(U....&..4a...7L(...:iq...p.q..?.?.7........>....;..r......J.....o.t=p+5.\....^S.....c......$..Q?.O...I...9.....E&&K.#....L...b=.+...81:..n.a.....d.[.#.3.y......U].^By.Z...J....{....}..ZG...ag2JQ..X[....#.d.C.Z.BN..^.R.....\.`.-.n:..;..n3J.k9y..f'4+..X.....8zA.V..v.4.V....d.).f..&.......ym..+..l....X......:Z%.}....[4..g.6/I.LC..h.....nf#...G....ms.G4....p.;,..bp.+4.......#...GX....*7...apUE]...(.....x...M/p..=.>.Z.<...pSF.;~.......x.?c...}..(..,..'......\|..^)e.w...6....a..>P..c.Y.z..... ..)>/..>..../H\|.\|I...Q....._._.....).!..xR..xJ..[.O........xF.{...?.?......O.....J<.^...X.8..J.R.k.m.[....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\java.xml.crypto.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	670979
Entropy (8bit):	7.887042011821685
Encrypted:	false
SSDEEP:	12288:aXgXoXuXOLj7awadMRn6HG46P4IN8mvyHswk596dQLreo7Z6AAb1yRvuASgS5Mey:aXgYMOLj7awadMRn6HG4y4IN8mvyHswi
MD5:	895377EEDFDE160D01971E53C5657F7C
SHA1:	8A3E4A11683A7F406DF57277921A9B5E49DCA185
SHA-256:	026D61591C17B3ACBF900F3EA676452CC668062116C5B823709AEABBF77AC7B6
SHA-512:	D73AB337D179B07DB5F01D58243578687A9E4323BCF6ADE8137E31D882099966EBC8C132CC3A5391A4C77D532B54C5354C6C0279CC24AC0970375B0EEA0EBEF4
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.UYW.P..F...6.....K..-.&(.((....6......7~.......[.....9'..............9..:].Prx...~.D.`..Y..z.^q...'A..Bh...q=K.3}..K....`.3..!....q.1...Y.vt.!E.lt....?.n............"..'.:.....l...M.%........KXH....z.........$......'..A..v/.p....4V..)q...0..I%?>..6a&.^..C.).5L.h.^.r...f...Y\..a.)h}......bJ..<&L4..m.cQIH.(a>9N..r..8..$.>.........I....~.2I.......'b....v$F^...0Fm.N....W.'.]$..b..G...q;.(.j?.0C.......0G....@...UE.../w.-.w'..e.....njX..."..@.P.Z-.2.?..$....}c!Oc..T.,..xOh;k.il..b.6.../...R.H..o4c.kse.v6R.D..U.q.v..[.+.z.?..<..>..T.{LX<"t..^.?.3.-L.N.+8{Z..X..=...5)[....J.......J.W.KJ.Qr..-..\|V.....].A.n@..na.wpW.>.#<.....t.c.9L.4/#,I....-......PK..v.G........PK.........n/Q............K...classes/com/sun/org/apache/xml/internal/security/algorithms/Algorithm.class...O.P..w.+t...(...0.I%&j2...@.F.._..M.v-io..+}....}..2.{W+HM4.Y.=..\|...s.o.?.............F.'IC'.=..qwW8....C)..N".4..J?H...\..X..@.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.accessibility.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	517331
Entropy (8bit):	7.932914811977659
Encrypted:	false
SSDEEP:	12288:3Jcwf4nlwkOnw0dGfGf2NNdGGF56ZwDcBy:3Jcy4nlenRGuf+NdPFke+y
MD5:	1BF162783EC1B1DE6BF846275CB30304
SHA1:	DAED3EAFA8D19CA690F8A46B55DEFB0FD5F55387
SHA-256:	BE8A7293DEADFF4410281D93A0B6E8CAF2ABD08486000F933E2B7794998B0AAA
SHA-512:	71000CFDE3B33D7E1DE2BE8F34D1A4451CA37DB7C7CA28B59A6F6C00A730E974EE9F0AE4868659B9BD47970FE70CD83A4F523AD0D03F70362C5C7BD7FD99AC95
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class...N.@....HA>....M............}..].B.%....sy..\|(..S=.....g~3.;...o..qL...O..S..@.V!.L.\..........T.b.D(....3 .y:tM....~.].%2.D.E8..L..P...........6..z.}i.....!.g...}n.j...el.M.../......l...NcO.@.\.....+g(...K.[..E<....P....'B..b.l`.J.C.7..g.[l...,..)[...'.......WU8W.a....PK..a.-.........PK.........n/Q............@...classes/com/sun/java/accessibility/internal/AccessBridge$1.class.SMo.@.}..q..............RU....i..rA ......v......~.?.1v".R.QK..}.7..3......}..QC.C#.....1?.a.U...c.8..T..2..Q.-...c;.R}.>\|.x.........:1aX.5O#..n.....B.3Re...G.k.:..`..q.'.-TX..$...X..MC..0......fb...3.b.t{..FZ.}...6..0e..F..\d".$Nj"6.t.V#..~1..y..N.......}.6...O..+.3...9.../.e..+..x~: .w.;...K)...L"^.R....e4..B%..Qfo.;..;.....Ck_X.J[..R....Za.I....O.V....n....g%r.+.g:.p.l.....`..k.N...1'?............g...>...f)..Jq.T./X=...K.YEm.V.7q.\|.[d.+d.w+..#.z~.PK...G.'....h...PK.........n/Q............A...classes/com/sun/java/acces

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.aot.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	286933
Entropy (8bit):	7.911348853312728
Encrypted:	false
SSDEEP:	6144:vlan58OL1oHDUV6c+45ksJuLWjNAN3ZtjV5OyaFQWIWdB8VimLL:vZHDezuqcjOjQWIySs6
MD5:	CB1CFBA8201EE222C2D69845FC055F84
SHA1:	8C448B58260790B6B10231F0153FC7438B41F4D8
SHA-256:	DE900FCC734F2CE46175DFBAA4C26368452C6049EA96A35F1E27F5CD988C9D3A
SHA-512:	2B69DD8B25F2549C4BCD4F2F3E3FB21F0EB66FD8BCAD4CEC0F7B731317041BC01B8329644109C0823839F3BA78BE48CEB227C5CB958CA3101E24035C24FD15C2
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class}..N.0.E.c...1.(.y..H..=;$$...b..IA..],..>..BB.`..G..~..\|{.p..P.&...)...?...9....}nR.#...3..?!L95H.QI.q.`(...s+..O....S..U!,.....)C..Rh.R.........0....')L.....0JI.R.#....P<Ib.%C..,....}eX$4......B...a.w.J.V....O..u.lV.(N..../".......HI.a.P.\.c~/...7.%L.....A.O\..8........a./.r{/SB.%.C.....!\|...#.....{.u.S7z...3;.......eT1..L..i.a..Xrz.k8...PK....h.x.......PK.........n/Q............>...classes/jdk/tools/jaotc/aarch64/AArch64ELFMacroAssembler.class.U]W.E.~...tm....b-.MBe...HK..l0..4j..a...M6.nPZ..z..^z.7............n.ml)x<........;......FPH...q....U`.S+..]/..W,;..L..M)..:t......i)o.....=.Z.8%'...If...M..0C.6..Z....o)..8^i$.oG...H.8.C._..........m2;..x.(e...R!..)...X:.... ...a.E..8.......j`...k..W.?..H..=j..:..e..l..-...W...T>..p"...^.).s...E...,e.......6Wr7......}..%.b.4^%.n...&3......6t.xMs.V,k....8+.V.\|'..d*.M).i...H.Y.>..D9.4......\|.c.N..x......:.tc+-...Li.SE......_...:]).s.....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.attach.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	38562
Entropy (8bit):	7.938691448340528
Encrypted:	false
SSDEEP:	768:YFL2bxkq9mFS8C+9OwdExG3rjwo6LkgHVOImnz3E2/ElTMst5G:Qalkq9ktCCOwHwo6L91Dmnz3E6ElTltQ
MD5:	B1ECA358F4D3525178F96244F11344FD
SHA1:	EA84D813907BA33FB66E54FC0A8272230F7F6FCB
SHA-256:	178B1246FA90169F75CC8DED648A88276DD252A28A85F26676777D75D290BB64
SHA-512:	985D19030C00EAF12E088184745739ACA59797D6E354FD41B1483A231E66479DAC0260E1BA9A3A5FFE4954CD69EC8FF49ECAF7D14DF0C4333BC77B2790EAE410
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuP.J.@.=..&M.V..>v.\5..".r#.....c2.I.d&........TA....9.........1....L.(...".~4..U..$..gJ...E..._.g....".d..J.T.+...0....<.....3.B.V...zzy....9K...b......$."........N.Q../,...5.o.]6O-...DY..6N.>......J&,..).....)W..".#..#.E..K`...}.u.C....}K..e......D...6.....@.a:.qhv.}.PK...4..........PK.........n/Q............?...classes/com/sun/tools/attach/AgentInitializationException.class..KO.A..O..y........1.c\..b...6.. .qU...LSm....7.!...p..v.....TO.H....7.~...>.s..@..u.P...D....W.]z.4#..~..Y....6..(.-.k..Z..&.h.<..=/I.g.(L<i..v..#e.."-C} .....+..f(.T....1.&h.....f..6...P`&Q1aC.'dl..,\|'0.Lb.......k....(../........?...;.( G..8O..N.....M.s$.zcj.../.3.{...[Q...v.,...S.."o..g+..fp..Em~\|..K.....2Zg^p.wO!...T.2}..4.\WX....p.Qs.&.>wGj..r...'....zEy.....3..(wz.9..t>.n._..:?....nf.........9......1....J..\|.p...L../PK..............PK.........n/Q............5...classes/com/sun/tools/attach/AgentLoadException.cl

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.crypto.cryptoki.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	351274
Entropy (8bit):	7.9627246365800355
Encrypted:	false
SSDEEP:	6144:ulMVIrmuMtJv/bpPkLG9zDEUa9NcHCwegOkCh0Tmj3/pxk3UKFZW7dc:ul6tltM6xDja9CCuOkChC0BxkkKFZwc
MD5:	1327D707FBB8DF3EE0D70D15A9C0D040
SHA1:	C4659E3754C6FA51E043AF8154AF8A9EE18A6F48
SHA-256:	EF9D8D43781AF4C7A1952014806FD3E36036DF92D62E79A3C0AF021CAB6EDA50
SHA-512:	E67C3E11EA5E962345CAC9682BE0F66E21CEB754AAAB2B48EC504D5EC50462BE5A96F59E28F046F9D3565E6C27214BD1793D8354DFA13FD99A2783EC44AA3AB5
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmP.N.@.=W...G+..7.)N.n\..1&M......N3...\..~.q..Xp..>........W..L'.T.U..=..t'.N....I...,.BoT.\|4.M....!l.....Q.b...2..#\.I...\..-B...~p+}t...QR....5b.#2z..i<..n....,z}...pFh.4B...t....#..F.E.......;7cY.=.%..C>K.............[.9.t~wYg..{..s\l..hc.....PK..gz"J........PK.........n/Q...............classes/sun/security/pkcs11/Config$1.class.SkO.@.=...}T..P...q..u...%$H @.G....t....!3S....(.?..e.....tn...s.....w.5.-".....>.3...'...Q...?.a._..0...re/.<.....<..0....@W.....SCD........).q.u.E..Q1/..-..6.1.W..6.....fG.c..).r.R.Q.^.E.P...%...Gi...(....W..t....%....6&..a ......dPF.0.]..XW...-~!W+b.....x.......k..,......8bp.=2..0L...{G.....o..FH".e.3..E..}.v.......?..H.]0g.B.j..=.....\|.+...ok..v/.i.\.u...u&^.....K*..2V._...J...$..Y..Pj...-..^1._.l....fM&..^."..C_k.1M......,.t.h6K_.E. s_.>.G.Oi.O..(.hw.P..E....J..$...u,.p..3\|......{v!6Fd`.9...u.`..4.#>....r..-Q..=.~....:...DM.KT).0O.......EbM!}~.PK....8.H....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.crypto.ec.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	201772
Entropy (8bit):	7.9524710852936815
Encrypted:	false
SSDEEP:	6144:9qVHcUYpfJbKNaLV2ppHAVxWHj+f/ehKAqW:9icZp0yVOxA30j+f/eJqW
MD5:	263F17CDB67CA9DC7704B373ED4FFE6C
SHA1:	6F8E27D98F9187BF6A19A6C048E4C1E8AD43D2B1
SHA-256:	C35E8D06078F41B89D152DF528C0F577A65BEE1235379B17E0C5BC54867B80FE
SHA-512:	6C3689F290F6FAC4A090B6F01B7C2E70390F158F548D2E3F3F04F5383C895DA6F2D0092A254FE85D3FE0FA9BDA8F50DA72173ACC9A0AC99F590A22D6E370D3B3
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmOIN.A.}_.f...t....D.4.3!...U_R.]....s.....X.q..'.x/.O...'..\..s....M.n...........DO.r.Ef...%Byp'n..J.$NY..d.U...9"c.....1..&."...b.x.).h.z.....]...@.).<yz.pA..l..?...._......P...sJh..W....V&.v...\..n..\|[.!.\|...k..X.....x...A........z.../PK...I......l...PK.........n/Q................classes/sun/security/ec/ECDHKeyAgreement.class.Z.\|...?.$_2....`F.F..9. ^...@.!.. .:.\|IF&.s......wW.j.-.....El..V..n...]{............f&a2.....3..{<...?....}.k.....9.5.2..\|..+......h_$n7\`.-.ZV...."AA..`8../....@..JMh.Y.D4..kX......'.p.N:.iK....v.....+.......)...$bqo....cq.8`y.N..rn..D.9NPY.....]..x4..;c..e(70.D.*.I,.....4,n.2K.......q[w.NO.....32...........\.....f....x.'.......-Z:...w$=Yp..D..e..f../N..F..`@.~...qT.d..Y..0.e.{w.....cq...M#...1o.S.H...7...M..M.@....]...B..fg3\|F.O5......g..\.`..[B!.....i..2...k. ..Aj.E.R.....LX..Y^.(j.;...fnAY.p..qy8..o....4....\|2.S.7..5R..G.....S....8S0c$....C.&...%-.].\.98.D#...]V\.;F.V

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.crypto.mscapi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	78196
Entropy (8bit):	7.92845847050618
Encrypted:	false
SSDEEP:	1536:k2Na/LNYo4Z/rkUG3FVnJP1Uufitv3eQccdatnKdknGFe3mUsGwzMOpOICSCSKPm:Z4CQls2igDGFiCgtIVjqSi4Hh
MD5:	6F42045F475CC7E5AFCE90B03AA6ECE0
SHA1:	51D26AA2154B906A29A931151887E9EA5C11962C
SHA-256:	F35CBD067FA654E4782847D60E27BC6BB19329C144CE724836E11ED3024885BE
SHA-512:	630781278A0BD196D38765E37566E8704CD09EFB48E267EAF541AFF60D0B3585884F4F27E5F6C4A0E5AA1536B5CB1F84DCA65E02FD80D22F5AFF296D2E6DC396
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmN.N.0....P..%.'..:T.......J.....Tn....V...8..\|..I...J.....~\|........+5...@...[..'..r..K.r'.Z.h....v...."qJx..].0...J.^.S1:.....Sk6Z..K...F..b.=.O.....x+.^.`>..$..!.b....z...............8.w.p...b....Bm#...(..B.0...c....PK.........E...PK.........n/Q............4...classes/sun/security/mscapi/CKey$NativeHandles.class.R.O.P...V.v..(.. ..6..#AQ3!8.4...xW..P......#.A.y.O.A=....@b....{.......o...`.@.I.......vy....?....R.].W....V.idt.&..dX.z...........u..+1.o......x"b0:.p..A...%......K.d`..:.&.c.a."r......v.F..RK..)y..{...Y0h.`. .p}...E....}.h...Z<t....w\.....C.0d.b..m.b.Qf.......Cjc.#........:b...$.#.h.. ".../..H..G.e./A.'_...'.0........C.V@...fe.@.!k.d6K.j..8.....PE..0....!Y..3T)......+...f..I.$..M...J#.Z..?.#R;B..c.3,.. ..\|z.f.r..)...b.A....U.....T.Z0(>.]......g.......T..&..55.p....EuV..%..i]:.....:A..A..%R.....q.$4...\|..PK...S;W*...E...PK.........n/Q............&...classes/

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.dynalink.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	164226
Entropy (8bit):	7.892034326519069
Encrypted:	false
SSDEEP:	3072:WduPEhfhy9SH8Y4zuTV/9nrPcTYxt7qnbN6LjTjAW6+w0ghchJK44kupSzOxGwQJ:WduchfIgHAzuTdR4TYxt7qnbN63TjAWN
MD5:	5F943224E4AF329272D7FDC2066583CF
SHA1:	895810831A50558AEA8DE45E121E5166030B9E54
SHA-256:	AE6BB704E5073B9A0A72E767E7621077E78905799EA24493D23F11E41B6D8E83
SHA-512:	BDFC9110CE85062532C583920D2AB6D4EEF9345E87FE5C68264C3E83020705E3AD3C4ABFA248C4C3C59FA9718EFD288B19DAA78C684A856F847D5F6864C24015
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmP.N.A..V..Fv.....J.^..........e...7....G.g.1.0...JM...>..\.P.'a...T.I.Dh.....qBu....C.X..........B...C..Ze...e(..k.TS.M.P!xk....j...!H..$.S.......]B...y<xvO;.I.I.yh.z...3.C.1.X...{.nS..b.P~N2=.w2.....V...y...Dj.[./\GbJ....Y.....\|.la.r8...qd.5...ffs..9O.;.....6...R...;N-.w.U.5.~..O~.PK...?.y).......PK.........n/Q............5...classes/jdk/dynalink/beans/AbstractJavaLinker$1.class.S]O.P.~.6.m...0......B.7.b37.n]B..p...'.PZ.v3..o.V.c.......i0.....y.~....ur.`.k%d.U.S1.<..{.......@......G.p.`.:<.........m.............3.....U\|..Q@QAI.(T...83zq.q'y..I...U.-...%N..42...i..v.j2.f..3.b.e...;.....m3l^.<..I..1.......b.T0.0.O5.>..t+..N....GQ..**n.)...1.Z..nH..../.v...6.K.{..Ym...>C..{../..,6...K6.$vH.....j....=.ux.'f.I..;<.$>#..;...3\..A.'...Z....z..a..{-..CW......5.l.8y...j...j>.c.+x.\|..0._.Oy....=.V...(O.<.C.......h\|.;.Q......Z....7).!8r.g......J.?#.".0...P.G$...g$...K.Y.S....9!....hM..V!...\|..ZU<

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.editpad.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	7108
Entropy (8bit):	7.811258404475187
Encrypted:	false
SSDEEP:	192:Q8DM/XTGw6L+YSUUgagGBdzubltchdvvWKdNsAlsB46c:Q8DM/jGNx7agGKblGDGLAD
MD5:	AA734D758967C9CC99D97CADAF2CF600
SHA1:	C11F74087C937E8A29C7B8E9E796896D0D9359CA
SHA-256:	614B6DAD2877EAC8D0E1F7D29F2067356C3ACC3CAA40DC6DCA23953F416D79DE
SHA-512:	959EDABC1255EF215CD76F949FCD6B1809D9A8E01BB320165AF0E9462EBFE62646A6DDE9017FE55944B5B9036C2FAAD87064C2EE64B46EE80511A0C6761CE988
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMOKN.0..WJK...\|/.&....;$.X E....Tn.8..v.s......8T..y3.y.~~...<...[)^$..j.....,.Y...2....$.fw.M0....M..P...=.f...S......=B.\.8W...aT..i.t..;.....;.9+..L...L.K..H...B.qL..g(....#t.\.g.....0.>...l!.MX..L/DN.ld....l..o.@..jb..?..}.qh.....:..."..3...5p......PK..5^..........PK.........n/Q............#...classes/jdk/editpad/EditPad$1.class}RmO.0.~..........o.J....i..:mR.&@E..4.......].@.......vv.m.E..r~...{....@.[S......J..W.u(b.oy...~.q..P.2... @4...)x.^.'A7Is.1.EW.......?OD....O\|.QaX..>........t...[m(Jo.....x}.3.j..\|.....z.a.^..H.v..i.1.#..A..\d.C.j.vy..4...c...iQ.`..03.M.....`X.G.]..o.0.]...n.(.e].A.....I!.m....,.e....j...&.D.?..&.OJ....<.9V..}...J.<%@...Dh...j......i...k...m\|..W.\|F{..@.../.....`..{N....=Y...wp.c....gONI.._\|.o>...L...79.X#.`.5l..:6-nX.._PK.....m........PK.........n/Q............!...classes/jdk/editpad/EditPad.class.X.\.....e..,.X....&..B ...l,`b...CD...@6,3.;.....n....nz7..$.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.httpserver.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	102118
Entropy (8bit):	7.881915775504197
Encrypted:	false
SSDEEP:	1536:hA2EjV4dImyeS82MzTdgErULKjFp4Fm1CMfe1ChqmxrMylQEnEfc6o3zqZ1o:+2Ej5mlP5rUGjFp4FbMfe18r2TYMZm
MD5:	F4F26CF1AABC52F9C792551E45F971CD
SHA1:	98F52335B802EDE4918EBE4725E79BF59BD48029
SHA-256:	AFDA7A68032E31314698D506E38EE63682A506BB72D6620DAFEA6DA1578585A6
SHA-512:	820ACBB8CAC8E19383B5B5D93AA475E83186148022EFCC125001ED2A3CDE96B9F131D083300D62167687442865ACC79644E169553A4C749FDF0E43203C938124
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuP.N.0..../.M.3.8T......J..Lb..&..$...8..\|.b..PV...xv...w.w..z...Jt.b.....!...y...U.r.6.Fh....q%.Qf...eZ.........R..1:.....}W<K."....m...S.'.4:W6...;5...^......%..-.L9B.G<I;S.a..en...E~{....c-.a..1...G.....x>.....1b.."d......PK..D.......}...PK.........n/Q............:...classes/com/sun/net/httpserver/Authenticator$Failure.class.R.N.@.}..R.............CbH.$....n...dw.Wy1.x...(.tA.nx..7;....~}.\|.h.$...&...d..h..8tB...R3....&V...sU$.C..@1d...Wm.t.>...e"oc.6..ZL]..b..l..,.%.D..Y.....#r.L..\|.O.\..2.~....~..ICM\|.....}......H..HD.......r....]..Ku.Ie..N_....\t.WJNr...5..pJ.L..1..O.R.g.Iv.P.pr.o..5o0_tM....d/`.....M.........VZ4v...t4.2.W...tY.lk.{Q..Ic_W.p.}.G.ZZ..#..e....PK..1P..g...p...PK.........n/Q............9...classes/com/sun/net/httpserver/Authenticator$Result.class.P.J.1.=i...Zm...B....*..D.TP.{..n.6.$.......G..[_\|....9..I........).h&..h!../.J.B..y?_P...Kmt..h......N3...4.P.y.......CN&.L....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.incubator.foreign.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	67990
Entropy (8bit):	7.946352945303167
Encrypted:	false
SSDEEP:	1536:bUJtgSL6NznTI0AE1ZSxiubggeSqtx0xp/2hQ9rW76B93ap:bytF6NbBz1ZS3bggeSqtxq5/rW76vKp
MD5:	E9CBB864F1F0780B15F40963C426E6F3
SHA1:	F910917052336D532732647BCDB73D80DF612C62
SHA-256:	FEEEBA790ABE0CD4A36BBC68FE29185B4A152663ED5FC6B6261FB40E729D3B21
SHA-512:	DE83F8F52040E862A495881C59A5FAD444A012DCDCFE65B56896A079D6DE1B4668138F48C9E50E091BD2F83E11F090CDBC38E47FAD52186DC6ACCE6994027535
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMNAR.@..A...h...X.J.p.F..~`H..B..$r.].\|....dE...t.t....'..bBog...6k........w&.m..&.V\Z....L.sB{....4x&...g..a..R....D...W+.$F..]..%.s....a..WN..I...b!..R[C.....LJB..Mj..w....h...Q.g..y.o...p.U.%N.n....6_.n.y..PK..%an.....C...PK.........n/Q............2...classes/jdk/incubator/foreign/AbstractLayout.class.Yy\\.......p.0d5. faI..!b.!.D.".Db.w...I......R..6.Q[M\....kB..4..>.Zkm.Z.V...^.....s.af...o.....9.w.s~..._...PO.9..\.6.y.'.l.....ZpS][.f..%./.....BnUuW..(P.PQ...`.oK.?..j.P../.....u...hX.F[..P.I."..t....z,....F....h..7...i.QB(..Lb@.2..s..2..U..L...M.@..c".Bq,8.....Zo@o....UI..L}u..9[...Aph.h.....B+.P......m..B.!SL;.....s]P....C..J.'.m.G......34....../K..Q.R.X(.?.]...T,."Q..U.6..`...*..LX.jP.`...8.P..h...mZX?/....P........4..[&O9...Uq..'.i...!..M.-.Ia./.4,_..z`.O.W....d.BpN...w@..C...B,.+f...D....a......G...b...hb.....d:.4.z..F...X.Q.E...9FJ..ay..\X....-hM..@.g......LsV.....b.Z..eu..3%U...'E

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.incubator.jpackage.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	944571
Entropy (8bit):	7.993019507850888
Encrypted:	true
SSDEEP:	24576:o/LKQfuCSkRb5ZBlZQQILYqwjypRJ0lqmAp:4LKQmCj1lZQvLYqweh2Wp
MD5:	D202B393A656A5E8C68687B4D33F55C4
SHA1:	9B41A22AD8105D3CF3961AD8F4D6E750BCF291B4
SHA-256:	5619F01649B53255A0A3E68CFEC3A4AD2DE6200F83E347DFFE083F0839AC467D
SHA-512:	01CE53A2C06BCA793DB0AA9E7011A3D4C734EC1B4DEB289CF3E57973514DFE25D325C3C401798EE22CA06FEB47D643CCD73880F064AFF27449691C189C7D7AEA
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class...N.0...a+-;-...C....\@.....$.1.mjGq...\.x...1Ii..j}...G...\|{.p.2a.a.....M.D..%85.,..5..(]..DdB...j]<.".......OXa.. .....P.......rCiM.V.-!OX..o..K."....a...$.Bk..."...i........N...b..2.H....9L....8R.k....._..Yy.m3..N.]^....9B...^.. .J_..r.*3.Rw.+.2.J..3aU.........<;W..F[....<.-.../5....D.$#...y.......@....H.^l.~.10..h3...dF...i..{..^,b....... k.(`..)..N..~.PK..-O..~...H...PK.........n/Q............N...classes/jdk/incubator/jpackage/internal/AbstractAppImageBuilder$IconType.class.TmO.A.~.^{.yH..K._....."j.)..M.H,6!~..G.r.k......h..2..%"U?..d.3..>..........#........Y...x.z.F....nR(0=.....x...Z.R.2.eo..x.p...-3..EG.1...s..v..6}7..s....a.\|Q..`..H.&......9...C...{.....I.u..T~.Za(.....)\W.....Q.v...?.-7......6j....;.!..:.I.~.V..I......;.s.3.E..~.L..x.S.e....Gu..m:...X.".@........).q$.....:.`B.G...V3.K..i9.P).......a.fz..fS......N.]..U.Y...8.i.\.'.w.)MT....#\$...-.v......pq..D.U..Y.....L.jR.n

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.ed.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	7519
Entropy (8bit):	7.847897535550514
Encrypted:	false
SSDEEP:	192:5IDZZqI952/n+g5u2ssRZZl3ewqKdNsAls7+B:2DZP9HgAuHZo1LAR
MD5:	C8936F98B9091974AE938C3DA77A2F25
SHA1:	F5A9C8C0883DE8EA79C3BD9D8AC3F80C11320157
SHA-256:	138B3AEDC0F46E2CAC688CDB36B78E9B06D102E8DC9C3E6F8A7CC8ACAC993263
SHA-512:	BB4BB7268C81DD734DE01977AA2AFD1CB4301C09EDA7D1D6E396EB7E24034520F52AB4111B9722EC32FE2DAB158D21B5DDD4EC579FB29125BBA3BD91089AAC4C
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmP.N.0..-..)}@.\...u..\.sCB..0.R..I...c.....G!...8..zgv.3....'.[......Ol.RtA...Be.M.F.Y(..\..)61...Z].).\..n...uQ.....]....je...=.u.1...{y.J...y".^..#.....u,!.CX.i..l..\....I.s.....M..&zin..@.....<........E.P...@:...8.Z.FH....PK..........Y...PK.........n/Q............;...classes/jdk/internal/editor/external/ExternalEditor$1.class.T[O.A......R..!.U[n......5@J1....``.%.[..JM.....h.Oj.5...P 5n..g....sf..y..@..a...._A...c..MU....MWyY8...]o....'.Z.ua.'(0.Dd...AD..Aa...v4....t.......X...O<3..N...H."..#.N...c.:.....Q.:w8C_"{.....0...D..>.f.?.".p..;......B.i.......,C.0i.j}^A?..y....PX.D.\|..0..T.....v.i..'..r...E...kp=...P.t..X.Xq..@.E...S.'R3L$...d..?g.)...0x..U..Vt..e...4K.kO.w.Am.&>I..We.....!.n...D=."...A.{.y.c..~......z....=.h..%m....5]3........X0<;..?..k..T,.\|:{..i..[.Y.J.:.].{9...d..n..X[..Y.b.a...P.v..]Qw.C9n;.tD........6.1H.DW'..toL........$...B....k.....U....\|./.B....".H)

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.jvmstat.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.8478943536932055
Encrypted:	false
SSDEEP:	1536:3fa+mzmuYgDlJR3aOy11mrrGFHz6FH2TD8YR7IactS5HK/6YVGz2OMPCzn3/PQPr:v1mzh9vX/az6FH2TDjIStA6gODz3/P2
MD5:	2F1AED1638554EC6D6479CCFECE4F6FE
SHA1:	767011B093A860A269947435B42A0918A031DBCB
SHA-256:	1CD4ED9D066D1C5D2B8E179DED7024F2B52FCF9364F1C0765C5D579FF73CB2BA
SHA-512:	987952BF02E87A4011B77A25CF3811BBB91FA0C166F3F7BD31C83A705A821685252F4F9C280AC77834EF6AE8BD57D96A467E8D2873BE1B8ED898F18AA72B195E
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.R.N.@.}..a....`..`l..\rAB . !.;j.......c.\|..> .....2H#.K.U...k..........a8Ua+..(k...0..x.(....K/..3.xq.j#..>B.c....,.[...qQ!8....,2w1H....e!3..&.v..d....O.#.....U...T.7.D..#.....@$.&../....M...-K.$..r.U+..v1E..>{gBK..!.0F...f.....4t0G..+.i.0..=?..0c.....v....D.E......o...>#.B+..w..\..B.R...NJw...dG.F.F......lE..#.si.#.Q..k].i........?`.^.q.....A.rc...9..a......g...G{/.....uFx.1..Uf..#.....l.?PK....vR....d...PK.........n/Q............1...classes/sun/jvmstat/monitor/AbstractMonitor.class.TKS.P..n....$(".".G}"BE..3u.8V..F..J..&I;:...n....3....(.sob[..7.'..{.s..._...X..\|.......w.W.xA/..[..#.0t%..,3...L.....).Ca..+..A.h;../.).l.W..c.9g.}g.Jz.`.H5..e..K..GA/....J..FR.H.....Pp....n.z.,.......L#E`..\.%..JG+[)..w..X.o^V0.+.A.rxX..c.vvB.s.Wg.!.m?._....N2..a..dL...3.p....v..].....3..%9.(b../.HUi...ik'3....w.E.).dlV.Y.z.g..i.^pM.........li....].X.A......h.3S.(aM..7)..P....v..a.%..N.z(5.<g.......ig..[

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.le.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	424947
Entropy (8bit):	7.938896145421226
Encrypted:	false
SSDEEP:	6144:kDK++kib1+dsmo6Asyn7XP8VClZe/vgPpHH8qUINO2QEnPyf2rQ5ASe:UrwbQno6AB7XPgCn/Bn8NMfQIy6Ke
MD5:	4A46A0B3A85C592A5CD1A875C466E386
SHA1:	9863CCC4CEF7FE3A46FB9A99CB367346B8872D3F
SHA-256:	05EB47739AC18826EA713F68E0611EB59950255AB002FE3CC7CDED75A9CC2464
SHA-512:	9D1B7EF66CD98A22C3A6E160F315263643F444A86F8C237C98E1FA6101A3A607B49266E085D45AF9F8A1FB232DB85248C046DA22FF2B6B679656EF6CD8C71DCD
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.R.N.@.=S(n......P...E.%R/.}..J..?..7a..E.....C?..B.a.VBib.sv.3......?.>.P..`j...G.."l.C..:W.f.L\|..:....na.......}.6g.,+.l,Ckb-'.2R..7_.i..L.B..W"M.Z...x.N....(+..GK8.L^$.@..3G.Dd...$.....[..e.2......{...&.xN.-r..xI...N.cs.W.J9n...y..j9.0?...C.......4M.....i...5~e.C...$.l......}........N.X..{... .....E~.....+..f..P.W..q....@x}Uf+x...U.....7.n9....;...u...y..5.^......g..qp...-PK.....i........PK.........n/Q............9...classes/jdk/internal/org/jline/keymap/BindingReader.class.X.xTW...,y.......)....iM..2.......\x.yI.&..Y..wk.j.R7.......m.. ....k.k......of2Y@.~....}.....s......j...k.g.2..Vk..NX...v4.P..O.3.....~.....7.eR..PW6.....x+P..@..sP..5.-.Of.T.J...Pxk"......#.h.+....sl.....hWvpP.s{N#.....Yz5..'.+S)k...Y;....,.!.(....p.......sF.8.&h..sL..<...kqa.i...t..Iv%.....r.5....*.K.,...t...x..c.5.~v.65.L......yXL..+.).>w.....\``....^a..HeT..L..M....0......Q.}s.4..".M4...M....Q.,,3......@Z.......

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.opt.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	81856
Entropy (8bit):	7.846420334642564
Encrypted:	false
SSDEEP:	1536:11nsYEHYbC3DfjgQb6r1sPX2ShUVu4J6FI8pn2aGZsUpCi7Lre7jDZXG3tQ9D:1BsYiQqDMriX2PVuM6SGrOLsK3UDZXMM
MD5:	E47B28481EE70BB515D1ACFC17C9D84F
SHA1:	5BD36C3121AD501400D8A92546DA6A72FCDC271F
SHA-256:	545BFD82162D6262FE190F86F86DD497E1665235EE2D1129CD5D5E1AEA908C2F
SHA-512:	2AEA39B26710427B528BBEBAF3A88DD9D6CC8ECF350E99E99FFD7437729CC234D958601FAD30AB844077FC190190E2DDD3E90528B56FEAC451065F459CE18800
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classu.MN.0...Ai.?($P.,z..T.n.g....0.)N...........R....od.......&t3..F..}s-.a......l%q.-Tn..nU.h...{q+..!...O..^g+.".......&..J...D....W.U.~%.Rb.MC..:......]./.6..>.?"...Or.....x..R...Z...Xf..n..a...Q.cD<G8..~rSQBP...~..N.......PK.....S....x...PK.........n/Q............8...classes/jdk/internal/joptsimple/AbstractOptionSpec.class.W.........N...X 4....d..,.......$..V..N..vg..Y.......-.m..j[j.-..V.O~>../....{g&.}.6~..{...\|..s..\|.........@.B.x.a..mj.....:F....\.0....)..P.(.qA;...]#.......kX.#..P8...9f8....1O2...........[.,.....@.Z...X........:......9U....A.4.!.......]..I ...6HS...VB.h..Q.I`...a..NI...a}..nV.....U.._[i^z.UE'..h....'...W..z.T..;..3....O\ Y.<...F.M...1..m6....Z.5..z.......m+E=..N..'.\Qw&...[o...6.[.=..c.i...X..RB..Uq/.9.~T.......>..U.}P..\?...Tf..yR..#....X........Z\|.F..\..<./.u/.....]...\|....:...\|1..n....cD&...D.)UG.de:k[.I....x..8...xL`g}Q.P=...\)......=.b...M.....

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.vm.ci.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	441292
Entropy (8bit):	7.904078584539265
Encrypted:	false
SSDEEP:	12288:xL9PUt54BixmIWVjQgCjiub1RU53P8tP9:xLhJgxmIUcWuxv9
MD5:	E46EA1F70112D65C273DEF5E61194944
SHA1:	A0545A8DE36BD509813D6E0D0A0FAB9C400494F4
SHA-256:	08738A27A0B852F2F928066F40F28B0ECF3B7AE383BE8670BE40EC51E3F322DC
SHA-512:	E7486E285DDA9376342303901C2C97216071E1512A7AA9E6D1AEDF3DF8D0639FD2F74F0B00028E9B2B186633C4FFB04B0D02ED25B7573903E114F052E8253C2D
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class}R.r.0.=.mC...z.PJ..h........t.I.w!..mdul%...]<..\|....4!.~.........?....a...2.8..* .\. OUG..N.3.'..j..:.0B....{.F..cC..J....s..a...Q...f.@."#0I...0.=..../.>..e.........r.\|v.@@X...t.&,........+..1i;.e.wK..pf.N.M&p.0..(....X#,....y.2i.u..0VZ..ccM..l.6....>7.o...N+.....v.o...&..5.j..@in.V..a..ea.^....!..bjXo....)a...6.\|o~f..E.(.O\.Fd...8R...8..EV-.].7...A...&$.C..:.......}.GX...pF.Mu.....6..=..B.V...&x.........].....oPK....V....x...PK.........n/Q............)...classes/jdk/vm/ci/aarch64/AArch64$1.classu..N.@..a...:.(G..r.@.....c\Y..%x..C;a...i.k.3..01>..jb.1<.....?#I....../........c..X,....Y.v..z..C..p\.i.D8.EKl...k..)c.....9....(X(r\.g.HsBDn}v.YZ2jO1...~..7.MA..].....m....x...%.kY.@....."...8....*..P..........t...;UUk..u_..Z..H....g...I.6.8...^..(..u..&.R...M.amd.....L...}m.q.k#..w ]...q....(a.{..&...{..p......+C~....O..vt.....?..fcOF..3tU.+.....O.Z".C.....T3r........\..@.~..)...,...

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.vm.compiler.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	6393414
Entropy (8bit):	7.903376019710367
Encrypted:	false
SSDEEP:	98304:6owraaSV2UUIicONZ4L/LgvXXtasDSECRrs+b5Fr4zvFTTJNzH8mQ:6oWbSPCeL/svX9Nwxs+b7r4zNplG
MD5:	9F834ABEAAC75525F0FCF228B7A60574
SHA1:	179F4A4E8E30686AD80582F3A0A1E1F178E50BA3
SHA-256:	8B66F9D8245ACAA5E2EF406C443E33D1FA9D3ACDCB6FC93A439C4EA1FCB15442
SHA-512:	81976CB0DC4FDAEF67BCE6276123DEF0ACDFA98B6ADDE9EF4350A018D03C57E3B3F0F8FEC5451AA34AACEF802476FF6561E8161DC9AB1F8FCDC077FB7C872035
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.\.x.V..ym.6mS.^...m.&e0.N....I......X+m%...L...\|.....zL=f..]...yz.5..n.}+.v....Q.}..G..l. .e.P....r:...l...1...^..4m_..au.;.N.bZ.].;".X......G.X6.......aY2..e...pV.2'..aX....`Vl.q.....D..Y.....G:n1. 7...3[0]..$..@8..te.2.,m.D.B8....Y..XM.....x......K.O......R....+39..S U.D.?VD.\|0..K?.J...\..p.C...Gr.....cg.h.c...e9.....[.l.H.x.i..T1.'.#.U...i...\|..mG....\...EI6:5..e..2......).(..nQ..8..X........~.....\...Y.......9.c.....pP.L..C..p..%...X.,..!M... g.H.2..\.U$U........d...g..2.E.'.![q.).2mz...m..D..bn$..oK....J_......./E8>.Is\.<....Z.m........y.2..cQ...)....N...4z.<Z.b.J..0.$.Px.#:.Zw.2......G..L..\R..2.Y.#a/....\T....:..:C..C....S ...k..Q.y..\|.B......xsC...Sd....6..eY6..%.(.:.%.8...p...7)..wqD...'I....K....i.r..i.p.U....L.',.!+=....\{..r.Q.R...x>.1..B.:.....AB!U...X.4z9.ZJ....H...Lz5/[$.^.pb..J.U.*H..>...&...F..h....K...\.o.....+=2.-...oMVO.'.ir......1]...@..h

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.internal.vm.compiler.management.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	12298
Entropy (8bit):	7.8734358073542
Encrypted:	false
SSDEEP:	384:4sWbgcyF3vE5ImBmW6oJ4+cbE3Rcfd8wxmy6zvXLAD:4s/cs3vEGmBmCKBP9Z6rQ
MD5:	34DFDC94E39761FC9E046893E561D671
SHA1:	A15D2FDDC81E8055E85289E409EEDD31B73DEF4B
SHA-256:	05334CBAC51A75673F23943BA026B79672440C477A0E69608FEA456C02A36834
SHA-512:	CA394A70EFE1AA102B2C01DD1CA6749009953B66FF5F426A50CFC9FEEB1452C756A72654A839D01F202A4BBBECD54CF6B4638EFC1F5AE0CDA1E41D7D0B3C1983
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.P.N.@.=W...)>v.\1....N....F:.B.C..l...~..e.. $..M...s.._....qJ(I.O"...W...5...)'.....c#t.#6.l..8..f..<.R..E...\...!.+.x..<.Jo..)....VUM8.B...D.(.j...\"T...}.B..X.....i\.{..?G{P.o.}....{.A...M.b.....m.s.O(..D..-...eW...>.\|0.....p<s..C....W......[XJ..H.m...b.b.bq.F.YN5.z.......G..a.....7PK..../.+...,...PK.........n/Q............Y...classes/META-INF/providers/org.graalvm.compiler.hotspot.management.HotSpotGraalManagement./J.K/JL.)..K..-..I-.../)../.../.... y................<^..PK...:.Y?...A...PK.........n/Q............_...classes/org/graalvm/compiler/hotspot/management/HotSpotGraalManagement$RegistrationThread.class.V.S.W.....C+..4..&.\.1......b..0.$...f.0..t..A..jn.....MQ...>.U..T.%y.C..}IYK....C...x...\|..v.......t...X%.?..#E/xL.v~.v.,H7.<m.sX..?Pv.xn..h0...F.u..I;...\z...vV`...u...mqk.t$P...N...C.......x.S.tN{.,.3^...J....h...tm..Wc[@.....r<.......u&.A.@.......l.p..6..4......xb....Ml...Y9!..4..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jartool.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	194472
Entropy (8bit):	7.970641034460952
Encrypted:	false
SSDEEP:	3072:MgedXNLqa3FbTV5vUwRraR677wbxsv1EGo76TIObRkax7vJk4VsDkT9hym9oAlzK:bIXFH31fvYRe7wbY1pH/7vS4okT9IAZ6
MD5:	325C9BAC6B43ED148BFAB975BA7EC749
SHA1:	112602CC92CB5706740FE8E470245CE5131ADD46
SHA-256:	0DD5B5ECAB1D3C4227330FF96B2CD0782BFF4C1DA082DD5BC667C693143454CB
SHA-512:	15DD1150F5BA2634EE32016FF470C5BDB6F51FFDE32E7A94265CC2298ADB1777526C907310086B5940762F78D317A051C927DF2D69D03F0CF2B35EA68B3BF61E
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classU..N.1..Qd./...x..V........@...lM....sy..\|(....4i;.}..L.......CB}i.,V#....Dh...\.$3.h..M...(.....6..:.Y..%.].g..><B...Safu...U....yyK.O.....>....$.r&..r>N..\|..M:.E.0.S..:..C.)WM.Y.HY.]..a.gi..sB.h..c.})>........L9Bc+L.....^.$2k7....n......G.......Y..l.B..Tm..\|.=\r.`..^.-.1(..?PK.....k........PK.........n/Q............-...classes/com/sun/jarsigner/ContentSigner.class.QMo.1.}.l.%..Z(....h{...J..R....N..&.v...V.8!.....U1kPKO.....{......9..6.X@#G..&Z..\.JQH;...V..zo......a.E.r....s.Z.E..m......D......k.M..FV.N.b(....`.g&......~.. .N.d_FIx.}.....Q....v..$.?.P.$.gC.....U.M.)..R..b.8..W.....or..Q..c.....k..D6N\|9.......J.6.)7j}S....O...M..G....C...l.Z.e......{...NO.8..G.t..h..).B......=.;........+]......l......2.},3.al..<......O...y..g.=.x..#l..PK..aHL.........PK.........n/Q............7...classes/com/sun/jarsigner/ContentSignerParameters.class.R]O.A..C..Zi..T...i..`B..n5.4...x.n..4.3..,...}.....w

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.javadoc.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	1211177
Entropy (8bit):	7.944554747269419
Encrypted:	false
SSDEEP:	24576:c4xHrlw1+43XYwN5YYB8d9PBEJAqxM6EClnYCRwQz:t5B69YYOrPeJfMrypz
MD5:	038AEACBF82A840FB86C19767F657F72
SHA1:	7883E63F46B7CB0847ECA59BEF4DF7D8A3EC8D72
SHA-256:	1430B8D1685F5DE76F26C54B56C81D5C1069358CD4709BC3DCB6FFCCB0913264
SHA-512:	154779EDA97F99703796A169D00BB37FBF46C4D1ED87F9954943860828FEA6DE3CBC0D282511977C0E5C56C084E801C5E736CD35A41AFC448E2B192F2EF5DA95
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.S.R.@.=-H..J........E..^\|.\|......dX.\f+........,;..X..IUz.O..3.3....o...-a:1a...NO.."t...&.%s...NC...'L...=..0...+"..U..!xM\...R.{.$,...9....[C.u.\..,.<~).N6K..DfQ9.p...^...Y.r.w.........]B..S..:.U.....V.....[i..\|...k.,47..A...X....LX....V.k#.....&+.."s.b.p..I..)a.z.I.:V....LuM. [...To/.hq.k.f.\s....uLv+.j.oI..\./-'..LP&-d.MZQ..Q..x3..~>.f...%L..&\|.2..}..0WO.e.....8.Y_......"..$<..n....>...<..M...._U.g...U...^..a.}.=./.g.+..a.YS..yx...,.!GV....o~.PK..~.AI....k...PK.........n/Q............3...classes/jdk/javadoc/doclet/Doclet$Option$Kind.class.T.O.P.=o..t2'.CP.!.(u*l.....l.....V.XZ.u\|.b..@F"D..o?..GQ..l..}.s.=..u_.}.. ...!....+}..1.^C..c.zQ.L..o{n..6.`.TD.e....J.b..0Y..........Jqi..}T..Tk+.5.9...I.9S_?-......(H....\$.....-s...^...>a.pIFZ.0.S......;.../.f.S.e.l..........\@...........v......Q..Gc.......M.6..SZ..6P.....5...e.....U37.....$.~..5L.n.l..HJ..m.3...N.7]...

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jcmd.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	148116
Entropy (8bit):	7.957089717075174
Encrypted:	false
SSDEEP:	3072:ep6J8WzaQPEnQilSKrKbu4orXtAw8BEI6KyVmX632j:c6eiOPObu4OAw8B7B/N
MD5:	7FE2728D9C5445BD2E8BCE58C8EB596B
SHA1:	DC5E88F003CE98F92BBC47558BEB041FD42316E9
SHA-256:	6E07BA1C7EF067AF05AAA9B6C5EBA558C9B7C110BE19A4B8CA92750718FFD195
SHA-512:	55694DC5A5F13F82C5E2E411BB17A5CF46B350A0CB4C25952CD35B57E98B6B9AF0652DEE4F4B365401E0DCB4AB6F2C873E6F8FF015D178E211B6655F025C5040
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class]P.N.0..C.A.RvzoB%.......ILI..U...~..>..B<.B$<...c...?>..c..Q:.c9..7..c...7.K......*pPc.Oo.kwJJ.'^.ul<_+....C...G8Z...g}9:U.....C..-..rKd2..9v...f........<.%9.3.l..U.....mS..,......a..4...-..ppB....!.%..,...Y<..L...x..Lf.e.&.^..P......o.p...qN..;4......q.9E....I.......8.e.s..PK....Z.........PK.........n/Q............1...classes/sun/tools/common/PrintStreamPrinter.class.T.s.U...vwo.l.Q..V .....BM.R..`.Bkg:}q...b...l.8.....o<..Kp.w..c....%..f.3.{..\|.9.g....O..q..1...S..=....p.;..{......0H....u...T..D.+..m?....NV..ww,HX.l...\|..9.QV,.....m..q..../.g.,.8..&.fF...J.I..a..{.F.o.../.Y)T-..#.)..o.....R...-..E..m.I@..Y.p.'$r6N.......`.^.do.]/K....3JQ.kD-_..>4.t.n..w....i.l....[......o....~..=...s..Z.DQ.U....(.,+].1%.Du_.@-....;[~....&k..6..8P.....(........c7.y[......a.......6+\.\|.....z.F....&..R....f.......r.l.9....P.v..)X..j.z_.t..8....0.)qQ.....7. .[.7..W..0j5j...(...W.9.....T?.B}.\|..+..Zc...o..}.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jconsole.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	471595
Entropy (8bit):	7.927361107640658
Encrypted:	false
SSDEEP:	12288:5l1yr1oJ6u/7xwGw5eHlUisCEtfyyVTJtfp:dI1oJb/7xwG4WlUibry/D
MD5:	8154E711D750D204E5358034800D4FCB
SHA1:	1ABD5BEC7F082B1A9183D36A298173A28BA37B40
SHA-256:	A00EAFECFB99C1C63FB7B33A5EE330680888215F55698B03CCAA340D74F2FA97
SHA-512:	20EF0B9A80EA8FC122EB5E5800E6CF0FCA70E95C08567675D8E46A37926B9D11C835CABCB7874F553092D34CF93CA2021DD671A437780D028A32461C736AA7DF
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classm....A....j.T1...o7.%..K......cw..3.3..s....J.L....o.\|...y.x}.p.}.D..~&..W..a..#..'N..&...+.U&.J...qx......#..Q..wR..av..JX..R..ElT.`bxF!.......S..qm.4..9..#r!MX.)..a.....5..n........SiD!y.v.rm.a.'L..O=..._=..".n@.K"t.G.UB. .u...aE.g..u.......?.<.......jp..q.....q..0..s....<ON.^..\|.....Ql...c.eT1..>'.lz.x.y.x..e....K...f{.[Nb.....'PK..>..e...i...PK.........n/Q............D...classes/com/sun/tools/jconsole/JConsoleContext$ConnectionState.class.S.O.P.=.u.V.2'. ...6P.T.X..1ud...%.O.V,..d....D.F.g.(.}..0.1[.w{.=.....~......CE...4....Q.x..k.~.x..^>y!.9..I..cGn....9.0(.I..2.z.R..1,.z.g..i..h...iO....EB....K...1.,.:.x^{S1.....!..........w.....g......TC.a\W1.1..$.....g.....{.....g..q&`F-..1.2....8.M.bH-....0../VV..4...b<.L.\........2..B.s!...(....d...N...vZ..G.._..z'......V...c.....]`.\..%}....."\"_h.B-.^<...!/..o..53h.l.+..vU..".;a..#...S..F._%..\.1...."}.a....}..Ll...Qq)...x../.7AV

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jdeps.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	747316
Entropy (8bit):	7.912940714319912
Encrypted:	false
SSDEEP:	12288:C73JYuZSRMmg+2l8ZUAKJUUvF9MnHczIf+z71M5Ns9ey:wZS5g+JUAOtrMni571Wsv
MD5:	29D0A4D06C197F265501AAD6BAF45E62
SHA1:	83E71B0BEF3DFCB56F3E2476B1CA53A16ACEF850
SHA-256:	A9775CF5EC65239428BB5C55BDC058BB60B8CBB4F5C0B4B070D413708EAD81E6
SHA-512:	F58B00D9D151AF763B8FCB95008E154D8506023C82490714E1D23228177283643C5B1A1EF2BC52565A651A87BA9200899F2ADEF02D8BEA7E5916CA7ACFE03595
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuR.N.0......-..... ..G..HHH..&1(m.Tq..\|..\|...X..-..d{wgf.#.....8..a....H...!.@.B[..'A.U..[.d]..#......s....f.5.$R......H:..vgQ+........T....R9......E.`....1F...k......:....B......v.6..#&dZ....!.i...o..0..X .j..l....w.n..).dja...O.".KW.._....-.9.;.k..n.....L.,..-...M..c...!.a..Xx...3.6..0.:....5,.J..Q6...0..gU..........]^.9...l".......4..e.....p4..Y..;oV.Y...e.U.kt...B..(p.`......PK..f`......C...PK.........n/Q............6...classes/com/sun/tools/classfile/AccessFlags$Kind.class.SmO.P.~.{.V/n...A.P.M....9!."q...O..Q....d$B4.>....^j...&.....y..._..0.Z...f.-=..z..^....{.....g5.......C.#.4CjM..J.A.....vu.......+.\.n..'u.r.D%....Y..Q...2__.}X7....WW1.q.#..q..l/...Q.X;..-.....s...a'qS...4n......i..C..8.{..ZO.<..S0...7.^.A .g8.`..Xq}7.2.k....z.)..?.A6..ANdE...b...}...x.a.....Z.Ks..\...v..{k.J..~...(.....V...1k.Z....h.%GY.m.V.i.....tk..O...,+.;...j....l..K...(hIi...7A.).0...../....[Y..4I?Yj

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jdi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	873528
Entropy (8bit):	7.899120036221473
Encrypted:	false
SSDEEP:	12288:va0YbDnpUDzGiOkyBcWLuexX9B5QjTQyJ9S38DMZz6zb2lPT6kax8uMCIJuTNDt2:i0wzMzrOpCWLgXSMYOzUPTtZVC71c
MD5:	70EE207E89DDCAEBBDBFE57B7274DB71
SHA1:	CBAEAC1512A8ED53D391BDF008E3490B5B19455E
SHA-256:	35C6FA0FF16DE8D51DD51448BBA85A3B43CE32E7553779B30A3AD71EEF8F3353
SHA-512:	61E299B33D34239DF362591CD2A5D37EA94F1811C80D44733CF9D536089431443FB19911D7B608D3F1B48C597CD4FB559A88A1D07B26B751168194B54E7F0E2B
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.SMS.A.}..J...("..`v....,.<..P..6.$;.gv...<...Q.....Yq.=...........7..p(...8.S-Q...!.Z..]9..^7...8.1+0.8..A...NC...3Ux.~!.FZ).....K...0kQ`...!).,.U...,'n.l_%2..6./2..)..<o.70U..l].....' w.;..Sa.`un".U..,....KK>..T..Y&......I.F.@..:>6.6.Zp49..%.....F;.&k..&.yx,.7-..hVh.;%.j..?-..M.(GG:M.......U.!F?..F.t.....k...f...U..U..=.z..#...jsQ..._V.....r......c..<....z<T+.4..J.L`y..X.lM....%0..g.....x........r.}.0....MwV.]rv..._.f..'.%..gx....5....l\....f.f...a...~.PK..............PK.........n/Q............4...classes/com/sun/jdi/AbsentInformationException.class...N.A...... ..Jclt........`66....8d.5.c.Q.}.+......-l.w.....b..........MT.H ...C.i...r..jlu..&..bH...a.!i...X..e..i..../.Ys2Xa..zS+..5.I.x......O.f~.....u..P}.;a`g.........n$R.V........x#.P.....t ..>p.S..!q8.^4..Z......4ix.Q....{.?..Rsw.f.j/v...0T.C..U...0.l..sD.QL.g`O..H....&J..."l..Ci..@..Z..7f..$4Hy..s....6..[.g..PK.....LM.......PK.........

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jdwp.agent.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	127873
Entropy (8bit):	7.995171911648754
Encrypted:	true
SSDEEP:	3072:BJ/WTQagxB70gu3KeURn3xm1aJr2lUdrwEfNQT0:XWSBzean3xm4JcAr3Y0
MD5:	62D094CAED8190D1752D97C6EF9DF7A5
SHA1:	6351CB0057606D2B44B8AED4AF01DB32FA9079D1
SHA-256:	27CC1468B8BA7A78E5DEB2560CAD5D6CEA1D4FE63EED380C80D90A3481F30BB0
SHA-512:	EEE33F1B646AEFDD6F52DA3CB8CEEDBCBD26091BE328A8BB441DB94846CBF25BF163DC478B562CCAAE923EDDAC5583F8ADE8E09FA7B84DCBD9A3B190AA8BA7D1
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.K..@.D.EA~..[0.D.w.J/08#..1\|d.\x..e...o.].y.......K.3%.T.q~U.....X....H.%..3...0%....Y@0{.......uRuq..8..t.~.._8."...m.\...y&v.......}.`u{.Y7u..-F..\|.PK..b..C........PK.........n/Q................include/jdwpTransport.h.Yms.F....q>....'nR<...C..G.g./.C:..qRu'.O...{w.....i....s.......h...0z......{....3..{w......<3.....r..>..w`....q.)..z.ioj..c....=.....9.N.GW.d>..;..S.9.d.H]."..w).QA.5.F~..l.L...dC...........P.n..<&.Ga,`......=..!.%qiG[z./.G........LfwS{.\|h..A....8..A.Q8yd~gu.jQ......k.}o..t.........n......^..k=_*....Q.p...q..N.'...e..l......G.[.o....C.e;.9...YlS.I<ET....r.+.p..pC..4!.F.-.(0.".B..8.cL.O.M..@..\|...>...G&.....+.7$..3.+......p,.\^.'.4#2.Q.l{j;.......F..c.f0v...[<......O?..sk.N./...g\|2...`.p{.f$f..\..s..<.o...7..Z.V.......6...`4..1....K.#.....u..%..u#=.......)..R.[:L.......L.....M.D8D..$.....X..h.]a..+..`....v^{.o..^......#....z...=..;.{~.....G`/^`.........G...FD.T@@.0%SiE.}

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jfr.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	534760
Entropy (8bit):	7.936953895862843
Encrypted:	false
SSDEEP:	12288:vtLqgAzEIiaPQ0NSuKWTdJLwUa3RPM71yj9aAP4E4:5qis+QdFw93RSyI8w
MD5:	6687450EE0EFC3CF002A404A31F0CF0B
SHA1:	2A3AF738821E03C7CB80D73F0051775D6A2DFC60
SHA-256:	BF4CE18BC133EECB6E0D7607553C0B911D780A430948B804F3BC9040ED0AE73D
SHA-512:	BA8E24DAB000C7A8C5777481679470C620486A1E394AA234B1B3E5F15A08C68FE210B489205736BC17CB642BA52BD0DEA46C1D3AA32EA278C7E23838E74AAB50
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmQ.N.@.=W.d......Q$Q_\|...D.`l.l.S...o\|..~..e....t...r.d......{\.r.k...i.....Js.n.. .m......$!...v....f...2\....h.P..r(U.k..)-.HO........+.J.......oB.}.q....@[..<....U.. .;...8.#....Z.k.. .T.[7...H......O..j......L...\|Y.!......(.cB...x.\|....z...aD.'a.......".......Lw.7.c...%.F.......~.e^S ..C6...;Y7y.N..s.;(.".<.%......m1........PK....^.W.......PK.........n/Q............'...classes/jdk/jfr/AnnotationElement.class.Z.xT.~.I&gfr.....EFD...EAL...".b.H.........o..[.V..l.w..Z...d..u.n.v.[....^.vw...Z.....dnA..<...?.............h..>.Pd...%..[C.Bu.PlK..[....d~$.I-..UO_..^.>..0.#5yo.u...uUo$a5.c..`juS....[^......#..........[...S.T$.[.....UN...c..4.X.J.B.5\|...(T..mb.....R..[.....Si......).L5.b....`b"N.Y..D2r....h (.=D.JDb[..#1+..d...`..6x0._.}..j......Y..J...V..j...O_.t.51.3..........e]..O..p...M..9.A>....%...)mh.:1..\.G.cz{Tu.X.8..I.}](.k-....H...0..&....g..C.V.....O.....)?...f..L.3.@&....R..pqV..d

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jlink.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	410728
Entropy (8bit):	7.940858294306596
Encrypted:	false
SSDEEP:	6144:Q0N3mgGVIQyaTOMi93AcpXpRfT+JjHS4W6dTL/doNBnUCNllxPZ+6UOP15If:vHKPXOMozpjsHS47RLF2BUqlTZ9UOof
MD5:	6B537512C2F426FB7D0EA53B2C9B88F3
SHA1:	52648A05552B27E9F7E8FFE39EC12688DA901E16
SHA-256:	09E7D2A027BDDD185DF18CD8D7042B1C6464664B82F798FB7DD81205E16B8A98
SHA-512:	E51CAED2A7181D2A275F34093F45E1C727196B30DFB26B16BC0439E7C449F98CD65F257AE6E3DCDB1BF55390CC876EE644F6BB9C16E06052DB56F07AA297F2CD
Malicious:	false
Preview:	JM..PK.........o/Q................classes/module-info.class..YW.@....Be.heS\.W.vYTd....B}.6C.4............x...V<I.....s.;w~.....:.1..M...4N....`....g.i.JM..i.....Ye.\.:...jM.yU..`....M..;.n....S-.R..B/.X.4.a.\O.....f..V.A..e...jN.0.0.9..-.0..&.R........I...-..oJ..Y)f.I.~ .&.v.....'...G..<.)..:RW.T..9o.g.tJ...TGR9......=.1....x.v.9.J...8....K6vD...`..},C[..M.^.#. .+.%2.....j"`.0,.e..~....j\..(*.4..W..#.r..td._;`..-F...vD=...V...k.d>..<..f...../1,E...D!...}.g..A.6....U..Z.r...'..SY..C:}..q..!,.L6..s..7..#...5.4u..d...65..Rk..85\..fZ[n......8.5.R...S.....P........P#.lF...N.....?./m.....=E...SDWQ.TP.n..rJ7...5.G.....\.....^../...~.....2.,r..4...g...M..yD~@..M\x...}.B...>..L.x./..o.`..X.2V.....O...........;.A..0H\.#...v./PK...D..........PK.........o/Q............+...classes/jdk/tools/jimage/JImageTask$1.class.R]o.@..k.8..ICiCK!....5 .K....p..D).O...8q}.v...g@B.B...(...!..nwFs7......3..x...R:4..H3.'....#k....m..<..jaH.p.&"..J..u.~7..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jshell.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	663529
Entropy (8bit):	7.949945206904611
Encrypted:	false
SSDEEP:	12288:tLcJdcxVT6CFASpD7Qzw8EunjWLmxQ2jWE+6pyTACA4oqu:lcJdcn6KdY9iTop3CAvZ
MD5:	5914B236665D99E5E396D3C727ACCEB2
SHA1:	6610D9A8F450DAC3AEDB06306AA0F99224D13F8B
SHA-256:	3A73276654319554366BFB46AC82BC1D6F2C93989D9DB2104EDA519BA310D654
SHA-512:	A4ED568482BDDAE0A06A530555ABAAEA31987674693ED34FD460C8960CDD29615984174A85D60D324619844CB80CF86B9CC310132ED6D763311347B5149A7F75
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuS[S.@....\......6)J............].m..I........(.M;m.&._.\|g.e.......>.+.\[..u..i...6B....2....J...\T.f6.~..dX%G .L.$TA.#...{p.V&.3....Z.70".]....\Q........@\...I.xX......8.I;..4..M.......\..4L..U.yk..2.]......T.._......w...RQ.....;..'....0.\....q..Xgp.\|.t.a}....@.o:.VGF.$....C}l...L......Ov-3...]R.K+N...:..6J.......4tu.....sY..[.7..~.(T.qM....P..0..H.c;.=R.n..}.t...Q....Hi..q..Xd4...p}...6....0.....G..\#.A.w.r.=...G..,>...r/,..X....,z.......>a.......m......:f1O.5.${.+.l....PK...`#I....!...PK.........n/Q............<...classes/jdk/internal/jshell/debug/InternalDebugControl.class.U]o.T.~..6..tM.....h7..#..6.R..k.I.5%]..p......i.BB.!n...._..n...@ .@.7!.{N..6.4.............~..@..:..!h.Z...e.I.,....[..1.NXe.dPc.\|..h.A7...a\|kc;i.=.M;..m'7.z..L...aMW.S....e..e8..\U...H......w.tK.....#..........R......3._.d....v........C..;e.[.d..2G+.j..]....s8O.s.Ne.3\.@;&...WD.Z..v..E\..Qu."3Y..N....#

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jsobject.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	3098
Entropy (8bit):	7.5832881194591995
Encrypted:	false
SSDEEP:	48:pCDh92jG/7jnZhQyhuW0KjhRg2EJrb/cl3gxo7RA1LXn+q3JusEL/dv0DVGOveUz:QDhLQ2XKvJX/Agxo7RA1LZZALCGOveI
MD5:	E495331A4B7EFC861687151B3647CCED
SHA1:	2EC5BE517CD31D9FBA085EBB432DAD9BC7D2186C
SHA-256:	04F7529F454B7B3DE70187C4B8457EB1F1F81B4F38F64B4509B5CB733AA80CC0
SHA-512:	C2A85AEB8B01FB37CD82235FF55D1E766FF3F45B6B4BA93A51A60D0D2A1DD19C2F95FA40B640BBA75D284175646CCCD3F5920DEF420BA7C4824829EFCFA54A39
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMM...A...~..._.A....D.......,......(1.".....\|.......G....G.NWA.. by..V..El.6f.y(....1.K83J.x.F..).J.;....:....T.":.M/..B.s.....m.........(.......&7../Jh.."Zv.P...[ts_B.?.s..:y...PK...5.........PK.........n/Q............-...classes/netscape/javascript/JSException.class...NB1.....DP..7.0..;1l.$..B..e96Z.=............d..H$.q.N.o.i..o..'.B8.H.Q..+..A..B./z..<yrd.(W.b.J+S%...M..Y.L....0...!1c.$ay.....G.jK..#.4.#..l!..T.k...)_zJ....y}uvL..a.....4E.'.[../..u..9ro$a...<.uZ......G.....S>a...=\.......}....D..y.<U.XjL.cylb.[.p.1......!.0../<...>..s.4...$.c"H. ."..%.....H..F........O.v.....!52.(.W......t.0Y........l\|.PK..k1bUt.......PK.........n/Q...............classes/netscape/javascript/JSObject.class}..N.@...@.XA....t....\..7F.L.....R'8.....[.......2..S..L./...............<2.2..........!.%C.-\!....VOE...r....:.}1..U7P...P4..o&.>..C.lz...,_.....G.0....5HG...i....p.....h-".....c)<7PQf

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.jstatd.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	33913
Entropy (8bit):	7.925452325822178
Encrypted:	false
SSDEEP:	768:UBjs99RXqRNMZEJvWg/hm6LY15x/C0WcqutzJuUyS5m9u8ynj:F9EWoJYNC0F/z8UJITq
MD5:	C40DFD30EFE94EB2E213E0B12215B482
SHA1:	AC7B8037B7FBF1BEC19AA62E9792598E6CA6CF72
SHA-256:	A4D36A1A5112F9F3E793BBABC690255962ED8894519004E7EA28F17C3AC39A32
SHA-512:	0522C1A23A4CBBE4CEA61EAA443ACAF2FBEA09F1EC657CACF254489ABDB36DCD8617C586431304E25D51253A1625C088C36AC76EA0759E73F0720A82866958CC
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class.P.N.0.......^...C.V.... .....L.VN...........Q.')U.8`.;...h>..?....Hd..y_..Y...;.^..P...i.L.D(.o..7$.."..e...D..H.+.H.]T...9W....%.42.....fWgt#e..b..........Z.j.......I...e..Y...p...Q.y.$..s.....!<.[.../..9.N..B..Q...4.$....36..,.^..rCh.D...$..Y.{.9%."..8.y.......Y..s..h..cw.\{Opn..WQG..\|..7PK....`.5.......PK.........n/Q............3...classes/sun/jvmstat/monitor/remote/RemoteHost.class...N.0.E.i.#...@J6xO.TTj.D.lX.`.G..b7..X..\|.b(.......^.g.....3..G1"._XQ5....qV.W.Z....^.K.C.6aP.F...3qu[....!Y...vBW. .......x.j.jmgy6.sgarB..T.A;.cl...mZ_..%..6t.Q..w.>..._ YA..2.'...f.tS..K5.s.r....s!..lq.-..F.U.U....ao...o......V....PK..&Q7.........PK.........n/Q............1...classes/sun/jvmstat/monitor/remote/RemoteVm.classe..N.A.....A>.....\........D..x....fg...".....e...i.k...<.....B.pSm...B.u...X...N?.....a....)..i.9..-..e......t."$....yx.n.>..B.p}..-..".7.c=....dN..{...i.....cc_.j..q[Z7....\\|{\!.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.management.agent.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	81621
Entropy (8bit):	7.930307384934393
Encrypted:	false
SSDEEP:	1536:b4z1HiSObJI7P6ahupea/dABbwU5wkwoKlzX6juezDDW6zrV+RZwOZjO2:b4z1HiS0OyCuEjchLoKlL6juofKxNz
MD5:	1A0F24297CFE2D15AAB00F31458640B6
SHA1:	5F4D91F26DCAE7AB0FB2B0FFE69C610E6B6AC273
SHA-256:	6BBE768A88034193C63670B2C037A7C229155C08275A69321A09715690422855
SHA-512:	27EBD97ED0E9C0BC9D29DCAE5837A0B478DFB7404233131E11AD46128FE110EF3D371AB5EAFF41EDC9D503BA6509FA61C8AB8D1536DAE7B5100087AD9233C1C7
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classmP.N.1.=W...2#..c.Rf$Q7..3!...L%3....%........A...{O.}......=...T....#.&......c6g./.'~.....7Vd...............,....C...............F......`.8...:....2....r>...4w.Oh.p.v.....Wi..P.w.GRh...C........9.B.....v..(..k..?..+g.F...M.....g.."..\.>K..%...S...x.=c..g.h..2....c.P..xl....(.bl.-..Z.?PK.....3.......PK.........n/Q............6...classes/jdk/internal/agent/Agent$StatusCollector.class.Xi`\U..nf.7..$.iH[.%.).L.L..@b.M[J....i..e.%....7mcQ6E@D...EE.VQ.@.).V.q..}.}......d..$..}..s..s.97O>w.1..EA.....H<i.fR3"..."k..^.+.P..'....k.CK.E....QK..#..[k.<..>.~.yy...'..e.FL7..Dy%.Q..VE.s.B..n.4+..L...L......i...1.u..PQ.y$,`.?......)...t....L.u...B.jvxg.......@..h..&..Z.Z&x.m$q...)Ko3RQ..L%...kc1S.d.h.B..T,....b..u.8;.5....K.....A....T4a.@%.....:.k.....U.8.F6w..i.P..j.P.B.@.....8>......$E..V......z2.2...$:#4.7..T%"Va...J9.D#.<.ZJx....H.7E.&]....'...a.xT.qY....\|..+%..U..C........K.g...q...;.[.n..L

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.management.jfr.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	35841
Entropy (8bit):	7.895920206921998
Encrypted:	false
SSDEEP:	768:01aLV2OeSrEWXZIj4RiHRdIuRK4jpg9I6app5uU8OIW8Gp9xwFJ2I6fJZdTX:01aLNLq88R7qRQuUT9jp
MD5:	2AF6A1F2D4FB1FA1AD0E8150892C4A12
SHA1:	2A1DFA6D16CE9ED226BB541AF3AD11E8466D205B
SHA-256:	3E223217F96935D6890A6E3BE53F90BE5E52CE6F691844AC53A40CD64481FCFB
SHA-512:	E0CEA8C7A25A86CB61512186D78564AD9CE08B3504D677BA4E797C7FE542B0DABB4C5DEB4F06702EDF449B7531AC4B665BC3B278E92E888E04EFD3CF41F0A982
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class}PMO.1.}...7.....^....7..H.z.Z....t...<...Q.n7....t.}..i?>.....P.T..yO.r@.V...l...y.."&.G\&.\|.].....w..3..K.........B&\K.vP&.S....E..FV.Nhl..h.........R.].W.C.L..Fw..V+.p..%..3.?...%.........}@.<......y..~..5;..dadcB-.....P_...u.cQp=...\|."...wpl...&..Z...ll..D..O/.c.!NlO.T8.j./PK...}..'.......PK.........n/Q............2...classes/jdk/management/jfr/ConfigurationInfo.class.Vis.U.=/.Iw2M..... ..!!.F4A.........;3.....8......}.}..Xe.H.....7h.....U.o.$3i1V.^.....=........O.P.j.!.a.(\4j..m);3.wh.I..5...oR.nj....Z.u."....&..F.sm]^f..).l..2.....w\|.....45....M......\|..YX...jI..3...v2...aO..O.._.Pp-................9../...R.PF.Eg{I.e....&...CNJB/..BB.).....V.[=.;.D...fq..B.8G..v.i..,!...7.&......".f.d.....;.........s.d4. .v\k`...p.B....Lj...I.9v....^....o.....4.....EAv..ia#nP.M...wX..UM.}+ko"f`K....Xa..D....v......);'.#..,tc..:n....rq..T.X.~...r..Mv..aE....Y..}TNP,..w.:.$t.a7.........p..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.management.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	69486
Entropy (8bit):	7.914145548898423
Encrypted:	false
SSDEEP:	1536:wQk+DDx0BvxFbTf8sCDrGvo9SFOwliS7QWAfRbfjM/Rd3N8CkQdyyFKLpW:wcDSFbD8s+A54E6fMH3N8CkQ+W
MD5:	295ECFC1A63647735DE3918D7B61AD15
SHA1:	7EAD8158CC54073AD4B5594446FC1275989D750E
SHA-256:	032F0DF66BD529D7D9838C9A0A76B7B825430EA2089B9C732B86F25EBC99DEA0
SHA-512:	52EDEA1A5315D5110B9031A0BE23C3952311BAC1FBFEAB758C59F89F1BABD3256C19D713FB3473CBB9F3498B2634883E3E57E55B7679B9392570779971619DD7
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class}P.N.0.....]...c/M.D.p...C.H..&q+..]9I{.wq...(....a....v_._....:..>.j....x...l...E..%Sl.%W....:..W......\.......7...q.X.N.....K..&.[...m...A..A..l...N8S..k.s.K.....{.J................$d......xdf.3B{#T.7....z....T.....;...U.[..K.../.]..}.\|.jh.t8{.PK..s...........PK.........n/Q............7...classes/com/sun/management/DiagnosticCommandMBean.class;.o.>...k.Nv.&F....\...<.........}........d..\.x..Sjb.;..#.@VbY.~Nb^...RVjr.;..#.,H.......d.FF......T..TF.i............ ....$..8.PK....`.........PK.........n/Q............B...classes/com/sun/management/GarbageCollectionNotificationInfo.class.U.S.U..nH..... ..6.6,.X...4....K../.fY..d.I6.u...h..>9...XGf..........7.....B..R.d..{..\|.9.......0...\|hQ.W.@+C......n..+..0..3-.ah..g....._JW..%...4wM76....1....y=.F..T....'...^vJ............U...T.....n.U....3..v1^.X.".x.(...O.R....P0$J.v.uS.b.`..$..!\|7..._...>.KD..T1(.J..c*...."......i..1$<.e.,^h@]8'..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.naming.dns.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	60084
Entropy (8bit):	7.94170672965016
Encrypted:	false
SSDEEP:	1536:Ko+W+rGMpEXYiqAD+gL24MrD9OYvVng1y3iX2r:L+r5pkYit8PJOAVntd
MD5:	29EA5E44B576D8EDC8334535ED8152BD
SHA1:	3D42D41A1E32054DE879F95D3E8D26EF2C7D0A66
SHA-256:	004819FB8B5C46995DEED0477F074CB15DB7862E4C4A83B5FFB891D4FAB700CC
SHA-512:	91546F0FE574F78CC02A7E285ED981129EEB5F2077AF970B6B620DB739CCF105ECE333DD6C9E13150CBAA54D710EF6FBAFD910EF68091D4F6D72DCAF9C4D8DAF
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class]OKN.0.}....C!.f...6...KP%.HHp....mb.8.e.s......$T.Z..Go<_.....qL.fV...i.b..a..`S.&....1#2m.&..."....?..w..S#5.r....c.<m...Se.g.T..._.&<D.pZ...0.j~gt.EzcM...D......N.g.[..}{..G[..T..........g"Q..k.'.'. ...H;w#...%...i!D.7..~.-_.....:.=~l]Wh..>.~..^=.3.~.PK..<..........PK.........n/Q............;...classes/com/sun/jndi/dns/BaseNameClassPairEnumeration.class.UMs.T.=.O.bYM.$v...i..v.......K...=a.NQ4..-e$.........`..S......f..;`.?0....M:YX...{.=....}....u.1p...8...[....6....-....%..U...'1...EE.....h~...M[.t\|..[u.c...m.^..v,..l..f..0_....e....@W0.....b.a:d...v..[.........g....1.p. ;."..C.q7-.......aN.q.Y.`H..b.h.~...J..T........q.....TqJ.=....g.,..P..3...(...1.....1:6}..Ke........}.u..5[..~..<.x.Qq..CR4.lt}.....n.<..!.....<..(F..$........_.-si..bX...}Ug8.;p4.#fA...e.@..U.v6,.....k..u..{..M.....^...I.!.8...V..Qj6C..F..Z..<R_...G..a.W3.C62.0d...a.....U..+f.]gP..J....$.CJ..h..Q.-.>

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.naming.rmi.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	18962
Entropy (8bit):	7.879095599349228
Encrypted:	false
SSDEEP:	384:JEJj14/v6ubRBwV+mtm5VpVAlF+D+6XZsLA2:JE74/CMemx+lgS6XOt
MD5:	F11E5D65863146758D0650872CB3A164
SHA1:	0E5EA724EB4EC991DF4FC7626DDBFE77FF313EFB
SHA-256:	9EE120517DD4F711C5C3662ED77555059861291DC78CF349615F0A51BC79A7E7
SHA-512:	242A225DEB9A88FF208511F772F19BA691EAFE2CF42597FA29A9D27B07CD7F5C7C5D5CA1B1B1DE381D8705E9F4D6751E7084A17642A56CB1802E0B3C9CD0E962
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuPKN.0.}SJ.-..O9......%R%.H...IL.6....v.s......8 ...<3....?^..\..MuT$b,.n....D0./.0.G.@.T.80..P'4.g.$..F.NYV(6W.dVfF.2...G.......)>.v.x..3.k.q...Oh9...!..h..e.]+.K.\i..U>.a...].....W..#t.uaB1....._..W.-..<...W...."'..REz..y...n...O..(..........z.R.....5t....r.b.{..8tu5.up.G.PK..e:..".......PK.........n/Q............8...classes/com/sun/jndi/rmi/registry/AtomicNameParser.class.R.n.1.=.l..&..BJ..P.. ..R!P.O.RQT.....v.....(<D....G!...6.<.s<>s.._.........TC.M,`..<._D..}....e....J+..P..:.Q#.z.$."W..\|d.z.'rYG.F.f.7p....<..:..m.K......3.J}.....8.NL...41v....I.,..B,{...;....g.Gw~..\|..w...g..V...oWA..$a)QZ...D?.L+1....U.<K.../....KX.yDx1g...5...Xz..'D.&..9et.....U....Bm7.f.....M.{.Gi..9......2X..0.;...G._T...3+.b..3.S.).....Q...yN`....!.2...A...g..v..>...+..R.s.ix..k\|..8...5l\..(.@....)..Q?-[_..x.Z.z..PK..............PK.........n/Q............:...classes/com/sun/jndi/rmi/registry/BindingEnumeration

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.net.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	16691
Entropy (8bit):	7.835716025973249
Encrypted:	false
SSDEEP:	384:X35ZZ+W608/ykiL+E3OgSd2yDLDoWlgv6LA2/c:XpZZ+W6zzPn4y3Dn750
MD5:	7B3BE04EFC27E0560C20006170E899DD
SHA1:	8FE7D7B4A04DC3F1A31F97CC17BAB31A94EC42E7
SHA-256:	6DBF1422C48BA474C70426686229DF1AD32A20582EEEE1E5D79F288933CFF20D
SHA-512:	E64FD473691976F4DFAB2001D15C7D72F2E64FB6F126E41D906A11BDDF600D0E5ACF6ABA54B0535DFA12104EDAFBE4309CF22F4A64BCE3EAC33DE6D949A97B80
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.K..@.D..E.....g.D.wgb...a$(0..l=............z..O.k...X.y$.09I.Dp..;..'.g.....`...%..yE...a~.P.a....yFh......P.[.O.U.{......._....E...H].......+.].{.=.'h..J.C.v........=..PK...y[.........PK.........n/Q............-...classes/jdk/net/ExtendedSocketOptions$1.class.V[p.U...-M.n..-.r.R.....PR...46$..E@.....lw..Il._.~..8<..."......_}..~...Q....nz.I..3........k.>...>,@.......a..3........O.n.xa&3\.B3....[34.....=.............j.........G..]}..{.....0-..yU.R.Um.=..a..)#....I....b.z.a...i.........9..J.K3....X..R...a.T..]aG.Phpt.p$4...`X....W1......p{LS..C.V)X-7.....U.q.e.P..7.........$3.;....K...v..`..^.7......!.6...1.Os..hW......!....#2........D.......]..A....\|.D.d.).E&.L'........=7....=.i.\..Pp.4\<c......J..u!.7]gL.........uc">.....".......h.W..V.=.-..4..15.ER.q".....f....a.,h.=-.g........F....f.W3<d.IU...qZ.B5.!..V.O.K[...~0.y.%....U.[.i..4..0...fP.~..Z.K{..b..F....I.....c..._....Fdk..

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.nio.mapmode.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	2573
Entropy (8bit):	7.585716552925947
Encrypted:	false
SSDEEP:	48:pIVaWgvq2vIt8Fn3fjPRg2EJrb/cl3gxo7RA1LXn+q3JusEL/dv0DHGavq5:Kavqbkn3jKvJX/Agxo7RA1LZZAL8Gav4
MD5:	6580F1626A2C55DA21AC50143B4C92C0
SHA1:	A28A5BA9620948355E0CCC9637C740963D3EDA92
SHA-256:	624B5898A3FBCD11E6E6D681871B9E8B307684CB068C6F17E66B7A637D7531F5
SHA-512:	820BF4E3A1BFE0711F1D52FFF9755B0D16C36E0B50B5E2D11D1FE90F906DACDF3453084BD1EA0E776E3084386ED39CEBF9E1922B53F82B0E03FEF00B224DF3C5
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.M..P.......C[.&...I$l..GZ.'....,...kK...s.sr.........e....&{....."~..;..,.%..YQ1.Fh.S6f~M=E...B't.$..L....Z..N,.P.e..`.... 2.Y....../.$.E..8.Mn@...`...0....z......~...fU...PK..I..........PK.........n/Q............-...classes/jdk/nio/mapmode/ExtendedMapMode.class.Q.N.A.}...."......9y....d.D...i..6........L<..~......R.U.......7.e...B.A.......x.^(.w.h. !d..V.>!..u.G.y....p.+..t"#-B.....>&R7e.D.t..0\|V=8.......u.B..-.V./..Z.0..T(+_.Z.g9.a.U$,...o..6.~..U%..FR..].._T-..R"dVL.WZ...D#....Dx)"e.~2...... ..r{A._P...if!......1..UB..2v.HX..6.,..~...>.+<t....9..f.vl&e.......l...ly.m.&70....`...s.....C.pz..0f..mR..v.~.Y.\|...`.U.?.PK..8.~M........PK.........n/Q................legal/COPYRIGHT.VMs.6...W..L.I{ir.$n....N...J.A..@).I..}...e.i{.@......C?F..f.....KC?.}.kCwQgHz.S.ds"..Y.MZ.K.X%.&..3z%..M.B..2.S\|t0...:..6x.}.;..i..D..Ye\|..&..wI..Xo....h.['..!..B.\HC.W.g.8.z$.q.....Kob...=.p.].>.Ld...

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.sctp.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	23570
Entropy (8bit):	7.699516108218091
Encrypted:	false
SSDEEP:	384:/FWdT63qGA2s74PPf+AfdgcirNa6hTbdJ3ZBR6ZhF62WmhSWDdulpLAEU:/c63qXDMvfLirFXd6Z2gDdufS
MD5:	7579F5E9191D26076513F0D62BA63763
SHA1:	A983D608C3087FFDE4E1A2F76C4072766CB52763
SHA-256:	6BE9DE8083B09B782B7520691C2B1B9CD8796ECCFA3101A205853CD3CE22FDF0
SHA-512:	EF643B3E4252448E6AB98CFC2F7309A0D41D53EABA8B3DB4AFA86BC09EDA1EDD49750AE5763E542073B142B40F9F541570655FDFB841709797D59433CB09997E
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classM.K..@...&.x-].D....S..... !.e..sY8.C).................B-T^\|..?......,..N(..iq>va.....k^..::...WN".P"..../....[s-....K......i...BB..,........i+...<u...z....!...$s.MS.(.\.q.%.....S-gX...W..PK...0S[........PK.........n/Q............:...classes/com/sun/nio/sctp/AbstractNotificationHandler.class...n.@...M...J..CiS(4).....".@.R.V$...ico.....7.^...n....x(.....s.....g.ofl.........4b....`.I..c..k]n....0.C.$-....\|.p..XH!...d.V....}K.....:.^p....p.]:<_.7_...3.j.....1l..-W9.Pu[.#ip%mkp0.E.........m...5i.z...N......l.w..#....P..2..s....t^.......J.^&.l...`h.Zg#...G...z...A.0..\)ntz.R^..L.a.....l[\....i.....#d.k..W.R..b....R.."g......TL.....+.L.]..3.~3B.!,s..0g/uD..y.z.\...z.`..L..5{i.!..ja..WV..\|...tM..CC0...!v.7Gs.....:..F....$..F.+...ed..}.E.Y?.s.q.....\.u.K.<.d.n.&.{roi.'.....!...Z...@.[..m.}.+.C:K>%6.Z.D.`.\|k.....\..l.e...37B0..2.Gd>.!...2.........i,.aD....#..V..PK.....}[.......PK.........n/Q.......

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.security.auth.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	75417
Entropy (8bit):	7.957051837625358
Encrypted:	false
SSDEEP:	1536:rLd/gr4QC4zcxQiwrk+79xRDxqWXp4kE/eoBtAi939FMp0t0NmwELQxqbJs8hneK:ejouRxH9qWXFEZ0is85rgyn
MD5:	24AF92517AC1A65B436D2FA612EC7003
SHA1:	32F019F2D9057A52EE79A603637753918991E193
SHA-256:	8D2196DFD3096919F43852D654C99D3D52CA37A58A311A540CE6A14D367B1482
SHA-512:	D4FDC8A4300591297595A2B7051F9ABB41EB5A833E813508160779EDB45FA7C1BAADEEF81B768F74C457C719B7C2987C601C64AC920C8FC18F37685772C908D8
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class...N.P.......@.....b..D.w.hL..8..z....^v<.....2.."..@.............p.CB.....{.. B.O.h..F(..g#.V......)B...81N....6..3..3ft...-.b..d..YBi8....td.....:....F..\.......-'.5.......s4h.J\x.wn..f-.~....H8...y.4....8...o.cu.q.."a..'..........1nN.f...I8.i.5..6!S....W...7.7........!a._h...]....l.5...}q..&.{M..8..._cZ...[T..-E.,....9.%.`..(K~.{.....s.Ws.~.PK......n...#...PK.........n/Q............@...classes/com/sun/security/auth/callback/TextCallbackHandler.class...O.A........."...C).M./x.....F..&...uC....n.?.DC..?.?.8{-5.5.3.3..........XqQ@.A..-...C.E.PF.b.{..C(..6....j.....f.HU.%.....P..(.C.a...w2.*q.XA.....j.&<..#..@f./..R...!..........r..Wq.3.f=..=..M..~......;._..J.......]...v..L...%..)a.}.....e...$.}3...h.g....u,.w&.........4.....%\|".C>.Y....>s./..p,..@.S.!;+<.6..u...(........O..\|.{.W......Jx.z...y#...![.....b[`[m~..v.z..Qn..f.>..J...=.c.=a...X.h)./..PK.....`....`...PK.........n

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.security.jgss.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	25069
Entropy (8bit):	7.861186641428454
Encrypted:	false
SSDEEP:	768:dGve+SEzoJirQXHxGTjCsxc0T3iQCVSJqdSE7g8gGuICe772czgyO/CS:d0e9EzyirQ3xGTjrxViQ0kQg8gGuICeu
MD5:	0818A0480E8735784DF484F633893DAE
SHA1:	B210BB4F8C1DC9EACC0531D645CF77A5EF80E30F
SHA-256:	6193B8935293735A0E075950A43AC9C2FED9EBD333CBC5CA2ECF3508E550FBFF
SHA-512:	9F881002F03343453B7903B6471ADF42F4769E61D26F7AB4AC31524484FB201FE25A9FDCCB90D03B337C42EE8B3072EB2A845E3DC3ED854E39266EFF19E55D1C
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.class}P.N.@.=...S.........Wn\.MH......A'.P.;....G...&$N2g.s.g......=.......M. B..aGl....m.<...v.Hi.J.Mn..{B.xb..<u.9N.c. \.I...Qr...:.^...Lr.MBK....0.L..}.....L....aX..g.X.>.....~.'?v..g..B..y...0../.W...2c^.....xeY....:L}..c.........E\|.SuNq.....P;:....k...]-.R{.3]SQJ.....PK..D... .......PK.........n/Q............:...classes/com/sun/security/jgss/AuthorizationDataEntry.class.T]O.A.=S...../.....RYQ...b..M.<@0..3......Yb.%...4.H0!>...wv.@.F.:sg..s.=.w..:>.....bh..O..M...\|..6w6...0%C..Xr..A....-..I.".3.].....f.Y.jlo....[.g}..r.y...#.C\V...+&.v..I\G.!.^`h4m...=S..E^.v%..B..b...C...@Z..$>...{...V..@/....-.0$E.P.66......S.H.r6.)..v.i.a...;b.uL..Zr.,_rG...^,..^.GB.E"Z.....d9.M.[../.t..&..g.s.2..,".-...D.m....M.\1:.wB.3J.f.F.]..4...x.X.T...3..8j...J_z\|. ......<......S..3...wwD.).v...U].I/.9F.K....*..N...O..@..%.........bI.o.s.+..L..f....i..W..'....8....._..:.O.i.f...+uU.1....l.)5.d.........z.N

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.unsupported.desktop.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	13963
Entropy (8bit):	7.775458355384311
Encrypted:	false
SSDEEP:	384:xzRgcWBxiV8wXQMbX9Z0aIg40ED5rfPLAJmnhB:xnWBQLz9Z0aV40EFfPFnhB
MD5:	510CE41F524D16C86791C0064A589E7B
SHA1:	78ED6092E0F150A94460ADDEF8CAAD601AB5ABBC
SHA-256:	AF7E7BDA39FB3EA6A8C41669DBB86B41B6799E7EFF379CE757981E5B956BB24F
SHA-512:	20B6517378381D379A052997642BF23B5B057EA33C2E0BC962AB6B64E989FDAAA4CC3F02BFD7560D26189E55C7CDF13555BA272C476AD984CD0F913730BD16C0
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classuPKN.0......J..V,....a...R%...M.&.#;i.=......NR....G3~..\|{.p.3B7.H.8R.....~.l.W.0Z.....Y.M......\|4...-.fS..&v..p..\........+..h..e.{.V...z......P[.Ym07z..i<........4K<...']..\|....x..&.../b.J..R...2'.]..k;....{.^..(.>..p.j.......UBk.w...1N...:8..F_PK...E..........PK.........n/Q............A...classes/jdk/swing/interop/DispatcherWrapper$DispatcherProxy.class.R.n.Q.]....X.E...R.h"...&....i.m0..a.D...A.?......?..2.3PQ...k..._...h.QD...r.. Ox4p.6...izA"U.5w.8.....Q$Um.y.....\|......Vg.\|..b...%X..@..M_0.7.N...Kv.Y..5..R.e...B.\`..z.y....pS...U.p.Un....}y.HX.;S1..A z.l.%\.p..U...y$.0p.:.aDX..c..%..j.....0Hk{..Z.m/.c..!..]I(u.@.....:...+...~W(O.dN...d..........`..C..=O...Gv_......0.eZ/.@../.X....4...4@......e.8.......c.2l...WP....9....y...2.`...;.`K.^&.......:..3......<....\|.....gX..0.B.a.)Iu.8!..&j.x>..r.>...#'......v.v:.R...oPK..s...........PK.........n/Q............1...classes/jdk/swing/intero

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.unsupported.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	17477
Entropy (8bit):	7.858834131732098
Encrypted:	false
SSDEEP:	384:WssxVkcgUhibEPAZowuCxykS7ug+aM2xbWCwRNXkoYufro8LAC:cekAiwuCxyvugjMqCCwAuzo8p
MD5:	76B5BEB2F821D1CADF6FBC86B4AD3EA4
SHA1:	353EB41AD10248539929CA4D4E52099C2233798E
SHA-256:	E390AE217A83C38651EAAAE4BB00941F53C3E06C70F5F6E335713333432BEA27
SHA-512:	A48301D836C6865B210FDA8D5252611E39C9BCB30A0E328C96A6F934B169B5FD31CC3ACAF0438DF85F1F4B846F1A1FDC815043C885072396F88018BC6DDD212C
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classUNAn.0....!@.M..S$.K.!U.0......\yW.}@.U.6......._.......&....K.+3.....v..0?.#s..........=.._(MSX...LQ.Z.....4.9....ZY..rL...v...3B.f\[....7........#.KK.^.-o..#..J.s.K........#.>..\....>..n.H.+.8....B..N.7..}.d?PK....q.....<...PK.........n/Q............1...classes/com/sun/nio/file/ExtendedCopyOption.class.T.O.P...^e...8......."......,....?...b..#._.$@4.~..2.....bc...{.w..........,..0$5....b...c......VY/..{..{.a[Q0.$..a.Z]..oll..\}U.3<,. .p...Q...X.ea+_d....X......n.0.5.t...\.U.U.T......k.a{..pKB.n3t...z...f]_.a.K.X..j..i..]..V.....0.A.H..7.H.[..%.w0,`D.].c..-.R....K5..Q..q....F.T$G..$p.F....i).\.@8J...-I....)x...~.a.....R.d.y3...H....S.c...R..^0.V.2...`X.Z...;..I..kb.}.f..lM5K.cp.&a.R.:....hP0...^.*.......e[<.l....h.X.[w.....\...jfs".).x...f}.(..y...]w4.....n>.m..iDz.@`y._.@l...t.i.D..St...?....t.C.B'.....'\|..4..xR1..g...q\|..~.V...S.xz.zZ9.{......).......9.qt.../B.N.p..Yr.Y...5.$../.p

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.xml.dom.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	42290
Entropy (8bit):	7.301009409584117
Encrypted:	false
SSDEEP:	768:GyvMIZQqx6mssgRqwShvKe8l5sFCIvV9XaK:GykJqxdevm3ptRaK
MD5:	476A6F2B11BB60D05012AD03D982E3C1
SHA1:	2796654C41EF4AAA09D23450B3F7E616E63ABA33
SHA-256:	905C70A0DD7FC8C9F4547388EB492992B43D26FDC3D6808D9A4DFFFF577C3FAC
SHA-512:	EBF7130DB716B4FFB5C4F2951E16464A683E0BB5B65D633B7F13EFEC69EC570D9B34DB1E7902761402A9068E0EE7A0F7EBAFE0BD96648BE9CFD993BDAF420E17
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classMN.R.0.=W.G....K..TFt..3....6...8M...\..~.C..wq.........x..._.d#.,_....0n.l.?..,.....%..."..w...#U.Qu.G.b.Ct...B....MU./)t&..O..I..~p....z...k.`D.:j.......)c.Ka.=....xy..B..G..0.a...U../....8............]...e...9.8..?..S.u}\....PK...F3.....r...PK.........n/Q............%...classes/org/w3c/dom/css/Counter.class;.o.>...k.nv.&F....t.r.d...\...b}....."v..F....D...t}......F..........."F...M.......tkF...2......T.78. .(.$...+8..(9.-.,..Q.d..#.#.3..0.......r.;....@..@.....PK..............PK.........n/Q............,...classes/org/w3c/dom/css/CSS2Properties.classu..x.G...`.S..N.qh..M. ...bc..):E.P.w..Z{..=[2%@B...{..z....{...3;...w...y...von../..K=.;...y.U.3.3s...L;...f..V..'.4.4..x.....L.G...c.E+.x#......t..M.8.T.4.$.:r.#d..;.[...C;-.K.8..5Z.N..\|4.W..9.;I..&....l.......l....Ig..8......\...Q.D...\.)...G..)..U./g6E..a..'m!g4L...r...#9...n...U.R0.w4{~K.&.....4..P..A0.w..=Y.S.........x.1.

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\mods\jdk.zipfs.jmod

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Java jmod module version 1.0
Category:	dropped
Size (bytes):	102661
Entropy (8bit):	7.963859985844485
Encrypted:	false
SSDEEP:	1536:kipzltxqDIygENgDWnkIgwqZOQqcK4kLvPx0aKeXCCIPuV/ingD4IJT8nYjIrSb0:kipXxgIy7Ng6kqr34e7Kw7Kwtmd0c
MD5:	0FF732511F74426FBE09EEC982ED56A2
SHA1:	D06B4A0E2745AF3C47E51721347852827EE18707
SHA-256:	9DB03AC8466E45B2FF32F419686E9B44286B2B29A7FCF2B1C7DBC0BCD46C927B
SHA-512:	E0A5115D5683D2E68E5274D77D007C35ACA02C137D8D52461889289282797ED29F57DC5FE1D604D0B09EE11F4152C7AC168CEF7BC681A8890DF1589301784E05
Malicious:	false
Preview:	JM..PK.........n/Q................classes/module-info.classm..N.1...UdD~D..;..J.l.#!...J;..L'S~"+.....C..h4.I.{..n{>......!.S..K.Y.".....s.Q..\/...Q!T{O.Q..M.ef..........Q#<.2 .]..s+.\L.....m.6E.:...[.....M.....)..e...Z.b...53..8./....G..L...T..{....k...m..p.g.....a....M.....3..PK..........K...PK.........n/Q............,...classes/jdk/nio/zipfs/ByteArrayChannel.class.W.w...~&....E@Hb..$.0.....M"...jB..U..N.!..ev....V..e. Zmm.....,9m.i...?...C.{N.=m....I....{......>..y../.h.%.e.V.6..mi..k.;.5fy..Q....J..s.{G.[I_C..c...B.-.:".nPB9.N.%]'..<....nr"..gq..g..!.....#X..e..r.5.j.B.5.S.m....3...i...<s.g.t.+M..1.!.X.`..v....UXE.#.Q.e..eq....VC8mf....:.....Yy..@#.4TzT.:.i........d..Z...6..N.[6b.....f.-....l..f,G.[.l.e.rR.....)Q.@.P.P..+W..I..`.......r.t}.T.....D).A...-..L..V..1.!...,.3.Y...w.$.....Gp#.I........nE..N...v...DzM...M....x.%..u......'....N....R)..K..s...G.=k.d.9c..r.....J`r.V].n.H,r.].^.[.;.\|.d....Rs$m..U$-.=..}.6.y4.xe2..[)..3E....(...

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1039136
Entropy (8bit):	6.580236835541948
Encrypted:	false
SSDEEP:	24576:fXAsqzXlKZSxpJUlwtC/jCQ6tGh91Ds9H2LUVMhmP3oRaEt:fX4zXlnAlwtCbM891YVH6
MD5:	5E807B5DAD1B6C81982037C714DC9AEF
SHA1:	2B818F50C0CE821CD0278C714E57CB591B89B715
SHA-256:	AC94FBB73EBD0CE13AEA7C1AFCBA0DF9A646CBE5795E804FA0C0AC4EBA259E16
SHA-512:	665EA8069E8D75089EF9292DD6F07E19FA7F7FA1294D44F45D017BCED0D16C8281260BCA4AC7896ACBB0DFFB483BFB13BA4298D767A4BB1A91D9FA437D6BECFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......9.}...}...}...t.[.k...........5.w......i......w......y......x...6...m...6...\|......z...}...L.............\|....7.\|......\|...Rich}...................PE..d....9:.........."....'.....v.................@..........................................`.........................................P...P............`..@........j...... )...p.......`..............................._..@............................................text............................... ..`.rdata...c.......d..................@..@.data........P.......2..............@....pdata...j.......l...6..............@..@.rsrc...@....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\sauighfs.rar

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	407502
Entropy (8bit):	7.999550543657746
Encrypted:	true
SSDEEP:	6144:stviMrxWzFJeN+cyifDzC/vyxvjwPZqau/EhT0astOrdzZIhpB+tTeC3I:5MrUDeNeFhLjhT025i6I
MD5:	D4450E9944C3B30B70F09998D5362B11
SHA1:	3DB9D5F433A0B7A7FE4B094BDDE4504EF0816DE3
SHA-256:	A8E872D37E2D83DD3A63BDFE9E0354ED564E326522B4A26075EB6E8E10274459
SHA-512:	CE32A7EA0246D4BC4CDFF9442AC3AF1F511A7BFACEFC137879C6A6AEFD0DE40AB97A8B3462F280703031835E4141817D209AEBDEC11F7EDC993568399E8CA18E
Malicious:	false
Preview:	Rar!........!.....Eqvj0e..5t>z.!Y..?,)Y}V........s...6.h4..D..E.D..P')T...1:...@..9...../.....>.k&.......b...90d.0...D.....E.....f.....P.....:p..fB0..Uf...D...Pj+..&S..q.&i>,...s.......m.)..Hg.\:9a..n.JF]....kH..NY.....ia....._.`;....u..__.c...F......b..\.c....Qj.....H..).]<'w.g.....k,Q>...a\|3AUG..e.C`....Dh...+.8.o.3.By[...U...C.) .3SH~...K"..z......z.B..y.../B.5?...#.t..e......F..).6.......C.U.3..j.I.o^...gT@..;p.K.:.!v.%..3.A.f..}.SG.sR".o...U.......27...2....31.....y...............Q....F.~.t.f..v.V..b.7s.......q.AN;..f...Jx...Q...gBws"pP.1...P.p.=E(.b.......(.......xw?.y.K.K.v...`j..8..a....c..+........Ww.}L.$#/v.........Ee}c_^..3[.P.Z."....K.%.uj....c.'..<{>k......fVn`.-.XU......j{.%@W.i.....%.......9U.6.i8._[+..b....$.A...u.8..\1..\|..xkqt)TDI..s.2 ....#9...'>.......1;y+E..+8........f.Z......7Dd.......ze....\..5...8....;+.qWl#c.......g_1.!.v.......!<.4......}...hYjC.}j......0TF&[.O...y....-.@.m....h.s.cO<t....F....fa4..:....._...:

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\vlc.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	984312
Entropy (8bit):	6.338396454828307
Encrypted:	false
SSDEEP:	24576:ee3xAibB85Z1HrWtB8z1L1OBJB5zzz3zzzozzz3zzz6O:lxAibBEZ1LWtBzxDO
MD5:	37CA63447784D68545801EB2F9DFE1AF
SHA1:	4575FA78C6E54480A1F2DA51082BFB9538649DDF
SHA-256:	31F5E43E9283CF2469D8B3E51E7C28C132C6ECB0DAB855DF52CBF21D5394AE0B
SHA-512:	49A16F4ADE2A434D0E502571E077529CAB54BC98BD4D3EEC45C86A9CFC9623F6830F4046B94730517C6706FDA71C54490EB5ADA538A157D0CC90DC413FA008C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.............................................@.................................... ]....`... .........................................B............ ...(......D........:...P.............................. ...(...................h................................text...X...........................`.P`.data...h".......$..................@.`..rdata..............................@.`@.buildid5...........................@.0@.pdata..D...........................@.0@.xdata..p...........................@.0@.bss..................................`..edata..B............f..............@.0@.idata...............h..............@.0..CRT....h...........................@.@..tls....h...........................@.`..rsrc....(... ...*..................@.0..reloc.......P......................@.0B/4...........p......................@.0B................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\71da1f76509d9c721d84655251014c87_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	2.219411074181711
Encrypted:	false
SSDEEP:	3:/lGlle2QwXln:8A2ZXln
MD5:	62E024FE2476732F71542D38DDF3F263
SHA1:	304A79B7904E2E1017AF6BC24461D2D7B4EDBDE2
SHA-256:	A05BE7F1BA1635E6CB5A46F778B93A0CA8FDDCD60C0E91BE3A9E86040DB067A5
SHA-512:	33162E2CA0135E03436491349B6DA65660B5D0F295B97E5243F4A4E380B51D7D6F00AE51CD48894B4149B6771C8E193E70061A190B6ABFC8B1FCAD3AFE084A7D
Malicious:	false
Preview:	........................................Advanced Installer.

C:\Users\user\AppData\Roaming\Microsoft\Installer\{D0265C05-725E-4038-8426-7D1D1C311BF9}\icon_27.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 9 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	175255
Entropy (8bit):	3.85622158771748
Encrypted:	false
SSDEEP:	1536:45DoI+e7H4NVBFvvMgJOVj5Ho46cOjkDPU:45Dt+e7GVBFvvMg0Vj5Ho4CIDPU
MD5:	333EE8442C6101D0CD9C874D0AD83EAE
SHA1:	22278A01E88B826B16D4936FA254E457B9ACA059
SHA-256:	B5FDF4A4143964A46B7F2BBD1357D075C786F7AFBBA0BE3DD7B2623F379271BF
SHA-512:	04F3BE053ECB44B11FE9ABDE941BFD367B17C0532B2C634FC42AF85CF1BE68C0F495B13F4B3CA35A4DD9E4535629EE1A615001A244DC1B68C871AB364A0A704F
Malicious:	false
Preview:	............ .A4............ .(....4..``.... ......<..HH.... ..T......@@.... .(B../&..00.... ..%..Wh.. .... ............... ............... .h.../....PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..yt..}.....8....H$EI<$Q$%..:.Hv,.Rly.......#..N6...v...dm.....%.2e.<.."-.$x..A.$@..\=.w...68.....`..}..7.X.U...[..U....A..A..A..A..A..A..A..A..A..A..A..A..A..A..)Q.l7...MM/.Q..J)[Q.0........e..u;l...q...X"....v.nj.hV2.j.IR.CS<..C!.O..iY`..f4j.....Y..w.....c$........HB!.....e.A.h...+L...4{i,f,QU.A..D.Z`...R..b..B-B..qd<.b.D...$......E...NQd:..D-..S)..5..Q......e..Y...E.....Y.LZ.E"..D.\5>..4MZG....RJ9..WW..C!....=....y..*.I$...HX..w..E..A.(....E..pl8....F]....16......M. .v..D.......Xm-.,..{.Lw,.+.e.u.z.....,......$Q.......?u..E.h#..".^.P<....K...4..D4..;..g.q....<--/.55....FF.?..K}<..n.....e.UQ.._......y.e....zj..[.....@.hn..,Z.....48.}..%...b/..v..>..t.ow}.......=..A.A.(.MM/.p....~.......R....r..g.]w..7........Y....3(.(.y...7lM.S.(..;:.......

C:\Users\user\AppData\Roaming\Microsoft\Installer\{D0265C05-725E-4038-8426-7D1D1C311BF9}\icon_32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 96x96, 32 bits/pixel, 72x72, 32 bits/pixel
Category:	dropped
Size (bytes):	74814
Entropy (8bit):	4.157215135011018
Encrypted:	false
SSDEEP:	384:2y2eKfQdkzvDKIeTzumt2yr8XbAVzpEoYR:23eKfMkjBozuI2yr8XQze
MD5:	346BAEB443ED5807042532D5A8CBEE66
SHA1:	9DF37248D164B816E0060FC61DB52968E5753644
SHA-256:	578D9022F7CFF1B54D354757D9A49859A65B168F6D9D42936317D893E6106940
SHA-512:	A51DD07A8E8D1CD4F2ECEB6869438F1EFBC030AF42C9248769A82B85307BC955FA06A0A05328C406F94541B1C238A010B4612744ECF22984C9FFDF1F9651B71D
Malicious:	false
Preview:	......``.... .....V...HH.... ..T......00.... ..%...... .... ............... .h.......(...`......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\3c4fc2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C0C9B56F-080E-4F40-9C41-BC28B95F9144}, Number of Words: 10, Subject: Ifid Apps, Author: Grovi Tend, Name of Creating Application: Ifid Apps, Template: x64;1033, Comments: This installer database contains the logic and data required to install Ifid Apps., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Dec 3 19:55:46 2024, Last Saved Time/Date: Tue Dec 3 19:55:46 2024, Last Printed: Tue Dec 3 19:55:46 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	56194048
Entropy (8bit):	7.979389584276561
Encrypted:	false
SSDEEP:	1572864:LP6FnkF2d6VXXtzR5mgvkz1d2x5wKklM:UW7VXtmgMRcxElM
MD5:	02976832766FA022DD51CAC7AF80E779
SHA1:	8E5611992E678B3851EE4BADC86EFA6170257D52
SHA-256:	9D04AEDDB08877A78C258B3AE7DF42A924AE3EA12A0C7085035BB0469204D76B
SHA-512:	718C320A45238E70FB2621605F142ED5E04685EC66788DD8A065830805A874E4CF3F7D73757B30F4CA32009CD75711B2BF18BF5B90FEE6E2C018FC1BCEA26C27
Malicious:	false
Preview:	......................>...................Z.......................2...........t.......0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?......+...,...-...$...%...&...'...(...)............................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0......................................7...9................................................................................... ...!..."...#...$...%...&...'...1...)......+...,...-......./...0.......2...3...4...5...6...:...8...@...D...;...<...=...>...?...C...A...B...H...@...E...F...G...?...I...J...K...+...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i.......k...l...m...n...o...p...q...r...s...........v...w...x...y...z...

C:\Windows\Installer\3c4fc5.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C0C9B56F-080E-4F40-9C41-BC28B95F9144}, Number of Words: 10, Subject: Ifid Apps, Author: Grovi Tend, Name of Creating Application: Ifid Apps, Template: x64;1033, Comments: This installer database contains the logic and data required to install Ifid Apps., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Dec 3 19:55:46 2024, Last Saved Time/Date: Tue Dec 3 19:55:46 2024, Last Printed: Tue Dec 3 19:55:46 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	56194048
Entropy (8bit):	7.979389584276561
Encrypted:	false
SSDEEP:	1572864:LP6FnkF2d6VXXtzR5mgvkz1d2x5wKklM:UW7VXtmgMRcxElM
MD5:	02976832766FA022DD51CAC7AF80E779
SHA1:	8E5611992E678B3851EE4BADC86EFA6170257D52
SHA-256:	9D04AEDDB08877A78C258B3AE7DF42A924AE3EA12A0C7085035BB0469204D76B
SHA-512:	718C320A45238E70FB2621605F142ED5E04685EC66788DD8A065830805A874E4CF3F7D73757B30F4CA32009CD75711B2BF18BF5B90FEE6E2C018FC1BCEA26C27
Malicious:	false
Preview:	......................>...................Z.......................2...........t.......0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?......+...,...-...$...%...&...'...(...)............................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0......................................7...9................................................................................... ...!..."...#...$...%...&...'...1...)......+...,...-......./...0.......2...3...4...5...6...:...8...@...D...;...<...=...>...?...C...A...B...H...@...E...F...G...?...I...J...K...+...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i.......k...l...m...n...o...p...q...r...s...........v...w...x...y...z...

C:\Windows\Installer\MSI5918.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI59E4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5A72.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5AA2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5B01.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI79F4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI97CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608727172078022
Encrypted:	false
SSDEEP:	24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
MD5:	EE09D6A1BB908B42C05FD0BEEB67DFD2
SHA1:	1EB7C1304B7BCA649C2A5902B18A1EA57CEAA532
SHA-256:	7BBF611F5E2A16439DC8CD11936F6364F6D5CC0044545C92775DA5646AFC7752
SHA-512:	2DD2E4E66D2F2277F031C5F3C829A31C3B29196AB27262C6A8F1896A2113A1BE1687C9E8CD9667B89157F099DFB969EF14AE3EA602D4C772E960BC41D39C3D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L.....$g.........."!...).....`...... ........ ...........................................@A............................L...,...@....................Z..`=......\....K..p....................L...... K..@............ ...............................text............................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSI982C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	380520
Entropy (8bit):	6.512348002260683
Encrypted:	false
SSDEEP:	6144:ZSXJmYiFGLzkhEFeCPGi5B8dZ6t+6bUSfcqKgAST:ZSXJ9khElPGvcttbxpAST
MD5:	FFDAACB43C074A8CB9A608C612D7540B
SHA1:	8F054A7F77853DE365A7763D93933660E6E1A890
SHA-256:	7484797EA4480BC71509FA28B16E607F82323E05C44F59FFA65DB3826ED1B388
SHA-512:	A9BD31377F7A6ECF75B1D90648847CB83D8BD65AD0B408C4F8DE6EB50764EEF1402E7ACDFF375B7C3B07AC9F94184BD399A10A22418DB474908B5E7A1ADFE263
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^..?{..?{..?{..x..?{..~..?{...x..?{......?{...~..?{.....?{..z..?{..?z..>{..r..?{..{..?{....?{..?.?{..y..?{.Rich.?{.........PE..L...>.$g.........."!...)..................... .......................................'....@A........................@3..X....3.......... ...............h:.......6..@...p...............................@............ ..(............................text...J........................... ..`.rdata...$... ...&..................@..@.data....!...P......................@....fptable.............@..............@....rsrc... ............B..............@..@.reloc...6.......8...\..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI99C3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	787808
Entropy (8bit):	6.693392695195763
Encrypted:	false
SSDEEP:	24576:aE33f8zyjmfyY43pNRmkL7mh0lhSMXlEeGXDMGz+:L3fSyjmfyY43pNRp7T0eGwGz+
MD5:	8CF47242B5DF6A7F6D2D7AF9CC3A7921
SHA1:	B51595A8A113CF889B0D1DD4B04DF16B3E18F318
SHA-256:	CCB57BDBB19E1AEB2C8DD3845CDC53880C1979284E7B26A1D8AE73BBEAF25474
SHA-512:	748C4767D258BFA6AD2664AA05EF7DC16F2D204FAE40530430EF5D1F38C8F61F074C6EC6501489053195B6B6F6E02D29FDE970D74C6AE97649D8FE1FD342A288
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m..m..m.'n..m.'h.q.m.'i..m.."i..m.."n..m.."h..m.'l..m..l..m.#d..m.#m..m.#...m.....m.#o..m.Rich.m.........PE..L.....$g.........."!...).....4............................................... ............@A........................@J.......J..........................`=......4`...~..p........................... ~..@............................................text............................... ..`.rdata..Z...........................@..@.data...D-...`.......B..............@....fptable.............^..............@....rsrc................`..............@..@.reloc..4`.......b...f..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA3F6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256864
Entropy (8bit):	6.8622477797553
Encrypted:	false
SSDEEP:	3072:rRiE8BF4JQi1a7plM/P5aef3HWxph0LR/hSMXlk4ZqKFya5XB67TDmzyJd5nJMCC:6BQ1k9GH5oph0lhSMXlBXBW/ncHfdKq
MD5:	E0BFA64EEFA440859C8525DFEC1962D0
SHA1:	4FEDB2E7604FFEB30FC0B535235BC38BD73FEA96
SHA-256:	8E1B93631C730C9ECDADF15477CCA540A45A8935EF200A435BA84E15D4B1C80F
SHA-512:	04EA18B777EACB6CC8AF9E63E33E3B5C71307A83D69C8722CEBE538D5DC681D538E731560612F8DA64413D7EDAA872C2A91AC6B4CA58D7B3561C87893D365D6F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K....vv..vv..vv...u..vv...s..vv...r..vv...u..vv...r..vv...s._vv...w..vv..vw..vv.G....vv.G.v..vv.G..vv..v..vv.G.t..vv.Rich.vv.................PE..L.....$g.........."!...).(..........@i.......@......................................;.....@A....................................P.......p...............`=......l....s..p....................s......@r..@............@...............................text....'.......(.................. ..`.rdata..XU...@...V...,..............@..@.data...............................@....fptable............................@....rsrc...p...........................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA54E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	275003
Entropy (8bit):	4.59748705562294
Encrypted:	false
SSDEEP:	3072:3K19QemZyzT5Dt+e7GVBFvvMg0Vj5Ho4CIDPJm:3a9HmZGTx0RFvvMg09DPJm
MD5:	ED84EA8DCDDBCA330FA325FB358971D7
SHA1:	4E7AA38A5D1B70350C21A7A9039C6FD6D3191C69
SHA-256:	938FAC77171B8ECEE7A2965E188215CBBADE8230EDFB4DCBE13812CCD10B44A5
SHA-512:	551970014DBB7BB12EEC22595B5F1B2A89989842D43D84649C19244EA99643CC5067752512A81FF755DC8ADF85F595D0707ECBDF5D34B9B8091B914B7DCBD4EB
Malicious:	false
Preview:	...@IXOS.@.....@wT.Y.@.....@.....@.....@.....@.....@......&.{D0265C05-725E-4038-8426-7D1D1C311BF9}..Ifid Apps..cwqqRXEhZb.msi.@.....@.....@.....@......icon_32.exe..&.{C0C9B56F-080E-4F40-9C41-BC28B95F9144}.....@.....@.....@.....@.......@.....@.....@.......@......Ifid Apps......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@(....@.....@.]....&.{4EAB000E-DEB5-4E28-8448-068C624BCBAA}5.C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\.@.......@.....@.....@......&.{3A93C24E-9EC4-4B96-973D-8D64785398E1}).21:\Software\Grovi Tend\Ifid Apps\Version.@.......@.....@.....@......&.{983AED90-5AA4-4C2B-A9F3-2563FFDAE964}E.C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\libssl-3-x64.dll.@.......@.....@.....@......&.{C04AA22D-BE6B-4EE3-8C36-F938BA4CD485}@.C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe.@.......@.....@.....@......&.{EADBA1F2-9A40-4915-9979-43CFCD1C35CE}E

C:\Windows\Installer\SourceHash{D0265C05-725E-4038-8426-7D1D1C311BF9}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1636213177612358
Encrypted:	false
SSDEEP:	12:JSbX72FjLaAGiLIlHVRpZh/7777777777777777777777777vDHFFGHQit/l0i8Q:JwQI5tyiF
MD5:	382CC42A828236C04EC4E51CF70FD480
SHA1:	2A2A3A22A9F7F1745EFD543D6C55159580997448
SHA-256:	FE72E102C2A29B7E9861B0E6A452C54C1912476C3EB99300AEEE178CA212D05A
SHA-512:	88A78182E64507BF333EED957E55818DE6508FC2295E1B3C94DFC648091A64BEF3EFBC4AE521E124798721231528B84A5A667CCBAA5C7481C81765968B7A5389
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5427872968416554
Encrypted:	false
SSDEEP:	48:a8PhquRc06WXJWjT57ETL5SJ3AErCyJggXf5SJjT5i:lhq1tjT2hnwCTgXhki
MD5:	A61F87A2582CA9F681BED29520EDFC97
SHA1:	ADDECC5D459654D147B75B2F82A71373A03CF5D9
SHA-256:	5074A8FAD1008F942EF7A2FD1AFA42C0105084CBEE0C534CB771E5C90F47D74F
SHA-512:	45BF4B109659E1A7B736858521D989C8BFDCC4310026940908E28DD363BFE2B44BB330B995BB64A41DA9A053AC7258F14B66C74A3B8F02CB807D2C2F6768A35F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365499404131991
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauN:zTtbmkExhMJCIpEe
MD5:	C99D0477BD4DFD0C97B23070DE1C8B4F
SHA1:	6D6E94B9715DBC6049C6B7ACE69765745A40F60B
SHA-256:	E441FB6ABAAA58E3412AB572C99828ACDA04118662CC4CA96099CFF0CC0775D1
SHA-512:	184D2471E940C3D74C927E6266910EE64AA2B51A973EC4208D418494CCA34B894766E62680232250BAE2C9D5234D054A2E214EFB5EF06EC167DF32C98EAF279B
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF24A0C73B886FBF51.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF26E70D620F878543.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12958112116725914
Encrypted:	false
SSDEEP:	24:AyxgwTx0XojADsipV0XojAD+0XojADsipV0XojAD2AEV0yjCyJVQwGzWR80aU+ku:Ai1Td5SJL5SJ3AErCyJggXZTw
MD5:	090692D4F52A2C024063EB895FB2C163
SHA1:	394F12866DC952D1CB08E652C209822AA6CCAA30
SHA-256:	4D272B751453606DD6DBB8E4EB3C4D9D394A12A0506C847E90AB9F3688EC8D8D
SHA-512:	3C5C3C05CECB98CE9B2961CA5A807BDCF2571D01CCE62E3B2842F4EEA4C5C27EFF18E4B2904A21EF0A37F4C2219C555B933BDCAFA7F71778816758ADD09272C9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF39E24CF181511FA3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2388409545129968
Encrypted:	false
SSDEEP:	48:S1iuEWI+CFXJxT5jETL5SJ3AErCyJggXf5SJjT5i:OiRZTuhnwCTgXhki
MD5:	94A663289DE0F677A206248871CA1291
SHA1:	CE7E3D1CBCA16605301B541DE206A2E21CFCEB67
SHA-256:	F11CFE2A343C2000B38F5F37E2BDA31DBED942167302A32936818A510C20C722
SHA-512:	17206C6DB2D27E54575FFD264DA04B57814D68B903F94DEE9F5AA4BBE52882147D4DA834C9E41463A7103E0511B526DD4ADF36097BC76E0FA7C3FE522D18B968
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F1E58BABC54318B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4A163FB5FD1702FB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2388409545129968
Encrypted:	false
SSDEEP:	48:S1iuEWI+CFXJxT5jETL5SJ3AErCyJggXf5SJjT5i:OiRZTuhnwCTgXhki
MD5:	94A663289DE0F677A206248871CA1291
SHA1:	CE7E3D1CBCA16605301B541DE206A2E21CFCEB67
SHA-256:	F11CFE2A343C2000B38F5F37E2BDA31DBED942167302A32936818A510C20C722
SHA-512:	17206C6DB2D27E54575FFD264DA04B57814D68B903F94DEE9F5AA4BBE52882147D4DA834C9E41463A7103E0511B526DD4ADF36097BC76E0FA7C3FE522D18B968
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6D48B57CA40632A9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5427872968416554
Encrypted:	false
SSDEEP:	48:a8PhquRc06WXJWjT57ETL5SJ3AErCyJggXf5SJjT5i:lhq1tjT2hnwCTgXhki
MD5:	A61F87A2582CA9F681BED29520EDFC97
SHA1:	ADDECC5D459654D147B75B2F82A71373A03CF5D9
SHA-256:	5074A8FAD1008F942EF7A2FD1AFA42C0105084CBEE0C534CB771E5C90F47D74F
SHA-512:	45BF4B109659E1A7B736858521D989C8BFDCC4310026940908E28DD363BFE2B44BB330B995BB64A41DA9A053AC7258F14B66C74A3B8F02CB807D2C2F6768A35F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF73BE3C1BAA3DE8C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2388409545129968
Encrypted:	false
SSDEEP:	48:S1iuEWI+CFXJxT5jETL5SJ3AErCyJggXf5SJjT5i:OiRZTuhnwCTgXhki
MD5:	94A663289DE0F677A206248871CA1291
SHA1:	CE7E3D1CBCA16605301B541DE206A2E21CFCEB67
SHA-256:	F11CFE2A343C2000B38F5F37E2BDA31DBED942167302A32936818A510C20C722
SHA-512:	17206C6DB2D27E54575FFD264DA04B57814D68B903F94DEE9F5AA4BBE52882147D4DA834C9E41463A7103E0511B526DD4ADF36097BC76E0FA7C3FE522D18B968
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9B4C11A90FB90206.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07143068049464232
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOnFGHnKzmgVky6lit/:2F0i8n0itFzDHFFGHDit/
MD5:	D5BA24C0307975F735D9A612F8E60690
SHA1:	6A1FBF5D785554AD728E5285D26D37EFD49F2DC1
SHA-256:	957FC1ADFCD3ABEBE896B52FF429C2FEEA3CE46CF280D806723329AFA950CA59
SHA-512:	6A4E78761955E540A6DBA8052981F495F1381F6A0956CF46064405AAEF77E9A0406FA48442D0EEAA76CC3D449AD6EDC02EDA2A10C64AB49EC996A1562E9732AC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA287DA197D60F566.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAA93FA7680937D3F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEF9AC72AF9919C5C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5427872968416554
Encrypted:	false
SSDEEP:	48:a8PhquRc06WXJWjT57ETL5SJ3AErCyJggXf5SJjT5i:lhq1tjT2hnwCTgXhki
MD5:	A61F87A2582CA9F681BED29520EDFC97
SHA1:	ADDECC5D459654D147B75B2F82A71373A03CF5D9
SHA-256:	5074A8FAD1008F942EF7A2FD1AFA42C0105084CBEE0C534CB771E5C90F47D74F
SHA-512:	45BF4B109659E1A7B736858521D989C8BFDCC4310026940908E28DD363BFE2B44BB330B995BB64A41DA9A053AC7258F14B66C74A3B8F02CB807D2C2F6768A35F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF17B23C420EBDDAE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C0C9B56F-080E-4F40-9C41-BC28B95F9144}, Number of Words: 10, Subject: Ifid Apps, Author: Grovi Tend, Name of Creating Application: Ifid Apps, Template: x64;1033, Comments: This installer database contains the logic and data required to install Ifid Apps., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Dec 3 19:55:46 2024, Last Saved Time/Date: Tue Dec 3 19:55:46 2024, Last Printed: Tue Dec 3 19:55:46 2024, Number of Pages: 450
Entropy (8bit):	7.979389584276561
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	cwqqRXEhZb.msi
File size:	56'194'048 bytes
MD5:	02976832766fa022dd51cac7af80e779
SHA1:	8e5611992e678b3851ee4badc86efa6170257d52
SHA256:	9d04aeddb08877a78c258b3ae7df42a924ae3ea12a0c7085035bb0469204d76b
SHA512:	718c320a45238e70fb2621605f142ed5e04685ec66788dd8a065830805a874e4cf3f7d73757b30f4ca32009cd75711b2bf18bf5b90fee6e2c018fc1bcea26c27
SSDEEP:	1572864:LP6FnkF2d6VXXtzR5mgvkz1d2x5wKklM:UW7VXtmgMRcxElM
TLSH:	F7C73360B596C537D66D11B7D529EEEE423F7D220BB048DBB7E4392E0E348C19232A17
File Content Preview:	........................>...................Z.......................2...........t.......0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...*...+...,...-...$...%...&...'...(...)..................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 16:35:42.507375956 CET	55661	53	192.168.2.5	1.1.1.1
Dec 9, 2024 16:35:42.800235987 CET	53	55661	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 16:35:42.507375956 CET	192.168.2.5	1.1.1.1	0x2da	Standard query (0)	search-keys.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 16:35:22.093790054 CET	1.1.1.1	192.168.2.5	0xf6c2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 16:35:22.093790054 CET	1.1.1.1	192.168.2.5	0xf6c2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:35:22
Start date:	09/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\cwqqRXEhZb.msi"
Imagebase:	0x7ff6bfe00000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:35:22
Start date:	09/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6bfe00000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:35:25
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding BFD51C7FF2693EC4009079085FB21FEE
Imagebase:	0x150000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:35:42
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss9A6A.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi9A57.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr9A58.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr9A59.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
Imagebase:	0x910000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:35:42
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:35:50
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\openvpn.exe"
Imagebase:	0x7ff6d3a70000
File size:	1'039'136 bytes
MD5 hash:	5E807B5DAD1B6C81982037C714DC9AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:35:50
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 071E1B50 Relevance: 4.0, Strings: 3, Instructions: 208COMMON

Download Yara Rule

Strings

$eq, xrefs: 071E1BEB
$eq, xrefs: 071E1C3E
$eq, xrefs: 071E1C32

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: $eq$$eq$$eq
API String ID: 0-177832560
Opcode ID: 8c32e849c6c2e90a6eee20608caead8a5d8a96fd3fe194e5c2a36ad2c234bde1
Instruction ID: b7561a8bc8bc803742840bbf8c0a5547dc775e0a0437fac3ce143da89560b6fd
Opcode Fuzzy Hash: 8c32e849c6c2e90a6eee20608caead8a5d8a96fd3fe194e5c2a36ad2c234bde1
Instruction Fuzzy Hash: 926139B171460EAFCB168F68C8406AA7BFAFF85210F14C46AE445CB2D2DB31DD81D7A1

Function 071E1B34 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

$eq, xrefs: 071E1BEB
$eq, xrefs: 071E1C32

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: $eq$$eq
API String ID: 0-2246304398
Opcode ID: 9b3ffa48c0e1993d53acd39a3d6978f5f03c58cb31dfbd0c923522c250720e75
Instruction ID: 5a3142eff8a6ff0d4808d0f85aa4b2ee5ae6023a7c9a8f177acfe880b7cd8b59
Opcode Fuzzy Hash: 9b3ffa48c0e1993d53acd39a3d6978f5f03c58cb31dfbd0c923522c250720e75
Instruction Fuzzy Hash: 2231C3F0610A0EEFCB2ACF15C544AA67BF9BF41220F0981A6D445CB2D1E330CAC0EB51

Function 044D8478 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd9fb608ff8db1528fd2d005a14b599654b5becbf73104128255f8a4116497e
Instruction ID: 3d1ee36b029661b3bdaf965ca0a236695e6e27b31332e6ccc12ce089099b1515
Opcode Fuzzy Hash: 8bd9fb608ff8db1528fd2d005a14b599654b5becbf73104128255f8a4116497e
Instruction Fuzzy Hash: 1BA19F31A00208DFDF14EFA5C954AAEBBF2FF84340F154569E416AB365DB74AD89CB80

Function 044D3C00 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6625a97333c2b9b9a7ff0683d0b00f4cf07ab43093b9ee1455801c25bc4cf1cb
Instruction ID: acfb566cddd1f2b49024925fb72403f5098a9ae3c15312e20eb982ee3cd4b6d1
Opcode Fuzzy Hash: 6625a97333c2b9b9a7ff0683d0b00f4cf07ab43093b9ee1455801c25bc4cf1cb
Instruction Fuzzy Hash: 04916A70A002058FCB06CF99C4A49AEBBB1FF48310B29859AD855EB3A5C735FC51CFA1

Function 044D8BC8 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d528691219c8cdf5dc17beefe039c96c3c1f2325bb39de37007e0307bc5054b6
Instruction ID: eddfae89577cfd08b57ca0de5f8bb31da9d5978330a80c3356f285df7680c196
Opcode Fuzzy Hash: d528691219c8cdf5dc17beefe039c96c3c1f2325bb39de37007e0307bc5054b6
Instruction Fuzzy Hash: 2C71D170A00209CFCB15EF68D850AAEBBF6FF89310F14896AE415DB351DB75AC45CB80

Function 044D8D36 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12a0a3405f7a1fc8bfe6fd7f7911a0d77aaa5fd2345ddf2bbbb653bae4ae185
Instruction ID: aa590dd9d3d8c7471ac8b8f42c4684e8453565f189eb147ae15d851c0d52f20e
Opcode Fuzzy Hash: d12a0a3405f7a1fc8bfe6fd7f7911a0d77aaa5fd2345ddf2bbbb653bae4ae185
Instruction Fuzzy Hash: 14712E70E01208DFDF18EFA4D454BAEBBF2BF88344F14886AD412AB290DB74AC45CB50

Function 044D8959 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9657d45eeba63a26e27a94b9ea667cfc4f44ac9a50f590a63c73c6a891263073
Instruction ID: 8695f92f9855b0ae3edc0783a19f735c4f3b99871982036d876004a78c126a8b
Opcode Fuzzy Hash: 9657d45eeba63a26e27a94b9ea667cfc4f44ac9a50f590a63c73c6a891263073
Instruction Fuzzy Hash: 16417F75A00200DFDB18EF64C854ABE7BB6EF8D750F18496AE516EB7A0CB74AC41CB50

Function 044D8BB3 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d5931e3bc860070ef14292245cf88ea30202dab29407df23fd2f80e1932507
Instruction ID: 9e6c6678c63ef7f76f4098ae9b7f28d40cfbbee216a7efb2c7aaef10b13c4979
Opcode Fuzzy Hash: a7d5931e3bc860070ef14292245cf88ea30202dab29407df23fd2f80e1932507
Instruction Fuzzy Hash: 4E414170E00609DFDB18EFA5C8547AEBBF2BF89344F14896AD016AB791DB74A845CB40

Function 044D3D10 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9952b1028b1d82d4f372b988c39c617ba4ecca1801a60bd242a3ca78dfb297e6
Instruction ID: 67c1004be74c80489520242c4045383453c937b149ea4a87ea732fb50bffafec
Opcode Fuzzy Hash: 9952b1028b1d82d4f372b988c39c617ba4ecca1801a60bd242a3ca78dfb297e6
Instruction Fuzzy Hash: 82413670A005059FCB06CF98C5A49AAFBB1FF48310F25865AD855AB3A4C732FC51CFA1

Function 02B9D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2446694641.0000000002B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31d315db1b03b0a0d551ef10d2fdf26a94a46d01e5ca7ca9de2ddd5de1ddd0e
Instruction ID: 0e3823c65f961a1fb481aa7a65dba4add341dd084f1f95b703e900724796cc04
Opcode Fuzzy Hash: a31d315db1b03b0a0d551ef10d2fdf26a94a46d01e5ca7ca9de2ddd5de1ddd0e
Instruction Fuzzy Hash: E6012671104345ABEB20AB2ACDC4B67FF98EF41334F18C5AAEC480B282C3799841C6B1

Function 02B9D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2446694641.0000000002B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b9d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04537d4b08f97903a01f5e2fb1bbf33bf63edfde5933be955b6558cc58bae03c
Instruction ID: b7c7bf845a5a3c680f350e9f577fbacc9d16a1f63d35bb6e739cd36bb8cb5b2e
Opcode Fuzzy Hash: 04537d4b08f97903a01f5e2fb1bbf33bf63edfde5933be955b6558cc58bae03c
Instruction Fuzzy Hash: 46015E7250E3C05FD7128B258DA4B52BFA4DF53224F1981DBE9888F2E7C3699845C772

Function 044D88ED Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2447006270.00000000044D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 044D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_44d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ada45b23ca68caff2acb04eb4587b1bf15a1dc00c0fe4a9bdc94e5cda81643
Instruction ID: a57779c247dafb4ef47af8e27d15433360cea9a0ae094ee6460146704443aa99
Opcode Fuzzy Hash: 96ada45b23ca68caff2acb04eb4587b1bf15a1dc00c0fe4a9bdc94e5cda81643
Instruction Fuzzy Hash: 1DF03070B4060ADFDB04DBA4C5A5B7E7BB2EF80340F108855D1129F395DB78AD898BC0

Non-executed Functions

Function 071E1658 Relevance: 12.8, Strings: 10, Instructions: 261COMMON

Download Yara Rule

Strings

$eq, xrefs: 071E17B4
$eq, xrefs: 071E1690
tPeq, xrefs: 071E1837
wk, xrefs: 071E173F
$eq, xrefs: 071E166A
tPeq, xrefs: 071E16E1
tPeq, xrefs: 071E16D5
tPeq, xrefs: 071E1843
wk, xrefs: 071E174D
$eq, xrefs: 071E169C

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: tPeq$tPeq$tPeq$tPeq$$eq$$eq$$eq$$eq$wk$wk
API String ID: 0-4289478345
Opcode ID: 4726715783caca5b809a19003c39494c603dba9954512a02342dcf0f2a6b5673
Instruction ID: e9a3a932e919ca5107134fc3c67c5e3d2c1b3e6d7f753d0ac88c315d7eff3764
Opcode Fuzzy Hash: 4726715783caca5b809a19003c39494c603dba9954512a02342dcf0f2a6b5673
Instruction Fuzzy Hash: 36817DB1B05649AFCB168B68C411A67BFFAEF86610F1980BBD545CB2D2CB31CC41C792

Function 071E0898 Relevance: 10.2, Strings: 8, Instructions: 180COMMON

Download Yara Rule

Strings

$eq, xrefs: 071E08EF
4'eq, xrefs: 071E0947
$eq, xrefs: 071E0A56
$eq, xrefs: 071E0A62
4'eq, xrefs: 071E0953
$eq, xrefs: 071E0929
$eq, xrefs: 071E091D
$eq, xrefs: 071E0A3E

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'eq$4'eq$$eq$$eq$$eq$$eq$$eq$$eq
API String ID: 0-3121479685
Opcode ID: ba87381a5a4f8d7aa7d5318ecc845bd34705493aa2afaafd8b39a223b55821ed
Instruction ID: 8a7a18daa0177989a339ad79f371dafd778468333f9050ba505c43bfddffed23
Opcode Fuzzy Hash: ba87381a5a4f8d7aa7d5318ecc845bd34705493aa2afaafd8b39a223b55821ed
Instruction Fuzzy Hash: ED5106B170460BCFDB268E69D80066BBBBAEFC9610F34806BD549C72C1DB76C845C761

Function 071E0E88 Relevance: 6.3, Strings: 5, Instructions: 79COMMON

Download Yara Rule

Strings

$eq, xrefs: 071E0ECB
4~k, xrefs: 071E0F3E
$eq, xrefs: 071E0F00
$eq, xrefs: 071E0F0C
4~k, xrefs: 071E0F30

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4~k$4~k$$eq$$eq$$eq
API String ID: 0-4285643053
Opcode ID: 982825447692df98965f1ffa6e1a7279dce5768322b55d5465c607b1a249830a
Instruction ID: 8d5f25e6e72818f2eb7dae4f53a700d60e00c7bcc220f7699f368465e772663c
Opcode Fuzzy Hash: 982825447692df98965f1ffa6e1a7279dce5768322b55d5465c607b1a249830a
Instruction Fuzzy Hash: 391136F132061B9BCA294569941027B77DA9FC9310B74843AE602CB2C3DFB6C842C3B2

Function 071E04D0 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'eq, xrefs: 071E0547
$eq, xrefs: 071E0526
$eq, xrefs: 071E051A
4'eq, xrefs: 071E053B

Memory Dump Source

Source File: 00000005.00000002.2452113196.00000000071E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_71e0000_powershell.jbxd

Similarity

API ID:
String ID: 4'eq$4'eq$$eq$$eq
API String ID: 0-3287427201
Opcode ID: b8624477cfb2f74d25074bdbb6249db96ce70a49c6c5b4b4014c834f0194e5d5
Instruction ID: 9aaa8cf9ffe19a7617e915c735434bae2d25624c67a502bb4508b622b8a94d1d
Opcode Fuzzy Hash: b8624477cfb2f74d25074bdbb6249db96ce70a49c6c5b4b4014c834f0194e5d5
Instruction Fuzzy Hash: 2E01DBB2B0AB864FCB670128182016A2FB7AFC755076A42DBC051CB2D7CE698C468353

Analysis Process: openvpn.exePID: 1252, Parent PID: 5548COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	5

Executed Functions

Function 00007FF8A7308E20 Relevance: 282.8, APIs: 135, Strings: 26, Instructions: 1024
filetimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlUnwind.KERNEL32 ref: 00007FF8A7308E77
DdeUninitialize.USER32 ref: 00007FF8A7308E7F
IntersectRect.USER32 ref: 00007FF8A7308E8C
CallMsgFilterW.USER32 ref: 00007FF8A7308E9A
GetUserObjectSecurity.USER32 ref: 00007FF8A7308EAF
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF8A7308EBF
GetLastInputInfo.USER32 ref: 00007FF8A7308EC7
GetConsoleMode.KERNEL32 ref: 00007FF8A7308ED1
SetConsoleDisplayMode.KERNEL32 ref: 00007FF8A7308EDE
DisableThreadLibraryCalls.KERNEL32 ref: 00007FF8A7308EE6
GetDialogBaseUnits.USER32 ref: 00007FF8A7308EEC
FlashWindowEx.USER32 ref: 00007FF8A7308EF4
RemoveDirectoryTransactedW.KERNEL32 ref: 00007FF8A7308EFE
DeleteTimerQueueEx.KERNEL32 ref: 00007FF8A7308F08
DeleteCriticalSection.KERNEL32 ref: 00007FF8A7308F10
SetConsoleWindowInfo.KERNEL32 ref: 00007FF8A7308F1D
OpenProcess.KERNEL32 ref: 00007FF8A7308F2A
SetProcessDEPPolicy.KERNEL32 ref: 00007FF8A7308F32
GetExitCodeProcess.KERNEL32 ref: 00007FF8A7308F3C
IsWow64Message.USER32 ref: 00007FF8A7308F42
DdeQueryStringW.USER32 ref: 00007FF8A7308F57
DuplicateHandle.KERNEL32 ref: 00007FF8A7308F76
GetVolumePathNameW.KERNEL32 ref: 00007FF8A7308F83
OpenProcess.KERNEL32 ref: 00007FF8A7308F90
CloseThreadpoolIo.KERNEL32 ref: 00007FF8A7309029
OpenPrivateNamespaceW.KERNEL32 ref: 00007FF8A7309033
PlayMetaFile.GDI32 ref: 00007FF8A730903D
GdiComment.GDI32 ref: 00007FF8A730904A
CancelSynchronousIo.KERNEL32 ref: 00007FF8A7309052
EnumMetaFile.GDI32 ref: 00007FF8A7309062
SelectClipPath.GDI32 ref: 00007FF8A730906C
GetNumaHighestNodeNumber.KERNEL32 ref: 00007FF8A7309074
GetShortPathNameW.KERNEL32 ref: 00007FF8A7309081
GetConsoleSelectionInfo.KERNEL32 ref: 00007FF8A7309089
GetThreadUILanguage.KERNEL32 ref: 00007FF8A730908F
GetTextAlign.GDI32 ref: 00007FF8A7309097
MapUserPhysicalPagesScatter.KERNEL32 ref: 00007FF8A73090CB
WriteConsoleOutputAttribute.KERNEL32 ref: 00007FF8A73090E1
ChangeTimerQueueTimer.KERNEL32 ref: 00007FF8A73090F1
CreateThreadpoolWait.KERNEL32 ref: 00007FF8A73090FE
GetApplicationRestartSettings.KERNEL32 ref: 00007FF8A730910E
UnregisterWaitEx.KERNEL32 ref: 00007FF8A7309118
MoveFileW.KERNEL32 ref: 00007FF8A7309122
GetProcessorSystemCycleTime.KERNEL32 ref: 00007FF8A7309136
OpenPrivateNamespaceW.KERNEL32 ref: 00007FF8A7309140
CreateEventW.KERNEL32 ref: 00007FF8A7309150
FlushViewOfFile.KERNEL32 ref: 00007FF8A730915A
ReleaseMutex.KERNEL32 ref: 00007FF8A7309162
AddResourceAttributeAce.KERNEL32 ref: 00007FF8A7309181
CreateWaitableTimerExW.KERNEL32 ref: 00007FF8A7309191
CheckTokenCapability.KERNEL32 ref: 00007FF8A73091F2
GetComputerNameW.KERNEL32 ref: 00007FF8A73091FC
TransmitCommChar.KERNEL32 ref: 00007FF8A7309206
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF8A7309216
DebugBreakProcess.KERNEL32 ref: 00007FF8A730921E
LocalAlloc.KERNEL32 ref: 00007FF8A7309228
IsBadStringPtrW.KERNEL32 ref: 00007FF8A7309232
LocalUnlock.KERNEL32 ref: 00007FF8A730923A
FreeLibrary.KERNEL32 ref: 00007FF8A7309242
CreateWaitableTimerW.KERNEL32 ref: 00007FF8A730924F
SetFileApisToOEM.KERNEL32 ref: 00007FF8A7309255
SetDllDirectoryW.KERNEL32 ref: 00007FF8A730925D
GetCurrentProcess.KERNEL32 ref: 00007FF8A7309263
SetFirmwareEnvironmentVariableExW.KERNEL32 ref: 00007FF8A7309278
GetActiveProcessorGroupCount.KERNEL32 ref: 00007FF8A730927E
GetLocalTime.KERNEL32 ref: 00007FF8A73092D6
GetOverlappedResult.KERNEL32 ref: 00007FF8A730930A
CreateHardLinkTransactedW.KERNEL32 ref: 00007FF8A730931A
ApplicationRecoveryInProgress.KERNEL32 ref: 00007FF8A7309322
SetThreadPreferredUILanguages.KERNEL32 ref: 00007FF8A730932F
GetProfileSectionW.KERNEL32 ref: 00007FF8A730933C
ResolveLocaleName.KERNEL32 ref: 00007FF8A730934E
SetFileAttributesW.KERNEL32 ref: 00007FF8A7309358
FindNextChangeNotification.KERNEL32 ref: 00007FF8A7309360
UnlockFile.KERNEL32 ref: 00007FF8A7309375
Wow64DisableWow64FsRedirection.KERNEL32 ref: 00007FF8A730937D
UnregisterApplicationRestart.KERNEL32 ref: 00007FF8A7309383
WaitForSingleObject.KERNEL32 ref: 00007FF8A730938D
GetConsoleAliasExesLengthW.KERNEL32 ref: 00007FF8A7309393
VerifyScripts.KERNEL32 ref: 00007FF8A73093B1
CreateFileMappingNumaW.KERNEL32 ref: 00007FF8A73093D0
RegCreateKeyExW.ADVAPI32 ref: 00007FF8A730945B
RegSetValueExW.ADVAPI32 ref: 00007FF8A7309492
RegCloseKey.ADVAPI32 ref: 00007FF8A730949D
CreateMutexW.KERNEL32 ref: 00007FF8A730950B
MessageBoxW.USER32 ref: 00007FF8A730952F
CloseHandle.KERNEL32 ref: 00007FF8A7309538
OutputDebugStringA.KERNEL32 ref: 00007FF8A7309547
SetDefaultCommConfigW.KERNEL32 ref: 00007FF8A7309605
UnlockFileEx.KERNEL32 ref: 00007FF8A730961E
MoveFileTransactedW.KERNEL32 ref: 00007FF8A7309639
CreateDirectoryW.KERNEL32 ref: 00007FF8A7309643
MapViewOfFile.KERNEL32 ref: 00007FF8A730965C
SetConsoleMode.KERNEL32 ref: 00007FF8A7309666
AreFileApisANSI.KERNEL32 ref: 00007FF8A730966C
FileTimeToDosDateTime.KERNEL32 ref: 00007FF8A7309679
BindIoCompletionCallback.KERNEL32 ref: 00007FF8A7309686
CompareStringEx.KERNEL32 ref: 00007FF8A73096C0
GetDurationFormat.KERNEL32 ref: 00007FF8A73096E7
GetNumberOfConsoleMouseButtons.KERNEL32 ref: 00007FF8A73096EF
LocalAlloc.KERNEL32 ref: 00007FF8A73096F9
GetConsoleAliasExesLengthW.KERNEL32 ref: 00007FF8A73096FF
GetFileBandwidthReservation.KERNEL32 ref: 00007FF8A730971B
CloseThreadpoolTimer.KERNEL32 ref: 00007FF8A7309723
SetConsoleActiveScreenBuffer.KERNEL32 ref: 00007FF8A730972B
GetCalendarInfoW.KERNEL32 ref: 00007FF8A7309746
TransactNamedPipe.KERNEL32 ref: 00007FF8A7309766
SetProcessShutdownParameters.KERNEL32 ref: 00007FF8A7309770
GlobalGetAtomNameW.KERNEL32 ref: 00007FF8A730977D
GetThreadUILanguage.KERNEL32 ref: 00007FF8A7309783
GetCurrentProcessId.KERNEL32 ref: 00007FF8A7309789
GetDurationFormatEx.KERNEL32 ref: 00007FF8A73097B5
AdjustWindowRect.USER32 ref: 00007FF8A7309836
SetFileTime.KERNEL32 ref: 00007FF8A7309846
SetWaitableTimerEx.KERNEL32 ref: 00007FF8A7309868
VirtualFree.KERNEL32 ref: 00007FF8A7309875
LocaleNameToLCID.KERNEL32 ref: 00007FF8A7309884
GetKeyState.USER32 ref: 00007FF8A730988C
CloseThreadpool.KERNEL32 ref: 00007FF8A7309894
IsValidNLSVersion.KERNEL32 ref: 00007FF8A73098A6
LocalHandle.KERNEL32 ref: 00007FF8A73098AE
DebugBreakProcess.KERNEL32 ref: 00007FF8A73098B6
WriteFileEx.KERNEL32 ref: 00007FF8A73098CB
GetNumaProcessorNodeEx.KERNEL32 ref: 00007FF8A73098D5
PeekNamedPipe.KERNEL32 ref: 00007FF8A73098EF
CloseWindowStation.USER32 ref: 00007FF8A73098F7
BindIoCompletionCallback.KERNEL32 ref: 00007FF8A7309904
InitAtomTable.KERNEL32 ref: 00007FF8A730990C
AddClipboardFormatListener.USER32 ref: 00007FF8A7309914
CharLowerBuffW.USER32 ref: 00007FF8A730991E
WriteFile.KERNEL32 ref: 00007FF8A7309933
ChangeClipboardChain.USER32 ref: 00007FF8A730993D
DdeAddData.USER32 ref: 00007FF8A730994D
ExitProcess.KERNEL32 ref: 00007FF8A73099A2
ExitProcess.KERNEL32 ref: 00007FF8A7309CB9

Strings

KtggTglFSXcelGfcN, xrefs: 00007FF8A7309476
VUUU, xrefs: 00007FF8A7309593
VUUU, xrefs: 00007FF8A7309AA2
VUUU, xrefs: 00007FF8A7309ADE
4KugzHnK33DFx6k9oK1, xrefs: 00007FF8A73097A7
eWxGfJTHq6Dav65jynUin4crP85, xrefs: 00007FF8A73096D9
t2qO688Q75l94ff4Ei, xrefs: 00007FF8A73096B4
VUUU, xrefs: 00007FF8A7309A32
Software\irCuXPsbcrroLAbDzcAek, xrefs: 00007FF8A7309432
vryyVoeIHVjuokZt, xrefs: 00007FF8A7309526
VUUU, xrefs: 00007FF8A7309A63
jox28Myu64Nwg5yQbm6JoDuq1i6, xrefs: 00007FF8A7309791
ltjCr1k51h7R8NJwQKSeu5dkw, xrefs: 00007FF8A73093A8
VUUU, xrefs: 00007FF8A7309BEE
XO3U5x7hImEeFfa4rE8sBg, xrefs: 00007FF8A730989D
rCsPKWCIvalZJrl, xrefs: 00007FF8A7309500
TihGZnTkUBbOxvh, xrefs: 00007FF8A7309540
vBlkYMvZWDXyfagiFqJ, xrefs: 00007FF8A730951F
6SUwo1IGbXk2a8N3HjI382R8zTR, xrefs: 00007FF8A730968E
E27IMi2mqQ8oVol63t7xwt9Q3Pk4, xrefs: 00007FF8A730969A
NnYMBeSxqf3hByq4KLX, xrefs: 00007FF8A730987D
5BsXL21IG4Ozm9TTcZuzCrcTzx177, xrefs: 00007FF8A7309345
VUUU, xrefs: 00007FF8A7309B8F
VUUU, xrefs: 00007FF8A7309C13
6m897wa3k4kfx4HjYLrxie, xrefs: 00007FF8A7309399
VUUU, xrefs: 00007FF8A7309BB2

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: File$Process$Console$Create$Timer$CloseName$LocalTime$FreeInfoOpenStringThreadThreadpoolWindow$ApplicationChangeDebugDirectoryExitFormatHandleModeNumaPathProcessorTransactedUnlockWaitWaitableWow64Write$ActiveAliasAllocApisAtomAttributeBindBreakCallbackCharClipboardCommCompletionCurrentDeleteDisableDiskDurationExesLanguageLengthLibraryLocaleMessageMetaMoveMutexNamedNamespaceNodeNumberObjectOutputPipePrivateQueueRectRestartSectionSpaceUnregisterUserView$AdjustAlignAttributesBandwidthBaseBuffBufferButtonsCalendarCallCallsCancelCapabilityChainCheckClipCodeCommentCompareComputerConfigCountCriticalCycleDataDateDefaultDialogDisplayDuplicateEnumEnvironmentEventFilterFindFirmwareFlashFlushGlobalGroupHardHighestInitInputIntersectLanguagesLastLinkListenerLowerMappingMouseNextNotificationOverlappedPagesParametersPeekPhysicalPlayPolicyPreferredProfileProgressQueryRecoveryRedirectionReleaseRemoveReservationResolveResourceResultScatterScreenScriptsSecuritySelectSelectionSettingsShortShutdownSingleStateStationSynchronousSystemTableTextTokenTransactTransmitUninitializeUnitsUnwindValidValueVariableVerifyVersionVirtualVolume
String ID: 4KugzHnK33DFx6k9oK1$5BsXL21IG4Ozm9TTcZuzCrcTzx177$6SUwo1IGbXk2a8N3HjI382R8zTR$6m897wa3k4kfx4HjYLrxie$E27IMi2mqQ8oVol63t7xwt9Q3Pk4$KtggTglFSXcelGfcN$NnYMBeSxqf3hByq4KLX$Software\irCuXPsbcrroLAbDzcAek$TihGZnTkUBbOxvh$VUUU$VUUU$VUUU$VUUU$VUUU$VUUU$VUUU$VUUU$VUUU$XO3U5x7hImEeFfa4rE8sBg$eWxGfJTHq6Dav65jynUin4crP85$jox28Myu64Nwg5yQbm6JoDuq1i6$ltjCr1k51h7R8NJwQKSeu5dkw$rCsPKWCIvalZJrl$t2qO688Q75l94ff4Ei$vBlkYMvZWDXyfagiFqJ$vryyVoeIHVjuokZt
API String ID: 262985072-3226831835
Opcode ID: fb5327fdcdddce12187ccf471fdf63ff171168283395b443f3335a15776c6b50
Instruction ID: 6fde183a80f68dcd764bd36f83e580a3bc07a030756358dd3d8dd563da362e9e
Opcode Fuzzy Hash: fb5327fdcdddce12187ccf471fdf63ff171168283395b443f3335a15776c6b50
Instruction Fuzzy Hash: AC920232B1AA5293E728CF74E81566E33A2FF88785F818139DA4F46A64CF3DD445DB40

Function 00007FF8A7303D50 Relevance: 180.8, APIs: 89, Strings: 14, Instructions: 597
timethreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProfileSectionW.KERNEL32 ref: 00007FF8A7303DA2
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8A7303DAC
ConvertThreadToFiberEx.KERNEL32 ref: 00007FF8A7303DB6
CopyFileTransactedW.KERNEL32 ref: 00007FF8A7303DD4
AssignProcessToJobObject.KERNEL32 ref: 00007FF8A7303DDE
IsValidLanguageGroup.KERNEL32 ref: 00007FF8A7303DE8
AddVectoredContinueHandler.KERNEL32 ref: 00007FF8A7303DF2
SetConsoleOutputCP.KERNEL32 ref: 00007FF8A7303DFA
SetProcessPreferredUILanguages.KERNEL32 ref: 00007FF8A7303E07
SetThreadIdealProcessor.KERNEL32 ref: 00007FF8A7303E11
GetCompressedFileSizeW.KERNEL32 ref: 00007FF8A7303E1B
EnumSystemLocalesW.KERNEL32 ref: 00007FF8A7303E25
WaitCommEvent.KERNEL32 ref: 00007FF8A7303E32
WriteProcessMemory.KERNEL32 ref: 00007FF8A7303E47
VirtualQuery.KERNEL32 ref: 00007FF8A7303E54
ChangeTimerQueueTimer.KERNEL32 ref: 00007FF8A7303E64
Wow64DisableWow64FsRedirection.KERNEL32 ref: 00007FF8A7303E6C
SetWaitableTimer.KERNEL32 ref: 00007FF8A7303E85
GetConsoleDisplayMode.KERNEL32 ref: 00007FF8A7303E8D
GetQueuedCompletionStatus.KERNEL32 ref: 00007FF8A7303EA1
GetApplicationRecoveryCallback.KERNEL32 ref: 00007FF8A7303EB6
DialogBoxIndirectParamW.USER32 ref: 00007FF8A7303F0A
UpdateLayeredWindow.USER32 ref: 00007FF8A7303F31
ContinueDebugEvent.KERNEL32 ref: 00007FF8A7303F3E
SetCommMask.KERNEL32 ref: 00007FF8A7303F48
GetTimeZoneInformationForYear.KERNEL32 ref: 00007FF8A7303F55
MoveFileWithProgressW.KERNEL32 ref: 00007FF8A7303F69
SetClassLongW.USER32 ref: 00007FF8A7303F76
HiliteMenuItem.USER32 ref: 00007FF8A7303F86
LoadBitmapW.USER32 ref: 00007FF8A7303F90
GetUserObjectSecurity.USER32 ref: 00007FF8A7303FA5
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7303FC2
SetThreadExecutionState.KERNEL32 ref: 00007FF8A7303FCA
ReplyMessage.USER32 ref: 00007FF8A7303FD2
IsThreadAFiber.KERNEL32 ref: 00007FF8A7303FD8
IsValidNLSVersion.KERNEL32 ref: 00007FF8A73045CF
GetUserPreferredUILanguages.KERNEL32 ref: 00007FF8A73045DF
GetCommState.KERNEL32 ref: 00007FF8A73045E9
SetFileApisToOEM.KERNEL32 ref: 00007FF8A73045EF
GetHandleInformation.KERNEL32 ref: 00007FF8A73045F9
CreateFileW.KERNEL32 ref: 00007FF8A7304616
LoadModule.KERNEL32 ref: 00007FF8A7304625
ReleaseSRWLockShared.KERNEL32 ref: 00007FF8A730462D
GetCurrencyFormatW.KERNEL32 ref: 00007FF8A7304646
FindResourceExW.KERNEL32 ref: 00007FF8A7304656
GetCurrentProcessorNumberEx.KERNEL32 ref: 00007FF8A730465E
GetCommTimeouts.KERNEL32 ref: 00007FF8A7304668
VirtualAlloc.KERNEL32 ref: 00007FF8A7304678
DeleteTimerQueue.KERNEL32 ref: 00007FF8A7304680
RequestWakeupLatency.KERNEL32 ref: 00007FF8A7304688
VerSetConditionMask.KERNEL32 ref: 00007FF8A7304695
GetApplicationRestartSettings.KERNEL32 ref: 00007FF8A73046A5

Strings

fsm9Gkva1BlCaiWfQg4U8675, xrefs: 00007FF8A73045C6
- Encrypted, xrefs: 00007FF8A73041A6
- Hidden, xrefs: 00007FF8A7304150
8lbGeKiUQy8Xx3Q86Re6l2Z, xrefs: 00007FF8A7303FB7
- Directory, xrefs: 00007FF8A7304126
Current Directory: , xrefs: 00007FF8A73040E6
- Read-only, xrefs: 00007FF8A730413B
M4LrBe1qFV5x1LBk4XGvl1qzJMxY, xrefs: 00007FF8A730461E
- System, xrefs: 00007FF8A7304165
- Compressed, xrefs: 00007FF8A7304190
- Temporary, xrefs: 00007FF8A73041BC
- Archive, xrefs: 00007FF8A730417A
VUUU, xrefs: 00007FF8A7303EC3
Attributes:, xrefs: 00007FF8A7304111

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: File$CommThreadTimer$Process$ApplicationConsoleContinueEventFiberInformationLanguagesLoadMaskObjectPreferredProcessorQueueStateUserValidVirtualWow64$AllocApisAssignBitmapByteCallbackChangeCharClassCompletionCompressedConditionConvertCopyCreateCurrencyCurrentDebugDeleteDialogDirectoryDisableDisplayEnumExecutionFindFormatGroupHandleHandlerHiliteIdealIndirectItemLanguageLatencyLayeredLocalesLockLongMemoryMenuMessageModeModuleMoveMultiNumberOutputParamProfileProgressQueryQueuedRecoveryRedirectionReleaseReplyRequestResourceRestartSectionSecuritySettingsSharedSizeStatusSystemTimeTimeoutsTransactedUpdateVectoredVersionWaitWaitableWakeupWideWindowWindowsWithWriteYearZone
String ID: - Archive$ - Compressed$ - Directory$ - Encrypted$ - Hidden$ - Read-only$ - System$ - Temporary$8lbGeKiUQy8Xx3Q86Re6l2Z$Attributes:$Current Directory: $M4LrBe1qFV5x1LBk4XGvl1qzJMxY$VUUU$fsm9Gkva1BlCaiWfQg4U8675
API String ID: 1706443817-1374925252
Opcode ID: b5556a6754790e023ae2cee460cfeadc0032a6b8fb3061be663761c33cd367d0
Instruction ID: 10ec2f37ce4a1d270fcd2985bf0bafce46221b15c53a1382a99e4ce0585108d4
Opcode Fuzzy Hash: b5556a6754790e023ae2cee460cfeadc0032a6b8fb3061be663761c33cd367d0
Instruction Fuzzy Hash: EF42D132B0AA52A6FB28DF75E85577E73A2FF88394F808139DA4E459A4CF3CD1059740

Function 00007FF8A7304E30 Relevance: 170.8, APIs: 78, Strings: 19, Instructions: 1046
timeregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF8A7304E89
InvalidateRect.USER32 ref: 00007FF8A73051B5
BeginPaint.USER32 ref: 00007FF8A73051C4
CreateSolidBrush.GDI32 ref: 00007FF8A7305222
FillRect.USER32 ref: 00007FF8A7305249
GetStockObject.GDI32 ref: 00007FF8A7305254
FrameRect.USER32 ref: 00007FF8A7305264
DeleteObject.GDI32 ref: 00007FF8A730526D
CreateSolidBrush.GDI32 ref: 00007FF8A73052CE
FillRect.USER32 ref: 00007FF8A73052F4
GetStockObject.GDI32 ref: 00007FF8A73052FF
FrameRect.USER32 ref: 00007FF8A7305310
DeleteObject.GDI32 ref: 00007FF8A7305319
EndPaint.USER32 ref: 00007FF8A7305330
KillTimer.USER32 ref: 00007FF8A730533F
PostQuitMessage.USER32 ref: 00007FF8A7305347
SetTimer.USER32 ref: 00007FF8A730535D
GetCurrentProcess.KERNEL32 ref: 00007FF8A7305565
GetProcessTimes.KERNEL32 ref: 00007FF8A730558F
OutputDebugStringW.KERNEL32 ref: 00007FF8A73056DB
AddAtomW.KERNEL32 ref: 00007FF8A7305750
FindCloseChangeNotification.KERNEL32 ref: 00007FF8A7305758
EnumSystemLanguageGroupsW.KERNEL32 ref: 00007FF8A7305765
AddVectoredContinueHandler.KERNEL32 ref: 00007FF8A730576F
GetCPInfoExW.KERNEL32 ref: 00007FF8A730577C
EnterSynchronizationBarrier.KERNEL32 ref: 00007FF8A7305786
VirtualQuery.KERNEL32 ref: 00007FF8A7305793
GetCalendarInfoEx.KERNEL32 ref: 00007FF8A73057BA
OpenEventW.KERNEL32 ref: 00007FF8A73057C7
GetNumaProximityNodeEx.KERNEL32 ref: 00007FF8A73057D1
FindFirstFileNameW.KERNEL32 ref: 00007FF8A73057E6
Polygon.GDI32 ref: 00007FF8A73057F3
OpenMutexW.KERNEL32 ref: 00007FF8A7305807
OutputDebugStringW.KERNEL32 ref: 00007FF8A730581C
CloseHandle.KERNEL32 ref: 00007FF8A7305825
OutputDebugStringW.KERNEL32 ref: 00007FF8A7305834
GetTempPathW.KERNEL32 ref: 00007FF8A7305846
GetFileAttributesW.KERNEL32 ref: 00007FF8A73058C5
OutputDebugStringA.KERNEL32 ref: 00007FF8A7305AD7
RegOpenKeyExW.ADVAPI32 ref: 00007FF8A7305B69
OutputDebugStringW.KERNEL32 ref: 00007FF8A7305BB9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A7305CED
LoadLibraryExW.KERNEL32 ref: 00007FF8A7305D60
GetStartupInfoW.KERNEL32 ref: 00007FF8A7305D68
SetConsoleTitleW.KERNEL32 ref: 00007FF8A7305D70
lstrcatW.KERNEL32 ref: 00007FF8A7305D7A
GetStdHandle.KERNEL32 ref: 00007FF8A7305D82
SetProcessMitigationPolicy.KERNEL32 ref: 00007FF8A7305D8F
TerminateThread.KERNEL32 ref: 00007FF8A7305D99
SetCurrentConsoleFontEx.KERNEL32 ref: 00007FF8A7305DA6
Beep.KERNEL32 ref: 00007FF8A7305DB0
GetModuleHandleExW.KERNEL32 ref: 00007FF8A7305DBD
CommConfigDialogW.KERNEL32 ref: 00007FF8A7305DCA
SetProtectedPolicy.KERNEL32 ref: 00007FF8A7305DD7
ReadConsoleOutputAttribute.KERNEL32 ref: 00007FF8A7305E15
lstrcmpiW.KERNEL32 ref: 00007FF8A7305E1F
FindNextFileNameW.KERNEL32 ref: 00007FF8A7305E2C
GetConsoleMode.KERNEL32 ref: 00007FF8A7305E36
GetNumberOfConsoleMouseButtons.KERNEL32 ref: 00007FF8A7305E3E
GetTapePosition.KERNEL32 ref: 00007FF8A7305E53
GetStringTypeExW.KERNEL32 ref: 00007FF8A7305E68
InterlockedPopEntrySList.KERNEL32 ref: 00007FF8A7305E70
HeapValidate.KERNEL32 ref: 00007FF8A7305E7D
RegisterWaitForSingleObject.KERNEL32 ref: 00007FF8A7305E95
SetConsoleActiveScreenBuffer.KERNEL32 ref: 00007FF8A7305E9D
CopyFile2.KERNEL32 ref: 00007FF8A7305EB4
CreateNamedPipeW.KERNEL32 ref: 00007FF8A7305ED5
CreatePipe.KERNEL32 ref: 00007FF8A7305EE5
SetSystemTimeAdjustment.KERNEL32 ref: 00007FF8A7305EEF
DeleteFileW.KERNEL32 ref: 00007FF8A7305EF7
ResolveLocaleName.KERNEL32 ref: 00007FF8A7305F09
StartThreadpoolIo.KERNEL32 ref: 00007FF8A7305F11
CreateDirectoryTransactedW.KERNEL32 ref: 00007FF8A7305F21
GetNLSVersionEx.KERNEL32 ref: 00007FF8A7305F33
AreFileApisANSI.KERNEL32 ref: 00007FF8A7305F39
FindAtomW.KERNEL32 ref: 00007FF8A7305F41
RemoveVectoredContinueHandler.KERNEL32 ref: 00007FF8A7305F49
TryAcquireSRWLockShared.KERNEL32 ref: 00007FF8A7305F51

Strings

3KM7OXoPOd585Gp3mi7, xrefs: 00007FF8A7305F2A
OOh9Uf7C1lI7Z7QcpLC1l, xrefs: 00007FF8A7305EAD
seoigjisue uioase fuia., xrefs: 00007FF8A7305815
OIUuaiu faiuhf aiu iawo., xrefs: 00007FF8A730582D
Mk8sU7RRTk8a9M5J, xrefs: 00007FF8A73057DF
xCxNxsrhAAoYOvohAf, xrefs: 00007FF8A7305BB2
%s\RnLihFRKmEQBxSQsVLFbYI, xrefs: 00007FF8A7305853
JykSVNViyQCA74vCJYYLZYTmQ4B, xrefs: 00007FF8A73057AA
OCJosytFHRoRJamf, xrefs: 00007FF8A7305BA9
uiashfiua auifh uiaw: , xrefs: 00007FF8A7305613
qH1juRvm8d9VJ56OM8neEtz, xrefs: 00007FF8A73057B3
ios_base::failbit set, xrefs: 00007FF8A7305CA6
Software\XIiGBYruPloeQmB, xrefs: 00007FF8A7305B5B
ios_base::badbit set, xrefs: 00007FF8A7305C9A
YSJOzKtYnhALMsqY, xrefs: 00007FF8A7305AD0
Yz95OOFu5QvN4EFyr7OM5jwd7, xrefs: 00007FF8A7305EA6
SHz2SIxe3ZXiefZ1R55wS6, xrefs: 00007FF8A7305F00
MyUniqueMutex, xrefs: 00007FF8A73057F9
ios_base::eofbit set, xrefs: 00007FF8A7305CAD

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ConsoleOutputString$CreateDebugFileObjectRect$Find$DeleteHandleInfoNameOpenProcess$AtomBrushCloseContinueCurrentFillFrameHandlerPaintPipePolicySolidStockSystemTimerVectored$AcquireActiveAdjustmentApisAttributeAttributesBarrierBeepBeginBufferButtonsCalendarChangeCommConcurrency::cancel_current_taskConfigCopyDialogDirectoryEnterEntryEnumEventFile2FirstFontGroupsHeapInterlockedInvalidateKillLanguageLibraryListLoadLocaleLockMessageMitigationModeModuleMouseMutexNamedNextNodeNotificationNumaNumberPathPolygonPositionPostProcProtectedProximityQueryQuitReadRegisterRemoveResolveScreenSharedSingleStartStartupSynchronizationTapeTempTerminateThreadThreadpoolTimeTimesTitleTransactedTypeValidateVersionVirtualWaitWindowlstrcatlstrcmpi
String ID: %s\RnLihFRKmEQBxSQsVLFbYI$3KM7OXoPOd585Gp3mi7$JykSVNViyQCA74vCJYYLZYTmQ4B$Mk8sU7RRTk8a9M5J$MyUniqueMutex$OCJosytFHRoRJamf$OIUuaiu faiuhf aiu iawo.$OOh9Uf7C1lI7Z7QcpLC1l$SHz2SIxe3ZXiefZ1R55wS6$Software\XIiGBYruPloeQmB$YSJOzKtYnhALMsqY$Yz95OOFu5QvN4EFyr7OM5jwd7$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$qH1juRvm8d9VJ56OM8neEtz$seoigjisue uioase fuia.$uiashfiua auifh uiaw: $xCxNxsrhAAoYOvohAf
API String ID: 3390045081-1114390751
Opcode ID: 5b7ee8ce716c075936bae7d2d5fd64f1d9426a1487d6ca9146531cb246b0b468
Instruction ID: c49d5eb247b42cdfdc3d76febe8455a1599cd823fb2380bac210b1f52b680082
Opcode Fuzzy Hash: 5b7ee8ce716c075936bae7d2d5fd64f1d9426a1487d6ca9146531cb246b0b468
Instruction Fuzzy Hash: 52B2AC32A0BA42AAEB14CF65E8406BD73A1FF847C4F814136DA4E47AA8DF3DE545D740

Function 00007FF8A73072C0 Relevance: 158.3, APIs: 78, Strings: 12, Instructions: 789
timethreadencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8A738A434: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A738A448

CryptAcquireContextW.ADVAPI32 ref: 00007FF8A7307377
CryptGenRandom.ADVAPI32 ref: 00007FF8A7307394
CryptReleaseContext.ADVAPI32 ref: 00007FF8A73073A3
GetTempPathW.KERNEL32 ref: 00007FF8A73077A4
GetTempFileNameW.KERNEL32 ref: 00007FF8A73077C2
VirtualFreeEx.KERNEL32 ref: 00007FF8A7307992
WritePrivateProfileStructW.KERNEL32 ref: 00007FF8A73079A7
FlsAlloc.KERNEL32 ref: 00007FF8A73079AF
GetModuleFileNameW.KERNEL32 ref: 00007FF8A73079BC
GetApplicationRecoveryCallback.KERNEL32 ref: 00007FF8A73079D1
OpenWaitableTimerW.KERNEL32 ref: 00007FF8A73079DE
IsSystemResumeAutomatic.KERNEL32 ref: 00007FF8A73079E4
EnumTimeFormatsW.KERNEL32 ref: 00007FF8A73079F1
SetLocalTime.KERNEL32 ref: 00007FF8A73079F9
FreeLibrary.KERNEL32 ref: 00007FF8A7307A01
SetThreadPriorityBoost.KERNEL32 ref: 00007FF8A7307A0B
GetStartupInfoW.KERNEL32 ref: 00007FF8A7307A13
ConnectNamedPipe.KERNEL32 ref: 00007FF8A7307A1D
SetFirmwareEnvironmentVariableW.KERNEL32 ref: 00007FF8A7307A2D
LCIDToLocaleName.KERNEL32 ref: 00007FF8A7307A3D
FlushInstructionCache.KERNEL32 ref: 00007FF8A7307A4A
CreateSemaphoreW.KERNEL32 ref: 00007FF8A7307A6D
CloseHandle.KERNEL32 ref: 00007FF8A7307A7B
OpenJobObjectW.KERNEL32 ref: 00007FF8A7307ADE
CreateThreadpoolCleanupGroup.KERNEL32 ref: 00007FF8A7307AE4
RtlCaptureStackBackTrace.KERNEL32 ref: 00007FF8A7307AF4
FindFirstVolumeMountPointW.KERNEL32 ref: 00007FF8A7307B01
GetFileMUIInfo.KERNEL32 ref: 00007FF8A7307B16
DeleteFiber.KERNEL32 ref: 00007FF8A7307B1E
ConvertThreadToFiber.KERNEL32 ref: 00007FF8A7307B26
EnumCalendarInfoW.KERNEL32 ref: 00007FF8A7307B36
FlsGetValue.KERNEL32 ref: 00007FF8A7307B3E
GetCommModemStatus.KERNEL32 ref: 00007FF8A7307B48
VirtualAlloc.KERNEL32 ref: 00007FF8A7307B58
GetLocalTime.KERNEL32 ref: 00007FF8A7307B60
GetNumaAvailableMemoryNode.KERNEL32 ref: 00007FF8A7307B6A
GetProcAddress.KERNEL32 ref: 00007FF8A7307B79
GetThreadContext.KERNEL32 ref: 00007FF8A7307B83
GetFileAttributesW.KERNEL32 ref: 00007FF8A7307B8B
DebugBreak.KERNEL32 ref: 00007FF8A7307B91
UnregisterWait.KERNEL32 ref: 00007FF8A7307B99
IsDBCSLeadByte.KERNEL32 ref: 00007FF8A7307C0F
DeleteVolumeMountPointW.KERNEL32 ref: 00007FF8A7307C17
GetConsoleCP.KERNEL32 ref: 00007FF8A7307C1D
RtlCaptureContext.KERNEL32 ref: 00007FF8A7307C25
FindNextFileNameW.KERNEL32 ref: 00007FF8A7307C32
WritePrivateProfileStringW.KERNEL32 ref: 00007FF8A7307C42
ReadConsoleOutputCharacterW.KERNEL32 ref: 00007FF8A7307C5B
GetUILanguageInfo.KERNEL32 ref: 00007FF8A7307C70
RequestWakeupLatency.KERNEL32 ref: 00007FF8A7307C78
GetFullPathNameTransactedW.KERNEL32 ref: 00007FF8A7307C8D
CreatePrivateNamespaceW.KERNEL32 ref: 00007FF8A7307C9A
LeaveCriticalSection.KERNEL32 ref: 00007FF8A7307CA2
GetConsoleProcessList.KERNEL32 ref: 00007FF8A7307CAC

Strings

2bu19L8uc5l155h6, xrefs: 00007FF8A7307B70
fYDXXwQKdihTZp, xrefs: 00007FF8A7308045
DqaCGGnU3RAQLWHVeodNMMq, xrefs: 00007FF8A7307EF7
ios_base::failbit set, xrefs: 00007FF8A7307D3D
bOmgI, xrefs: 00007FF8A730745A
I2jQt471MgKXsK6O6q1, xrefs: 00007FF8A7307F2B
HEX, xrefs: 00007FF8A73077B4
ios_base::badbit set, xrefs: 00007FF8A7307885
dOEctFxIURcuUsUvi, xrefs: 00007FF8A7307A5C
txt, xrefs: 00007FF8A73077F9
R6Oh7CAgiYDlD9FV4688, xrefs: 00007FF8A7307B0D
ios_base::eofbit set, xrefs: 00007FF8A7307D44

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: File$NameTime$ContextInfo$ConsoleCreateCryptPrivateThread$AllocCaptureDeleteEnumFiberFindFreeLocalMountOpenPathPointProfileSystemTempVirtualVolumeWrite$AcquireAddressApplicationAttributesAutomaticAvailableBackBoostBreakByteCacheCalendarCallbackCharacterCleanupCloseCommConnectConvertCriticalDebugEnvironmentFirmwareFirstFlushFormatsFullGroupHandleInstructionLanguageLatencyLeadLeaveLibraryListLocaleMemoryModemModuleNamedNamespaceNextNodeNumaObjectOutputPipePriorityProcProcessRandomReadRecoveryReleaseRequestResumeSectionSemaphoreStackStartupStatusStringStructThreadpoolTimerTraceTransactedUnregisterValueVariableWaitWaitableWakeup
String ID: 2bu19L8uc5l155h6$DqaCGGnU3RAQLWHVeodNMMq$HEX$I2jQt471MgKXsK6O6q1$R6Oh7CAgiYDlD9FV4688$bOmgI$dOEctFxIURcuUsUvi$fYDXXwQKdihTZp$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$txt
API String ID: 1768793651-1975038400
Opcode ID: 760114263707f93232ca2819c7427e5fcbc88839c177ee198424e5f21b448609
Instruction ID: b038ff73112ad55b10fa6a418a6cf761c5e446a550269afc4a21bef6e2e396cb
Opcode Fuzzy Hash: 760114263707f93232ca2819c7427e5fcbc88839c177ee198424e5f21b448609
Instruction Fuzzy Hash: C582D232A1AB81A6EB14CF34E8517BE73A1FF88784F819135EA4E46A68DF3CD145D740

Function 00007FF8A7303570 Relevance: 91.3, APIs: 46, Strings: 6, Instructions: 303
timethreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8A7308870: DdeUnaccessData.USER32 ref: 00007FF8A73088C2
Part of subcall function 00007FF8A7308870: DrawIcon.USER32 ref: 00007FF8A73088D2
Part of subcall function 00007FF8A7308870: GetFileSize.KERNEL32 ref: 00007FF8A73088DC
Part of subcall function 00007FF8A7308870: SetThreadContext.KERNEL32 ref: 00007FF8A73088E6
Part of subcall function 00007FF8A7308870: CreateDirectoryTransactedW.KERNEL32 ref: 00007FF8A73088F6
Part of subcall function 00007FF8A7308870: GetFileTime.KERNEL32 ref: 00007FF8A7308906
Part of subcall function 00007FF8A7308870: LoadPackagedLibrary.KERNEL32 ref: 00007FF8A7308915
Part of subcall function 00007FF8A7308870: SetFileValidData.KERNEL32 ref: 00007FF8A730891F
Part of subcall function 00007FF8A7308870: PurgeComm.KERNEL32 ref: 00007FF8A7308929
Part of subcall function 00007FF8A7308870: GetMenuDefaultItem.USER32 ref: 00007FF8A7308936
Part of subcall function 00007FF8A7308870: SendMessageTimeoutW.USER32 ref: 00007FF8A7308955
Part of subcall function 00007FF8A7308870: FileTimeToDosDateTime.KERNEL32 ref: 00007FF8A7308962
Part of subcall function 00007FF8A7308870: GetCapture.USER32 ref: 00007FF8A7308968
Part of subcall function 00007FF8A7308870: GetProfileIntW.KERNEL32 ref: 00007FF8A7308975
Part of subcall function 00007FF8A7308870: IsHungAppWindow.USER32 ref: 00007FF8A730897D
Part of subcall function 00007FF8A7308870: RegisterDeviceNotificationW.USER32 ref: 00007FF8A730898A
Part of subcall function 00007FF8A7308870: LoadBitmapW.USER32 ref: 00007FF8A7308994
Part of subcall function 00007FF8A7308870: CancelIo.KERNEL32 ref: 00007FF8A730899C
Part of subcall function 00007FF8A7308870: ReleaseSemaphore.KERNEL32 ref: 00007FF8A73089A9
Part of subcall function 00007FF8A7308870: UpdateLayeredWindowIndirect.USER32 ref: 00007FF8A73089B3
Part of subcall function 00007FF8A7308870: GetConsoleMode.KERNEL32 ref: 00007FF8A73089BD
Part of subcall function 00007FF8A7308870: FormatMessageW.KERNEL32 ref: 00007FF8A73089DC

InitializeProcThreadAttributeList.KERNEL32 ref: 00007FF8A73037A4
RtlCaptureContext.KERNEL32 ref: 00007FF8A73037AC
EnumTimeFormatsEx.KERNEL32 ref: 00007FF8A73037C1
GetConsoleAliasesLengthW.KERNEL32 ref: 00007FF8A73037C9
SetFileValidData.KERNEL32 ref: 00007FF8A73037D3
GetFullPathNameTransactedW.KERNEL32 ref: 00007FF8A73037E8
GetTapeStatus.KERNEL32 ref: 00007FF8A73037F0
GetUserDefaultLCID.KERNEL32 ref: 00007FF8A73037F6
PeekConsoleInputW.KERNEL32 ref: 00007FF8A7303806
InitializeConditionVariable.KERNEL32 ref: 00007FF8A730380E
GetTimeFormatEx.KERNEL32 ref: 00007FF8A7303830
GetFileInformationByHandle.KERNEL32 ref: 00007FF8A730383A
OfferVirtualMemory.KERNEL32 ref: 00007FF8A7303847
GetKerningPairsW.GDI32 ref: 00007FF8A7303854
SetLastError.KERNEL32 ref: 00007FF8A730385C
GetVolumeInformationByHandleW.KERNEL32 ref: 00007FF8A730387F
InitOnceComplete.KERNEL32 ref: 00007FF8A730388C
AnimatePalette.GDI32 ref: 00007FF8A730389C
TerminateThread.KERNEL32 ref: 00007FF8A73038A6
BitBlt.GDI32 ref: 00007FF8A73038CB
CreateFiber.KERNEL32 ref: 00007FF8A73038D8
GetTextAlign.GDI32 ref: 00007FF8A73038E0
GetUserGeoID.KERNEL32 ref: 00007FF8A73038E8
GetEnvironmentStringsW.KERNEL32 ref: 00007FF8A7303950
DeleteProcThreadAttributeList.KERNEL32 ref: 00007FF8A7303958
CreateThreadpoolTimer.KERNEL32 ref: 00007FF8A7303965
GetModuleHandleExW.KERNEL32 ref: 00007FF8A7303972
ChangeTimerQueueTimer.KERNEL32 ref: 00007FF8A7303982
FindStringOrdinal.KERNEL32 ref: 00007FF8A73039A3
QueryDepthSList.KERNEL32 ref: 00007FF8A73039AB
SwitchToFiber.KERNEL32 ref: 00007FF8A73039B3
CreateMailslotW.KERNEL32 ref: 00007FF8A73039C3
GetStdHandle.KERNEL32 ref: 00007FF8A73039CB
GetSystemDEPPolicy.KERNEL32 ref: 00007FF8A73039D1
OfferVirtualMemory.KERNEL32 ref: 00007FF8A73039DE
GetAtomNameW.KERNEL32 ref: 00007FF8A73039EB
OpenFileMappingW.KERNEL32 ref: 00007FF8A73039F8
FileTimeToSystemTime.KERNEL32 ref: 00007FF8A7303A02
EnumTimeFormatsW.KERNEL32 ref: 00007FF8A7303A0F
GetVersion.KERNEL32 ref: 00007FF8A7303A15
CreateTimerQueueTimer.KERNEL32 ref: 00007FF8A7303A31
SetPriorityClass.KERNEL32 ref: 00007FF8A7303A3B
FlsSetValue.KERNEL32 ref: 00007FF8A7303A45
GetVersion.KERNEL32 ref: 00007FF8A7303A4B
OpenPrivateNamespaceW.KERNEL32 ref: 00007FF8A7303A55
GlobalLock.KERNEL32 ref: 00007FF8A7303A5D

Strings

mnQ8f0lmPmVJNEI8GaN3D6Aztl6xyW8KYZ4ZopHYB2FbsIqHLN4TZuOUB5qvM+psptuIPfsHwQT+3JLFt/1aPvGMD5fTBm/G8kSDeajQpdxLVEO5sEBtewAB7TOYd+UlxDzddrk9kJYjjvXPNWapqm4Mk7errJBybiT4Q91bkJ4Md+lTA7iwVxibtYfHx/YNDghe88Twq5MNG6LEj5VqYUtJmibXiSAZmQQ6gfP3gIWeu0CQ5R/8qVzdaezPPw2OwWcv, xrefs: 00007FF8A7303932
NAd6erubTbYEaMK3j2OPBw4US, xrefs: 00007FF8A7303990
4BIDVDf5IWX2BldkheVS637L9esEl, xrefs: 00007FF8A730381D
e96litMJwfH9qV5u3CFPnMK, xrefs: 00007FF8A7303829
Ips2R6GcB73uAe8NLn7, xrefs: 00007FF8A73037B8
G8t2YBKApZGrJ9m233iZ27K13, xrefs: 00007FF8A730399A

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: FileTime$CreateTimer$HandleThread$ConsoleDataList$AttributeCaptureContextDefaultEnumFiberFormatFormatsInformationInitializeLoadMemoryMessageNameOfferOpenProcQueueSystemTransactedUserValidVersionVirtualWindow$AliasesAlignAnimateAtomBitmapCancelChangeClassCommCompleteConditionDateDeleteDepthDeviceDirectoryDrawEnvironmentErrorFindFullGlobalHungIconIndirectInitInputItemKerningLastLayeredLengthLibraryLockMailslotMappingMenuModeModuleNamespaceNotificationOnceOrdinalPackagedPairsPalettePathPeekPolicyPriorityPrivateProfilePurgeQueryRegisterReleaseSemaphoreSendSizeStatusStringStringsSwitchTapeTerminateTextThreadpoolTimeoutUnaccessUpdateValueVariableVolume
String ID: 4BIDVDf5IWX2BldkheVS637L9esEl$G8t2YBKApZGrJ9m233iZ27K13$Ips2R6GcB73uAe8NLn7$NAd6erubTbYEaMK3j2OPBw4US$e96litMJwfH9qV5u3CFPnMK$mnQ8f0lmPmVJNEI8GaN3D6Aztl6xyW8KYZ4ZopHYB2FbsIqHLN4TZuOUB5qvM+psptuIPfsHwQT+3JLFt/1aPvGMD5fTBm/G8kSDeajQpdxLVEO5sEBtewAB7TOYd+UlxDzddrk9kJYjjvXPNWapqm4Mk7errJBybiT4Q91bkJ4Md+lTA7iwVxibtYfHx/YNDghe88Twq5MNG6LEj5VqYUtJmibXiSAZmQQ6gfP3gIWeu0CQ5R/8qVzdaezPPw2OwWcv
API String ID: 4121532481-288095831
Opcode ID: 019e626283627785135766d01466a13653ef6a7d8dff09ffd417f391119cc3e4
Instruction ID: 089acd5378154ae13327cc6ef111e37a7ebc54f738eb73c7c09ec2d166a7932e
Opcode Fuzzy Hash: 019e626283627785135766d01466a13653ef6a7d8dff09ffd417f391119cc3e4
Instruction Fuzzy Hash: FEE10432A0AB8293FB248F75F85566EB3A1FF88394F818139DA5E459A4CF7CD105CB44

Function 00007FF8A7309E00 Relevance: 59.7, APIs: 32, Strings: 2, Instructions: 170
processpipetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileWithProgressW.KERNEL32 ref: 00007FF8A7309E70
GetCommModemStatus.KERNEL32 ref: 00007FF8A7309E7A
SetMailslotInfo.KERNEL32 ref: 00007FF8A7309E84
EnumResourceNamesW.KERNEL32 ref: 00007FF8A7309E94
GetStartupInfoW.KERNEL32 ref: 00007FF8A7309E9C
FindNextVolumeMountPointW.KERNEL32 ref: 00007FF8A7309EA9
GetCurrentProcessorNumberEx.KERNEL32 ref: 00007FF8A7309EB1
InterlockedPushListSListEx.KERNEL32 ref: 00007FF8A7309EC1
TerminateProcess.KERNEL32 ref: 00007FF8A7309ECB
GetCurrentProcessorNumberEx.KERNEL32 ref: 00007FF8A7309ED3
GetActiveProcessorCount.KERNEL32 ref: 00007FF8A7309EDB
RequestWakeupLatency.KERNEL32 ref: 00007FF8A7309EE3
EnumSystemLanguageGroupsW.KERNEL32 ref: 00007FF8A7309EF0
GetBinaryTypeW.KERNEL32 ref: 00007FF8A7309EFA
OfferVirtualMemory.KERNEL32 ref: 00007FF8A7309F07
IsSystemResumeAutomatic.KERNEL32 ref: 00007FF8A7309F0D
DeviceIoControl.KERNEL32 ref: 00007FF8A7309F30
ReadConsoleOutputW.KERNEL32 ref: 00007FF8A7309F49
InitOnceComplete.KERNEL32 ref: 00007FF8A7309F56
FlushProcessWriteBuffers.KERNEL32 ref: 00007FF8A7309F5C
CreateProcessW.KERNEL32 ref: 00007FF8A7309F88
GetTimeZoneInformationForYear.KERNEL32 ref: 00007FF8A7309F95
DeleteVolumeMountPointW.KERNEL32 ref: 00007FF8A730A00E
GetNamedPipeClientComputerNameW.KERNEL32 ref: 00007FF8A730A01B
GetLocaleInfoEx.KERNEL32 ref: 00007FF8A730A030
InitializeSynchronizationBarrier.KERNEL32 ref: 00007FF8A730A03D
GetProcessWorkingSetSizeEx.KERNEL32 ref: 00007FF8A730A04D
FindFirstVolumeW.KERNEL32 ref: 00007FF8A730A057
TrySubmitThreadpoolCallback.KERNEL32 ref: 00007FF8A730A064
GetFileSize.KERNEL32 ref: 00007FF8A730A06E
SetProcessPreferredUILanguages.KERNEL32 ref: 00007FF8A730A07B
VirtualQueryEx.KERNEL32 ref: 00007FF8A730A08B

Strings

pYYHNjWzbsQFChoBPYB, xrefs: 00007FF8A730A095
4ye7klLBxbA49zL2Vq56p6C4, xrefs: 00007FF8A730A024

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Process$InfoProcessorVolume$CurrentEnumFileFindListMountNumberPointSizeSystemVirtual$ActiveAutomaticBarrierBinaryBuffersCallbackClientCommCompleteComputerConsoleControlCountCreateDeleteDeviceFirstFlushGroupsInformationInitInitializeInterlockedLanguageLanguagesLatencyLocaleMailslotMemoryModemMoveNameNamedNamesNextOfferOnceOutputPipePreferredProgressPushQueryReadRequestResourceResumeStartupStatusSubmitSynchronizationTerminateThreadpoolTimeTypeWakeupWithWorkingWriteYearZone
String ID: 4ye7klLBxbA49zL2Vq56p6C4$pYYHNjWzbsQFChoBPYB
API String ID: 4217189656-1299669585
Opcode ID: 3c794e33c66c8d244cc03cb3335949345a0b332e71cd797dadc5e3d631d92b53
Instruction ID: a9fc1b51d745f52931c214c2cd61c7f8b4ad3e9cd43570274aece34b035b5a0e
Opcode Fuzzy Hash: 3c794e33c66c8d244cc03cb3335949345a0b332e71cd797dadc5e3d631d92b53
Instruction Fuzzy Hash: AE71B032B0AA9193F728DF75B81562FB3A2FF88345F819038DA4E45864CF3DD0499B04

Function 00007FF8A7303A80 Relevance: 40.7, APIs: 27, Instructions: 179
threadtimememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseThreadpoolWork.KERNEL32 ref: 00007FF8A7303B10
GetConsoleCursorInfo.KERNEL32 ref: 00007FF8A7303B1A
SetSystemFileCacheSize.KERNEL32 ref: 00007FF8A7303B27
LocalUnlock.KERNEL32 ref: 00007FF8A7303B2F
GetConsoleAliasExesW.KERNEL32 ref: 00007FF8A7303B39
FillConsoleOutputAttribute.KERNEL32 ref: 00007FF8A7303B4F
QueryIdleProcessorCycleTime.KERNEL32 ref: 00007FF8A7303B59
GetShortPathNameW.KERNEL32 ref: 00007FF8A7303B66
CancelIoEx.KERNEL32 ref: 00007FF8A7303B70
SetPriorityClass.KERNEL32 ref: 00007FF8A7303B7A
GetThreadIOPendingFlag.KERNEL32 ref: 00007FF8A7303C12
GetCommandLineW.KERNEL32 ref: 00007FF8A7303C18
CreateEventW.KERNEL32 ref: 00007FF8A7303C28
GetStartupInfoW.KERNEL32 ref: 00007FF8A7303C30
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF8A7303C40
OpenPrivateNamespaceW.KERNEL32 ref: 00007FF8A7303C4A
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF8A7303C5A
GetFirmwareType.KERNEL32 ref: 00007FF8A7303C62
GetLongPathNameTransactedW.KERNEL32 ref: 00007FF8A7303C72
FileTimeToSystemTime.KERNEL32 ref: 00007FF8A7303C7C
TryAcquireSRWLockShared.KERNEL32 ref: 00007FF8A7303C84
InitOnceExecuteOnce.KERNEL32 ref: 00007FF8A7303C94
GetProcessHeap.KERNEL32 ref: 00007FF8A7303C9A
GetDriveTypeW.KERNEL32 ref: 00007FF8A7303CA2
SetConsoleCP.KERNEL32 ref: 00007FF8A7303CAA
GetCommState.KERNEL32 ref: 00007FF8A7303CB4
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF8A7303CC1

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Console$NamePrivateTime$FileInfoOncePathProcessProfileQuerySectionSystemType$AcquireAliasAttributeCacheCancelClassCloseCommCommandCreateCursorCycleDriveEventExecuteExesFillFirmwareFlagFullHeapIdleImageInitLineLocalLockLongNamespaceOpenOutputPendingPriorityProcessorSharedShortSizeStartupStateThreadThreadpoolTransactedUnlockWorkWrite
String ID:
API String ID: 1360258227-0
Opcode ID: dd137468b921da7f6f5afd6c3baac1566354ee6648b3b597d37d4195cc4f05f4
Instruction ID: ab05b5e1a66a959b1aca6ec5c36c580557eae16d3eb60e6079f0767058d813a4
Opcode Fuzzy Hash: dd137468b921da7f6f5afd6c3baac1566354ee6648b3b597d37d4195cc4f05f4
Instruction Fuzzy Hash: D4816B32B06B11AAFB24CF71E8557AE33B1FF48388F808539DA5E16A58DF3C91499744

Function 00007FF8A735C480 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExA.KERNELBASE ref: 00007FF8A735C4C5

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 5f538518f70937bf11e419d51a4fea6598bbd6422f46c342526eb7ef06b1ca16
Instruction ID: d6bd023aef13f88f7da155c71dc16a27506a3a5de3dcecbee528923cabe123b6
Opcode Fuzzy Hash: 5f538518f70937bf11e419d51a4fea6598bbd6422f46c342526eb7ef06b1ca16
Instruction Fuzzy Hash: ECF092B7600A8496CB50CFAAD584AAD77A0F758BD8B258027EB5C83714CB3AC495CB00

Function 00007FF8A737E984 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A737E9AC
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A737E9FE
_RTC_Initialize.LIBCMT ref: 00007FF8A737EA2C
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A737EA52
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A737EA7D

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 536385e7d69e2311f948b38b4d99e1947c2b244044acaeef2898a37a43193d8f
Instruction ID: 75de606199d6fa8679ec74349e31eea771af18ad288776c0f52cefe6cdf48859
Opcode Fuzzy Hash: 536385e7d69e2311f948b38b4d99e1947c2b244044acaeef2898a37a43193d8f
Instruction Fuzzy Hash: 18819C61E4FA43A6F690EF6A94413BD2790FF857C8F868135E94C473A6DE3CE801A600

Function 00007FF8A7392750 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF8A73927C9
GetFileType.KERNEL32 ref: 00007FF8A73927DF

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 41e34074fe02b841acf694b0dd4cac41e5d43b55a65c15485351d84a8410b44d
Instruction ID: 918715ad8777b7c98ae9e4c1ff12c1dff57164228884457656d537a9a3665b60
Opcode Fuzzy Hash: 41e34074fe02b841acf694b0dd4cac41e5d43b55a65c15485351d84a8410b44d
Instruction Fuzzy Hash: BD31B521E19F42A1E7608F1595A017C6650FB45BF0FA9533ADB6E573E0CF38E461E348

Function 00007FF8A735BEA0 Relevance: 1.6, APIs: 1, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE ref: 00007FF8A735BF15

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: f4b8e0852565ae240f485a8ed5b173096ae8d21d336fe275133f3bd28a2ee16b
Instruction ID: 53cc0c1ed362a7f8318b9b7938530bd1edc8865afd91661a03e4cc0404c8cb04
Opcode Fuzzy Hash: f4b8e0852565ae240f485a8ed5b173096ae8d21d336fe275133f3bd28a2ee16b
Instruction Fuzzy Hash: 3311F0F7610A84D6DB50CFAAC4853A877A0E799F8AF29D01ACF1D47350DB3AC189C701

Function 00007FF8A735BC70 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF8A735BCAE

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 08162ecbcb6fe265952aeab26004fd56f186c16ea12c815fdaed98c207f13e25
Instruction ID: 010ad77b46231546ad8e563a91b9bd877a52f49bfa2d6eec000b6cc97054d2fc
Opcode Fuzzy Hash: 08162ecbcb6fe265952aeab26004fd56f186c16ea12c815fdaed98c207f13e25
Instruction Fuzzy Hash: 381133B7600A88C6CB50CF6AD988AA87760F79CB89F268116DF0D43350DB36C495CB40

Function 00007FF8A733D8E0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A733D9A9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 08b4c4aee603363bf07928ea8d64e28bc3a2b3d129bb78397a86ea956161cd31
Instruction ID: 1461ecfdea3299eaf88160917d6ac09af05fab1511100f180d92a5892087b1d8
Opcode Fuzzy Hash: 08b4c4aee603363bf07928ea8d64e28bc3a2b3d129bb78397a86ea956161cd31
Instruction Fuzzy Hash: F3210331A0AE82A1E710DF15F94016D73A8FB987C4B85423AE58C43B64EF3CE965E741

Function 00007FF8A7335710 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A73357D9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 0b80384e093ec071265204ddd0eefcbb44b8f1f8a2a188ba99573b5da12a9be7
Instruction ID: 3ff8a4129c8ea288ba80764f4b521025788758ece3eb2e45b8956ffc11f73147
Opcode Fuzzy Hash: 0b80384e093ec071265204ddd0eefcbb44b8f1f8a2a188ba99573b5da12a9be7
Instruction Fuzzy Hash: C2212631A0FF82A2E720CF15E85016D7365EB98BD0B950235E94C43B64EF3CE5A59740

Function 00007FF8A7331630 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A73316F9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: a2b84ea57e8461e4fde0980b891f02291d7e5e7ac5b38bc6df3c7d03040d4f06
Instruction ID: 61c8ef0251c6c1eb673c7fd0f743b343d3e533167f07cb758062d15e1d6e805f
Opcode Fuzzy Hash: a2b84ea57e8461e4fde0980b891f02291d7e5e7ac5b38bc6df3c7d03040d4f06
Instruction Fuzzy Hash: BD212571A0AF42A1E711DF11F84016D7365FB887D0B554235DA9C43B60EF7CE965EB80

Function 00007FF8A732D500 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A732D5C9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 512a6bbdaf5d269f240ce598c51cd294a15f20c358adc1c30a853964fadc3d6a
Instruction ID: 5793ee3b26a2c58b7706e734ccba3262fecab2b37acd06ef865d3d2c487a5802
Opcode Fuzzy Hash: 512a6bbdaf5d269f240ce598c51cd294a15f20c358adc1c30a853964fadc3d6a
Instruction Fuzzy Hash: 6D212431A0AF82A6E750CF11E84016D73A8FB887C4F954236D54D83B64EF7CE565E780

Function 00007FF8A7332330 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A73323F9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 4ae6e61fb6eb1b0b53499be4a1d5ab09b77bc838d555f12bc062500fac05ca1a
Instruction ID: 2eab0c29034f8bcdd8c1d73831563923038b80da85706c32d5706f8896933a4c
Opcode Fuzzy Hash: 4ae6e61fb6eb1b0b53499be4a1d5ab09b77bc838d555f12bc062500fac05ca1a
Instruction Fuzzy Hash: 19211372A0BB42A1E7208F21F8801AD7364FB887D0B964236D65C53764EF3CA4A5E744

Function 00007FF8A73433C0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A7343489

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 7d86488e27e26ab759a8bde32fe5f3bd1ff06b706aca0176743afc5cda18146e
Instruction ID: dcf53c7906560e336d0a5b7802de9d8cd42679eaaf2272227b3b74c614c4ff26
Opcode Fuzzy Hash: 7d86488e27e26ab759a8bde32fe5f3bd1ff06b706aca0176743afc5cda18146e
Instruction Fuzzy Hash: 9A213431A0BE42A1E710CF15E9401AD7368FB887D4F950236E65C43B60EF3CE565E741

Function 00007FF8A73363F0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A73364B9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: f9874cab13728a75d224e1222a8ad5292bf921ad642b79130d3e0095a1cfa5a5
Instruction ID: d4d407de8ac4fd1ba75d9063febfc67aed104f330f5b55de43f1ebb9c6a2441b
Opcode Fuzzy Hash: f9874cab13728a75d224e1222a8ad5292bf921ad642b79130d3e0095a1cfa5a5
Instruction Fuzzy Hash: 6B213471A0AE42A5E721CF11F84016D73A9FB887D0F954236E64C43761EF3CE465E750

Function 00007FF8A7344110 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A73441D9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: b1c85c6d2aed6a24b3ba5e02b377987f4527ca5b6dae23e3cee41855ee9b7eab
Instruction ID: 2916f0b9c406ea1296fab3941f3e886b87d4c3de625261e0d3e109950bf8daa4
Opcode Fuzzy Hash: b1c85c6d2aed6a24b3ba5e02b377987f4527ca5b6dae23e3cee41855ee9b7eab
Instruction Fuzzy Hash: C3212371A0AE82A1EB11CF15E84017D77A4FB987D8F954236DA4D43760EF3CE465E740

Function 00007FF8A7348F40 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A7349009

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: c1b681732f3a8fbf2340d1e220e98793f4afe87d86f22ea73e10974c112f575b
Instruction ID: 0065d21781ce069aefaba01c910bc5fa23bcfb6d930cfb71de7fad7c5bd478bf
Opcode Fuzzy Hash: c1b681732f3a8fbf2340d1e220e98793f4afe87d86f22ea73e10974c112f575b
Instruction Fuzzy Hash: 2E212431A0EF42A6E710CF11E8401AD73A8FB887D4B954236E65C43764EF3DE5A5E780

Function 00007FF8A7344E40 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A7344F09

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: b8be2fc03289dfcc8c559de8b9057637e4731d248370c0f6d19369f435ef59cc
Instruction ID: 9876b6540142abc89105bea6633101f36e88ee513cdbac5c45ccaf4725f48203
Opcode Fuzzy Hash: b8be2fc03289dfcc8c559de8b9057637e4731d248370c0f6d19369f435ef59cc
Instruction Fuzzy Hash: 5821F331A0BB82A5EB10CF16F84016D7368EB887D4B954235D64D42B64EF3CE5A5EB40

Function 00007FF8A733CC00 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A733CCC9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 8778791de9cad6250b9ef29b28ae8f335022c7a90d44e865c7abff8f82902ab9
Instruction ID: 1f32c9296e752ba9741ee0defbdf16ebd9e6ecc4740243f83a812c39dd691b6a
Opcode Fuzzy Hash: 8778791de9cad6250b9ef29b28ae8f335022c7a90d44e865c7abff8f82902ab9
Instruction Fuzzy Hash: DF21F671A0AE82A1EB20CF15E84117D7364FB887D0F550235EA8C43764EF3CE5A5E740

Function 00007FF8A7334A10 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A7334AD9

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 80db31324878fee03efbb9928be267fffabc00edbc67bf6a7c62ef559b6b567a
Instruction ID: e65de97cb0d0d5d6e1c10de3d54253c78f5c9dd4a137d2e4c2aefbcd39abc4a4
Opcode Fuzzy Hash: 80db31324878fee03efbb9928be267fffabc00edbc67bf6a7c62ef559b6b567a
Instruction Fuzzy Hash: C7216431A0AF82A1EB50CF05E84116E73A4FB887D4F810236E65D03B60EF3CE564E740

Function 00007FF8A7338AD0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A7338B99

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: eb122bab39e63ac342cec77bdd6290423f3d7e54555f0e9fb61b7837d59de438
Instruction ID: 428b093e93de4a17b3951252fb2ae5d005e6723a3662441a5b5e09842e6d1e2d
Opcode Fuzzy Hash: eb122bab39e63ac342cec77bdd6290423f3d7e54555f0e9fb61b7837d59de438
Instruction Fuzzy Hash: F821F471A0AF42A2E712CF15E8401AD7368FB887D4B954235EA5C43760EF7CE565E780

Function 00007FF8A734A960 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8A734AA29

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release__std_exception_destroy
String ID:
API String ID: 507308885-0
Opcode ID: 97ab1a8bad8aff4bebc421ff614fb1733eacc70cea2d55a31d7b0169cd75df06
Instruction ID: 7d79d0f2be7f8eb8fcef4f9ea1d196238c682e93d9cb1f099b1f5874029696c7
Opcode Fuzzy Hash: 97ab1a8bad8aff4bebc421ff614fb1733eacc70cea2d55a31d7b0169cd75df06
Instruction Fuzzy Hash: CB216431A0AE82A1FB10CF10E99006D7364FB987C4B564232D55C43B64EF3CE4A5E780

Function 00007FF8A739CC70 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A739CC9B

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 11129b6cd13a03716b85a16f881323c1c4ce7ac5c6c3e85454c71bdfcf166b72
Instruction ID: d186dd6ffc989737d17ec58d7279738043299fb34fce65159126c883c2fc47d7
Opcode Fuzzy Hash: 11129b6cd13a03716b85a16f881323c1c4ce7ac5c6c3e85454c71bdfcf166b72
Instruction Fuzzy Hash: 7611303790EE42A2F3109F28A45057DB654EF447C0FDA0535EA9D57796DE3CE811AB40

Function 00007FF8A735C230 Relevance: 1.5, APIs: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE ref: 00007FF8A735C292

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b6326df03547ea6f84f29f9ee147747a304e1d365c9d8797de04ee65a0ac18c9
Instruction ID: 8f8d52afec40f46d0eeadfd85e36a0686173138d1b6a7b5bb6e5a7a16d19a297
Opcode Fuzzy Hash: b6326df03547ea6f84f29f9ee147747a304e1d365c9d8797de04ee65a0ac18c9
Instruction Fuzzy Hash: AE01CE7B604F8896CB50CF5AE48469D77A0F38CBD4B25812AEF9C93724CB3AC451CB00

Function 00007FF8A735C2C0 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF8A735C311

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: cfebc1515fc543b2b083fe2095759787ddce3388642ce27f36cb7901a027486b
Instruction ID: 7c15578d300e577eb2588c54f86070f396cfde503b42f02a8c29891fe5e503b2
Opcode Fuzzy Hash: cfebc1515fc543b2b083fe2095759787ddce3388642ce27f36cb7901a027486b
Instruction Fuzzy Hash: EEF0B2BB610A84D6CB50CF6AE484A9D7760F359FD8B258126DF5C43724CB3AC455CB00

Function 00007FF8A737E74C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A737E760

Part of subcall function 00007FF8A73809A4: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF8A73809AC
Part of subcall function 00007FF8A73809A4: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF8A73809B1

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 56d1967f7ca8823f61a18b3e171290dc37495714e2cfe51231c3721dfa77e6b7
Instruction ID: 76bf24504d40ac3025be7583ec07c254b6606aa59fa697c5846515270ff87df5
Opcode Fuzzy Hash: 56d1967f7ca8823f61a18b3e171290dc37495714e2cfe51231c3721dfa77e6b7
Instruction Fuzzy Hash: F8E0B614D4FA83B0FE68AEA612423BD03409F213CDFD30478D85D5A193DE1E34163621

Function 00007FF8A735BD80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00007FF8A735BDA4

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 00ca3bb6c16bf401e8107cfd5d380dc7284680fb22f24669aa6de33ca1ad307b
Instruction ID: acba1fe49ee8351d4f0489dbb5485bd46bb8baaf7d3ea97e89b45ff6e6ab8d73
Opcode Fuzzy Hash: 00ca3bb6c16bf401e8107cfd5d380dc7284680fb22f24669aa6de33ca1ad307b
Instruction Fuzzy Hash: BEE0E2F3701A80C6DB14CF69C48536877A1EB58B8AF19D019CB1C4B394EA3AC489CB10

Function 00007FF8A735BF80 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF8A735C025

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 58984d69895f230553de08d39cbae206efa4d1f7ff968e70513416a8fd665297
Instruction ID: 3d8f7e631a3ccd99bc0deaa089928b8581e76186698eec05205fca20e431eef2
Opcode Fuzzy Hash: 58984d69895f230553de08d39cbae206efa4d1f7ff968e70513416a8fd665297
Instruction Fuzzy Hash: 1411F0B7700A88C6CB10CF6AD888AA837A4F75CB89F268016DF1C83750DB36C495CB00

Function 00007FF8A73928D4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF8A7392929

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 8b44c2c59a098c83a39972b1511d7c1a6e0c4ef89543c806f55c0a396f555c77
Instruction ID: 4fc70a4d9d9cba1360a30af9603d0fe45d1533ffa1abb797772b6f054b864a8b
Opcode Fuzzy Hash: 8b44c2c59a098c83a39972b1511d7c1a6e0c4ef89543c806f55c0a396f555c77
Instruction Fuzzy Hash: B8F09054B0BF0761FE685F6699213BD5280EF89BC0FCE8430C90E863D1ED2CE5A1A218

Non-executed Functions

Function 00007FF8A7308870 Relevance: 161.4, APIs: 86, Strings: 6, Instructions: 394windowthreadtimeCOMMON

Download Yara Rule

APIs

DdeUnaccessData.USER32 ref: 00007FF8A73088C2
DrawIcon.USER32 ref: 00007FF8A73088D2
GetFileSize.KERNEL32 ref: 00007FF8A73088DC
SetThreadContext.KERNEL32 ref: 00007FF8A73088E6
CreateDirectoryTransactedW.KERNEL32 ref: 00007FF8A73088F6
GetFileTime.KERNEL32 ref: 00007FF8A7308906
LoadPackagedLibrary.KERNEL32 ref: 00007FF8A7308915
SetFileValidData.KERNEL32 ref: 00007FF8A730891F
PurgeComm.KERNEL32 ref: 00007FF8A7308929
GetMenuDefaultItem.USER32 ref: 00007FF8A7308936
SendMessageTimeoutW.USER32 ref: 00007FF8A7308955
FileTimeToDosDateTime.KERNEL32 ref: 00007FF8A7308962
GetCapture.USER32 ref: 00007FF8A7308968
GetProfileIntW.KERNEL32 ref: 00007FF8A7308975
IsHungAppWindow.USER32 ref: 00007FF8A730897D
RegisterDeviceNotificationW.USER32 ref: 00007FF8A730898A
LoadBitmapW.USER32 ref: 00007FF8A7308994
CancelIo.KERNEL32 ref: 00007FF8A730899C
ReleaseSemaphore.KERNEL32 ref: 00007FF8A73089A9
UpdateLayeredWindowIndirect.USER32 ref: 00007FF8A73089B3
GetConsoleMode.KERNEL32 ref: 00007FF8A73089BD
FormatMessageW.KERNEL32 ref: 00007FF8A73089DC
CascadeWindows.USER32 ref: 00007FF8A73089F1
DispatchMessageW.USER32 ref: 00007FF8A73089F9
FreeConsole.KERNEL32 ref: 00007FF8A73089FF
SetLayeredWindowAttributes.USER32 ref: 00007FF8A7308A0F
SendMessageCallbackW.USER32 ref: 00007FF8A7308A29
InitOnceBeginInitialize.KERNEL32 ref: 00007FF8A7308A39
SleepConditionVariableCS.KERNEL32 ref: 00007FF8A7308A46
GetNumaNodeProcessorMask.KERNEL32 ref: 00007FF8A7308A50
OemToCharW.USER32 ref: 00007FF8A7308A5F
RegisterDeviceNotificationW.USER32 ref: 00007FF8A7308A6C
LocalLock.KERNEL32 ref: 00007FF8A7308A74
GetSystemWindowsDirectoryW.KERNEL32 ref: 00007FF8A7308A7E
GetDllDirectoryW.KERNEL32 ref: 00007FF8A7308A88
EnumResourceNamesW.KERNEL32 ref: 00007FF8A7308ABA
CreatePrivateNamespaceW.KERNEL32 ref: 00007FF8A7308AC7
PeekNamedPipe.KERNEL32 ref: 00007FF8A7308AE1
LocalHandle.KERNEL32 ref: 00007FF8A7308AE9
GetCurrentThread.KERNEL32 ref: 00007FF8A7308AEF
ReleaseSemaphore.KERNEL32 ref: 00007FF8A7308AFC
EnumSystemCodePagesW.KERNEL32 ref: 00007FF8A7308B06
UpdateResourceW.KERNEL32 ref: 00007FF8A7308B20
IsValidNLSVersion.KERNEL32 ref: 00007FF8A7308B32
SetProtectedPolicy.KERNEL32 ref: 00007FF8A7308B3F
CreateSemaphoreExW.KERNEL32 ref: 00007FF8A7308B59
CreateThreadpoolWait.KERNEL32 ref: 00007FF8A7308B66
GetNumberOfConsoleMouseButtons.KERNEL32 ref: 00007FF8A7308B6E
Wow64GetThreadSelectorEntry.KERNEL32 ref: 00007FF8A7308B7B
SetErrorMode.KERNEL32 ref: 00007FF8A7308B83
PostQueuedCompletionStatus.KERNEL32 ref: 00007FF8A7308B93
WritePrivateProfileStructW.KERNEL32 ref: 00007FF8A7308BA8
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8A7308BB2
OpenPrivateNamespaceW.KERNEL32 ref: 00007FF8A7308BBC
FindVolumeClose.KERNEL32 ref: 00007FF8A7308BC4
LocalSize.KERNEL32 ref: 00007FF8A7308BCC
TryAcquireSRWLockShared.KERNEL32 ref: 00007FF8A7308BD4
SetupComm.KERNEL32 ref: 00007FF8A7308BE1
CreateSymbolicLinkW.KERNEL32 ref: 00007FF8A7308BEE
VirtualAllocEx.KERNEL32 ref: 00007FF8A7308C03
GlobalMemoryStatus.KERNEL32 ref: 00007FF8A7308C0B
IsValidNLSVersion.KERNEL32 ref: 00007FF8A7308C1D
CreateThreadpool.KERNEL32 ref: 00007FF8A7308C95
SetFileCompletionNotificationModes.KERNEL32 ref: 00007FF8A7308C9F
CompareStringW.KERNEL32 ref: 00007FF8A7308CB9
GetThreadIOPendingFlag.KERNEL32 ref: 00007FF8A7308CC3
GetLocaleInfoW.KERNEL32 ref: 00007FF8A7308CD3
MoveFileW.KERNEL32 ref: 00007FF8A7308CDD
HeapSize.KERNEL32 ref: 00007FF8A7308CEA
GetCurrentConsoleFont.KERNEL32 ref: 00007FF8A7308CF7
LeaveCriticalSectionWhenCallbackReturns.KERNEL32 ref: 00007FF8A7308D01
DiscardVirtualMemory.KERNEL32 ref: 00007FF8A7308D0B
SetHandleInformation.KERNEL32 ref: 00007FF8A7308D18
AreFileApisANSI.KERNEL32 ref: 00007FF8A7308D1E
EndUpdateResourceW.KERNEL32 ref: 00007FF8A7308D28
ReadConsoleOutputW.KERNEL32 ref: 00007FF8A7308D3D
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A7308D4A
ConvertDefaultLocale.KERNEL32 ref: 00007FF8A7308D52
FillConsoleOutputCharacterW.KERNEL32 ref: 00007FF8A7308D67
lstrcmpW.KERNEL32 ref: 00007FF8A7308D71
CreateThreadpoolWait.KERNEL32 ref: 00007FF8A7308D7E
SetPriorityClass.KERNEL32 ref: 00007FF8A7308D88
EnumTimeFormatsEx.KERNEL32 ref: 00007FF8A7308D9D
EnumSystemCodePagesW.KERNEL32 ref: 00007FF8A7308DA7
ReclaimVirtualMemory.KERNEL32 ref: 00007FF8A7308DB1
GetDurationFormat.KERNEL32 ref: 00007FF8A7308DD0

Strings

wja8YkiAh7vOembY, xrefs: 00007FF8A7308A58
l5ohhZon4ZUTubG3, xrefs: 00007FF8A7308C14
jvCjmFqRWLOosZJGtechX, xrefs: 00007FF8A7308C5E
7m5zURdP61Kp6Z92J6y4161, xrefs: 00007FF8A730890E
HUG5w69RilajCGv7l, xrefs: 00007FF8A7308D91
9PNbABZO7sRVRgv9buhPTSoew1DrJ, xrefs: 00007FF8A7308B29

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: CreateFile$Console$DirectoryEnumMessageThreadTime$LocalMemoryNotificationPrivateResourceSemaphoreSizeSystemThreadpoolUpdateValidVersionVirtualWindowWindows$CallbackCodeCommCompletionCurrentDataDefaultDeviceFormatHandleInfoLayeredLoadLocaleLockModeNamespaceOutputPagesProfileRegisterReleaseSendStatusWait$AcquireAllocApisAttributesBeginBitmapButtonsCancelCaptureCascadeCharCharacterClassCloseCompareConditionContextConvertCriticalDateDiscardDispatchDrawDurationEntryErrorFillFindFlagFontFormatsFreeGlobalHeapHungIconIndirectInformationInitInitializeItemLeaveLibraryLinkMaskMenuModesMouseMoveNamedNamesNodeNumaNumberOnceOpenPackagedPeekPendingPipePolicyPostPriorityProcessorProtectedPurgeQueuedReadReclaimReturnsSectionSelectorSetupSharedSleepStringStructSymbolicTimeoutTransactedUnaccessVariableVerifyVolumeWhenWow64Writelstrcmp
String ID: 7m5zURdP61Kp6Z92J6y4161$9PNbABZO7sRVRgv9buhPTSoew1DrJ$HUG5w69RilajCGv7l$jvCjmFqRWLOosZJGtechX$l5ohhZon4ZUTubG3$wja8YkiAh7vOembY
API String ID: 2804625631-2107615613
Opcode ID: 9b9beda332e506df80a5eb0ccead25f0c25ec6770a4455efe169b0187cc9e651
Instruction ID: 493bc25205dfc370e976349b01a3e27cd6aa277ccd4b81566f739c85b8d8c3a6
Opcode Fuzzy Hash: 9b9beda332e506df80a5eb0ccead25f0c25ec6770a4455efe169b0187cc9e651
Instruction Fuzzy Hash: 35F19232B1A65193F72CDF36B826A2F3262FF8C785F859439DA1F49854CE3DD0099A44

Function 00007FF6D3AF3FE0 Relevance: 106.5, APIs: 21, Strings: 39, Instructions: 1459COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF410D

Strings

TLS Error: reading acknowledgement record from packet, xrefs: 00007FF6D3AF4E41
TLS ERROR: received control packet with stale session-id=%s, xrefs: 00007FF6D3AF447B
TLS: received P_CONTROL_SOFT_RESET_V1 s=%d sid=%s, xrefs: 00007FF6D3AF4A07
Peer tried unsupported key-method 1, xrefs: 00007FF6D3AF55BA
!reliable_pid_min(pid, rel->packet_id), xrefs: 00007FF6D3AF5806
[%u], xrefs: 00007FF6D3AF4F71, 00007FF6D3AF51FC
TLS: received control channel packet s#=%d sid=%s, xrefs: 00007FF6D3AF4A9F
ACK reliable_schedule_now, xrefs: 00007FF6D3AF4B4F
TLS: control channel, op=%s, IP=%s, xrefs: 00007FF6D3AF4198
TLS Error: unknown opcode received from %s op=%d, xrefs: 00007FF6D3AF5694
false, xrefs: 00007FF6D3AF3ADD, 00007FF6D3AF3F80, 00007FF6D3AF3FE5
ACK read ID %u (buf->len=%d), xrefs: 00007FF6D3AF5042
TLS ERROR: local/remote key IDs out of sync (%d/%d) ID: %s, xrefs: 00007FF6D3AF4BDC
ks->state != S_UNDEF, xrefs: 00007FF6D3AF5770
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AF3F73, 00007FF6D3AF3FBE, 00007FF6D3AF577C, 00007FF6D3AF5795, 00007FF6D3AF57AE, 00007FF6D3AF57E0
ACK acknowledge ID %u (ack->len=%d), xrefs: 00007FF6D3AF52ED
ACK %u is a replay: %s, xrefs: 00007FF6D3AF5273
TLS Error: Received control packet from unexpected IP addr: %s, xrefs: 00007FF6D3AF497B
ACK read ID FAILED (buf->len=%d), xrefs: 00007FF6D3AF5386
Incoming control channel packet too big, dropping., xrefs: 00007FF6D3AF50F6
TLS Error: session-id not found in packet from %s, xrefs: 00007FF6D3AF54A5
ACK received for pid %u, deleting from send buffer, xrefs: 00007FF6D3AF4EA7
ACK no free receive buffer available: %s, xrefs: 00007FF6D3AF53AE
ACK mark active incoming ID %u, xrefs: 00007FF6D3AF518F
ACK read BAD SESSION-ID FROM REMOTE, local=%s, remote=%s, xrefs: 00007FF6D3AF4DBB
TLS Error: Existing session control channel packet from unknown IP address: %s, xrefs: 00007FF6D3AF4D17
TLS: initial packet test, i=%d state=%s, mysid=%s, rec-sid=%s, rec-ip=%s, stored-sid=%s, stored-ip=%s, xrefs: 00007FF6D3AF43E7
[NULL], xrefs: 00007FF6D3AF38AF, 00007FF6D3AF3B0B, 00007FF6D3AF3DAD, 00007FF6D3AF3EF2, 00007FF6D3AF40D2, 00007FF6D3AF5577, 00007FF6D3AF568A
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c, xrefs: 00007FF6D3AF57F9, 00007FF6D3AF5812
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3AF3FA5, 00007FF6D3AF57C7
TLS Error: client->client or server->server connection attempted from %s, xrefs: 00007FF6D3AF5581
TLS Error: Unroutable control packet received from %s (si=%d op=%s), xrefs: 00007FF6D3AF4844
%u, xrefs: 00007FF6D3AF4FAB, 00007FF6D3AF5239
ACK acknowledge ID %u FAILED (ack->len=%d), xrefs: 00007FF6D3AF5337
ks->state != S_ERROR, xrefs: 00007FF6D3AF5789
TLS: Initial packet from %s, sid=%s, xrefs: 00007FF6D3AF470B
TLS Error: Cannot accept new session request from %s due to session context expire or --single-session, xrefs: 00007FF6D3AF45C6
session_id_defined(&session->session_id), xrefs: 00007FF6D3AF57A2
TLS: found match, session[%d], sid=%s, xrefs: 00007FF6D3AF44B4

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc
String ID: %u$!reliable_pid_min(pid, rel->packet_id)$ACK %u is a replay: %s$ACK acknowledge ID %u (ack->len=%d)$ACK acknowledge ID %u FAILED (ack->len=%d)$ACK mark active incoming ID %u$ACK no free receive buffer available: %s$ACK read BAD SESSION-ID FROM REMOTE, local=%s, remote=%s$ACK read ID %u (buf->len=%d)$ACK read ID FAILED (buf->len=%d)$ACK received for pid %u, deleting from send buffer$ACK reliable_schedule_now$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$Incoming control channel packet too big, dropping.$Peer tried unsupported key-method 1$TLS ERROR: local/remote key IDs out of sync (%d/%d) ID: %s$TLS ERROR: received control packet with stale session-id=%s$TLS Error: Cannot accept new session request from %s due to session context expire or --single-session$TLS Error: Existing session control channel packet from unknown IP address: %s$TLS Error: Received control packet from unexpected IP addr: %s$TLS Error: Unroutable control packet received from %s (si=%d op=%s)$TLS Error: client->client or server->server connection attempted from %s$TLS Error: reading acknowledgement record from packet$TLS Error: session-id not found in packet from %s$TLS Error: unknown opcode received from %s op=%d$TLS: Initial packet from %s, sid=%s$TLS: control channel, op=%s, IP=%s$TLS: found match, session[%d], sid=%s$TLS: initial packet test, i=%d state=%s, mysid=%s, rec-sid=%s, rec-ip=%s, stored-sid=%s, stored-ip=%s$TLS: received P_CONTROL_SOFT_RESET_V1 s=%d sid=%s$TLS: received control channel packet s#=%d sid=%s$[%u]$[NULL]$false$ks->state != S_ERROR$ks->state != S_UNDEF$session_id_defined(&session->session_id)
API String ID: 2803490479-1960415790
Opcode ID: 143a6c24d1539054254afb77238d2795caab912242bde4b7c43f88048d5f79b7
Instruction ID: b17b745582be251ea7ecb5ecbe573f65c8090308967f373886196d3b6abe122a
Opcode Fuzzy Hash: 143a6c24d1539054254afb77238d2795caab912242bde4b7c43f88048d5f79b7
Instruction Fuzzy Hash: E1E29C32F09B5285FA189B64D4422BDA7A1FF55B88F484137EA8DB7696DF3CE460C340

Function 00007FF6D3AA27C0 Relevance: 98.9, APIs: 26, Strings: 30, Instructions: 923stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF6D3AA2902
memset.VCRUNTIME140(?,?,00000000), ref: 00007FF6D3AA299D
memset.VCRUNTIME140(?,?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2B6D
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2BC6
strchr.VCRUNTIME140(?,?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2C12
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2C33
strchr.VCRUNTIME140(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2C68
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2CBA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2CC3
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2DBE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2E01
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2E4E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,FFFFFFFF,?,?,?,00007FF6D3AEA772,?), ref: 00007FF6D3AA2F2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA3036
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA3064
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00007FF6D3AA30C6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA310A
memset.VCRUNTIME140 ref: 00007FF6D3AA314D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA3364
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA33BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA3514
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA3537
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AA3566

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\misc.c, xrefs: 00007FF6D3AA3AB2
prompt_len > 0 && prompt != NULL && resp_len > 0 && resp != NULL, xrefs: 00007FF6D3AA3598
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c, xrefs: 00007FF6D3AA35C3
Error reading password from %s authfile: %s, xrefs: 00007FF6D3AA2C93
ERROR: could not read %s ok-confirmation from stdin, xrefs: 00007FF6D3AA2A2C
ERROR: could not read challenge response from stdin, xrefs: 00007FF6D3AA2F13
Error opening '%s' auth file: %s, xrefs: 00007FF6D3AA2B9B
CRV1::%s::%s, xrefs: 00007FF6D3AA2F42
NEED-OK|%s|%s:, xrefs: 00007FF6D3AA291E
ERROR: Failed retrieving username or password, xrefs: 00007FF6D3AA32F8
@, xrefs: 00007FF6D3AA3A41
i < QUERY_USER_NUMSLOTS, xrefs: 00007FF6D3AA357F
Enter %s Password:, xrefs: 00007FF6D3AA316C
str, xrefs: 00007FF6D3AA35B7, 00007FF6D3AA3AD6
ERROR: received malformed challenge request from server, xrefs: 00007FF6D3AA30A9
ERROR: could not retrieve static challenge response, xrefs: 00007FF6D3AA345F
stdin, xrefs: 00007FF6D3AA2839
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\console.c, xrefs: 00007FF6D3AA358B, 00007FF6D3AA35A4
ERROR: %s username is empty, xrefs: 00007FF6D3AA3333
n >= 0 && n + base + 1 <= max_parms, xrefs: 00007FF6D3AA3AA6
SESS_ID_, xrefs: 00007FF6D3AA3E30
SCRV1:%s:%s, xrefs: 00007FF6D3AA34DE
make_arg_array, xrefs: 00007FF6D3AA3A2C
CHALLENGE: %s, xrefs: 00007FF6D3AA2E77, 00007FF6D3AA33E3
ERROR: could not base64-encode password/static_response, xrefs: 00007FF6D3AA3550
Error reading username from %s authfile: %s, xrefs: 00007FF6D3AA2BE1
No password found in %s authfile '%s'. Querying the management interface, xrefs: 00007FF6D3AA2D22
Enter %s Username:, xrefs: 00007FF6D3AA3157
ERROR: username from %s authfile '%s' is empty, xrefs: 00007FF6D3AA2DA0
Note: previous '%s' credentials failed, xrefs: 00007FF6D3AA287B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$free$memset$_exitfgetsstrchrstrncpy$fclose
String ID: @$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\console.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\misc.c$CHALLENGE: %s$CRV1::%s::%s$ERROR: %s username is empty$ERROR: Failed retrieving username or password$ERROR: could not base64-encode password/static_response$ERROR: could not read %s ok-confirmation from stdin$ERROR: could not read challenge response from stdin$ERROR: could not retrieve static challenge response$ERROR: received malformed challenge request from server$ERROR: username from %s authfile '%s' is empty$Enter %s Password:$Enter %s Username:$Error opening '%s' auth file: %s$Error reading password from %s authfile: %s$Error reading username from %s authfile: %s$NEED-OK|%s|%s:$No password found in %s authfile '%s'. Querying the management interface$Note: previous '%s' credentials failed$SCRV1:%s:%s$SESS_ID_$i < QUERY_USER_NUMSLOTS$make_arg_array$n >= 0 && n + base + 1 <= max_parms$prompt_len > 0 && prompt != NULL && resp_len > 0 && resp != NULL$stdin$str
API String ID: 3045993279-932351873
Opcode ID: 924279bbff4b0c103b54e11c29a485d7b05ca7d0d4e1b68444afb3e365500376
Instruction ID: 32382b99b522a00b9525ed090ce91530553af9100d0cde18f098ed1e689ce342
Opcode Fuzzy Hash: 924279bbff4b0c103b54e11c29a485d7b05ca7d0d4e1b68444afb3e365500376
Instruction Fuzzy Hash: C382CE22B0978286FA5A8B1495127BDE7A1FF55BC4F4C4037DA8DA7789EF3CE4658300

Function 00007FF8A7308260 Relevance: 89.6, APIs: 49, Strings: 2, Instructions: 368windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF8A73082B3
InvalidateRect.USER32 ref: 00007FF8A73082E0
BeginPaint.USER32 ref: 00007FF8A730846A
CreatePen.GDI32 ref: 00007FF8A730847D
SelectObject.GDI32 ref: 00007FF8A730848C
MoveToEx.GDI32 ref: 00007FF8A73084AE
LineTo.GDI32 ref: 00007FF8A73084BF
MoveToEx.GDI32 ref: 00007FF8A73084D3
LineTo.GDI32 ref: 00007FF8A73084E4
SelectObject.GDI32 ref: 00007FF8A73084FB
DeleteObject.GDI32 ref: 00007FF8A7308504
CreatePen.GDI32 ref: 00007FF8A730853E
SelectObject.GDI32 ref: 00007FF8A730854D
MoveToEx.GDI32 ref: 00007FF8A7308564
LineTo.GDI32 ref: 00007FF8A7308575
MoveToEx.GDI32 ref: 00007FF8A7308589
LineTo.GDI32 ref: 00007FF8A730859A
SelectObject.GDI32 ref: 00007FF8A73085F0
DeleteObject.GDI32 ref: 00007FF8A73085F9
CreatePen.GDI32 ref: 00007FF8A7308620
PostQuitMessage.USER32 ref: 00007FF8A730885B

Strings

EOPXFHPrKRnOuwgaMCJUMac, xrefs: 00007FF8A73082A5
YigrsPcxhaDzhXiBRp, xrefs: 00007FF8A73082AC

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Object$LineMoveSelect$Create$DeleteMessage$BeginInvalidatePaintPostQuitRect
String ID: EOPXFHPrKRnOuwgaMCJUMac$YigrsPcxhaDzhXiBRp
API String ID: 3706565309-2378693359
Opcode ID: 08feb813616fda1ff5314d92750411c3596d9e57b33d99c682a69fbf98f35c25
Instruction ID: d2f6033c485dad594d3d6cf003643733b308f1d58792a73299c502467abc8cdf
Opcode Fuzzy Hash: 08feb813616fda1ff5314d92750411c3596d9e57b33d99c682a69fbf98f35c25
Instruction Fuzzy Hash: 50E1C460B0BA92A6FB248F25B81877D3761EF89BC0F854035CE4E4BB55CE3D904AE744

Function 00007FF6D3A948C0 Relevance: 81.5, APIs: 20, Strings: 26, Instructions: 954COMMON

Download Yara Rule

APIs

pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3A9494C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A94991
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A94A4A
EVP_MD_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A94B1E
EVP_MD_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A94B2A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A94B8F

Part of subcall function 00007FF6D3A7CD30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CE83
Part of subcall function 00007FF6D3A7CD30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CEB4

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A94CA2

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

Part of subcall function 00007FF6D3A83310: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83319
Part of subcall function 00007FF6D3A83310: fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83329
Part of subcall function 00007FF6D3A83310: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A83333

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A94D02
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A94E54
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A94E65
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A94E73
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3A94E81
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A94E98
memset.VCRUNTIME140 ref: 00007FF6D3A94EAB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 00007FF6D3A954B3
memset.VCRUNTIME140 ref: 00007FF6D3A9550F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 00007FF6D3A955F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 00007FF6D3A9571F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9598F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A959B0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A95A28
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A95A45

Strings

!options->test_crypto, xrefs: 00007FF6D3A95768
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A957A6
options->tls_server || options->tls_client, xrefs: 00007FF6D3A9574F
auth-gen-token, xrefs: 00007FF6D3A94B44
ERROR: not enough data in auth-token secret, xrefs: 00007FF6D3A94CEC
gfff, xrefs: 00007FF6D3A94FB0
SHA256, xrefs: 00007FF6D3A94AFB
ciphername, xrefs: 00007FF6D3A9579A
OpenVPN auth-token server key, xrefs: 00007FF6D3A94BCF
options->tls_server == !options->tls_client, xrefs: 00007FF6D3A95781
TLS-Auth MTU parms, xrefs: 00007FF6D3A95923
auth-token secret, xrefs: 00007FF6D3A94C8A
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c, xrefs: 00007FF6D3A94D60, 00007FF6D3A9575B, 00007FF6D3A95774, 00007FF6D3A9578D
ERROR: Cannot load auth-token secret, xrefs: 00007FF6D3A94BFB
private-key-password-failure, xrefs: 00007FF6D3A94A09
none, xrefs: 00007FF6D3A94A74
ERROR: --%s requires %s support., xrefs: 00007FF6D3A94B4B
proto >= 0 && proto < PROTO_N, xrefs: 00007FF6D3A95736
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c, xrefs: 00007FF6D3A94D47
Error: private key password verification failed, xrefs: 00007FF6D3A94A34
Re-using SSL/TLS context, xrefs: 00007FF6D3A94D20
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3A95742
TAS, xrefs: 00007FF6D3A95688
BF-CBC, xrefs: 00007FF6D3A94A58
NULL != ctx, xrefs: 00007FF6D3A94D3B
Control Channel MTU parms, xrefs: 00007FF6D3A9588B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$free$_exit$R_get_modememset$Any_exD_fetchD_freeR_fetchR_freeR_get_flags__acrt_iob_funccallocexitfprintfpkcs11h_certificate_sign
String ID: !options->test_crypto$BF-CBC$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c$Control Channel MTU parms$ERROR: --%s requires %s support.$ERROR: Cannot load auth-token secret$ERROR: not enough data in auth-token secret$Error: private key password verification failed$NULL != ctx$OpenVPN auth-token server key$Re-using SSL/TLS context$SHA256$TAS$TLS-Auth MTU parms$auth-gen-token$auth-token secret$ciphername$gfff$none$options->tls_server == !options->tls_client$options->tls_server || options->tls_client$private-key-password-failure$proto >= 0 && proto < PROTO_N
API String ID: 2521965006-2305849387
Opcode ID: eb105fa63fe9332fcd7743fcd4e5a59a4a1cb2e5116f93920d676fe26b93b187
Instruction ID: faa89b10137a94e7ebe10a461e14c064aca5431f9d3976feea31b30e44744a09
Opcode Fuzzy Hash: eb105fa63fe9332fcd7743fcd4e5a59a4a1cb2e5116f93920d676fe26b93b187
Instruction Fuzzy Hash: 73B2A222A09BC286E755CF28D5023FC73A0FB55B48F589236DF8CA7656DF39A1A4C710

Function 00007FF6D3A9A3F0 Relevance: 75.9, APIs: 15, Strings: 28, Instructions: 646stringCOMMON

Download Yara Rule

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6D3A9A55B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9A5C0
htonl.WS2_32 ref: 00007FF6D3A9A602
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9A67B
htonl.WS2_32 ref: 00007FF6D3A9A6BD
inet_ntoa.WS2_32 ref: 00007FF6D3A9A6C5
inet_ntoa.WS2_32 ref: 00007FF6D3A9A60A

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9A716
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9AA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9AA74
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6D3A9AA9F
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A9AB56

Strings

SUCCESS: '%s' %s entered, but not yet verified, xrefs: 00007FF6D3A9ABEB
@, xrefs: 00007FF6D3A9A5B3
@, xrefs: 00007FF6D3A9A66E
all, xrefs: 00007FF6D3A9A945
PKCS#11: Cannot get certificate list %ld-'%s', xrefs: 00007FF6D3A9AD4D
ERROR: %s parameter must be 'on' or 'off' or some number n or 'all', xrefs: 00007FF6D3A9AAC1
0 <= x && x < mod && -mod <= y && y <= mod, xrefs: 00007FF6D3A9AAD4
ERROR: no %s is currently needed at this time, xrefs: 00007FF6D3A9AC59
SUCCESS: real-time %s notification set to OFF, xrefs: 00007FF6D3A9A92C
SUCCESS: real-time %s notification set to ON, xrefs: 00007FF6D3A9A8E0
PKCS#11: pkcs11_management_id_count - return count=%d, xrefs: 00007FF6D3A9ADAD
>PKCS11ID-COUNT:%d, xrefs: 00007FF6D3A9ADC1
man->connection.up_query_type, xrefs: 00007FF6D3A9AC75
kill, xrefs: 00007FF6D3A9A846
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3A9AC81, 00007FF6D3A9AC9A
ERROR: kill parse, xrefs: 00007FF6D3A9A81E
ERROR: The '%s' command is not supported by the current daemon mode, xrefs: 00007FF6D3A9A852
off, xrefs: 00007FF6D3A9A8F9
ERROR: port number is out of range: %s, xrefs: 00007FF6D3A9A76A
SUCCESS: common name '%s' found, %d client(s) killed, xrefs: 00007FF6D3A9A7CE
ERROR: common name '%s' not found, xrefs: 00007FF6D3A9A7FB
SUCCESS: %d client(s) at address %s:%d killed, xrefs: 00007FF6D3A9A646
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h, xrefs: 00007FF6D3A9AAE0
ERROR: %s of type '%s' entered, but we need one of type '%s', xrefs: 00007FF6D3A9AC1E
PKCS#11: pkcs11_management_id_count - entered, xrefs: 00007FF6D3A9AD01
ERROR: client at address %s:%d not found, xrefs: 00007FF6D3A9A6FA
END, xrefs: 00007FF6D3A9AA21
ERROR: error parsing IP address: %s, xrefs: 00007FF6D3A9A790

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$atoihtonlinet_ntoamalloc$__stdio_common_vsprintfstrncpy
String ID: 0 <= x && x < mod && -mod <= y && y <= mod$>PKCS11ID-COUNT:%d$@$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$END$ERROR: %s of type '%s' entered, but we need one of type '%s'$ERROR: %s parameter must be 'on' or 'off' or some number n or 'all'$ERROR: The '%s' command is not supported by the current daemon mode$ERROR: client at address %s:%d not found$ERROR: common name '%s' not found$ERROR: error parsing IP address: %s$ERROR: kill parse$ERROR: no %s is currently needed at this time$ERROR: port number is out of range: %s$PKCS#11: Cannot get certificate list %ld-'%s'$PKCS#11: pkcs11_management_id_count - entered$PKCS#11: pkcs11_management_id_count - return count=%d$SUCCESS: %d client(s) at address %s:%d killed$SUCCESS: '%s' %s entered, but not yet verified$SUCCESS: common name '%s' found, %d client(s) killed$SUCCESS: real-time %s notification set to OFF$SUCCESS: real-time %s notification set to ON$all$kill$man->connection.up_query_type$off
API String ID: 3011225574-532987796
Opcode ID: 7f52540132923405dfa0e60b7fcfacf501be6ba923415182122fe1ffa25bf520
Instruction ID: 257c92a8c909320ce8eb4149c1af9548854cc20e3271a1d511c311b420f5e607
Opcode Fuzzy Hash: 7f52540132923405dfa0e60b7fcfacf501be6ba923415182122fe1ffa25bf520
Instruction Fuzzy Hash: 2042F525B1D79282FB989F14E4022BCE7A1FF56B84F884037DA8DB7791DE2DE4258710

Function 00007FF6D3A92BC0 Relevance: 72.3, APIs: 9, Strings: 32, Instructions: 581COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D3A92BFE
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A92C4D
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A92C5E
EVP_CIPHER_get_nid.LIBCRYPTO-3-X64 ref: 00007FF6D3A92C6E
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A92C7E
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A92C89

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

memcmp.VCRUNTIME140 ref: 00007FF6D3A9319D
memcmp.VCRUNTIME140 ref: 00007FF6D3A931B6

Part of subcall function 00007FF6D3A916B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,FFFFFFFF,?,00000000,00000000,56D81A5E,00007FF6D3A93125), ref: 00007FF6D3A9176B
Part of subcall function 00007FF6D3A916B0: htonl.WS2_32 ref: 00007FF6D3A917A3
Part of subcall function 00007FF6D3A916B0: inet_ntoa.WS2_32 ref: 00007FF6D3A917AB
Part of subcall function 00007FF6D3A916B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,FFFFFFFF,?,00000000,00000000,56D81A5E,00007FF6D3A93125), ref: 00007FF6D3A91803
Part of subcall function 00007FF6D3A916B0: htonl.WS2_32 ref: 00007FF6D3A9183D
Part of subcall function 00007FF6D3A916B0: inet_ntoa.WS2_32 ref: 00007FF6D3A91845

Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71017
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A71037
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71040
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A710C2
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A710CB

Strings

ERROR: Failed to apply DCO keepalive or MSS fix parameters, xrefs: 00007FF6D3A935E2
OPTIONS ERROR: failed to import crypto options, xrefs: 00007FF6D3A933CD
%s: peer-id %d, fd %d, xrefs: 00007FF6D3A93320
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A9306E
ERROR: Failed to apply push options, xrefs: 00007FF6D3A930EA
ping-exit %d, xrefs: 00007FF6D3A92DF9
tls-ekm, xrefs: 00007FF6D3A92FBD
session-timeout %d, xrefs: 00007FF6D3A92EA4
inactive %d, xrefs: 00007FF6D3A92E42
Need hold release from management interface, waiting..., xrefs: 00007FF6D3AA0CBF
ciphername, xrefs: 00007FF6D3A93062
NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device., xrefs: 00007FF6D3A931DA
dco_new_peer, xrefs: 00007FF6D3A93314
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco.c, xrefs: 00007FF6D3A936EB
Cannot set parameters for DCO peer (id=%u): %s, xrefs: 00007FF6D3A935B0
ping-restart %d, xrefs: 00007FF6D3A92E02
%llu, xrefs: 00007FF6D3A92E5F
man_standalone_ok(man), xrefs: 00007FF6D3AA0BF3
Data Channel: cipher '%s', auth '%s', xrefs: 00007FF6D3A92CD4
ls->info.connection_established, xrefs: 00007FF6D3A936DF
dco-win doesn't yet support reopening TUN device, xrefs: 00007FF6D3A93218
ping %d, xrefs: 00007FF6D3A92DA8
, compression: '%s', xrefs: 00007FF6D3A92D19
protocol-flags, xrefs: 00007FF6D3A92F89
cc-exit, xrefs: 00007FF6D3A92FA3
Data Channel: cipher '%s', xrefs: 00007FF6D3A92CA3
explicit-exit-notify %d, xrefs: 00007FF6D3A92F47
, peer-id: %d, xrefs: 00007FF6D3A92CF8
Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write, xrefs: 00007FF6D3AA0D45
dyn-tls-crypt, xrefs: 00007FF6D3A92FD7
Timers: , xrefs: 00007FF6D3A92D7F
Protocol options: , xrefs: 00007FF6D3A92F1E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: CountTick$R_free_time64htonlinet_ntoamallocmemcmp$R_fetchR_get_modeR_get_nid__stdio_common_vsprintfmemset
String ID: %llu$ cc-exit$ dyn-tls-crypt$ tls-ekm$%s: peer-id %d, fd %d$, compression: '%s'$, peer-id: %d$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco.c$Cannot set parameters for DCO peer (id=%u): %s$Data Channel: cipher '%s'$Data Channel: cipher '%s', auth '%s'$ERROR: Failed to apply DCO keepalive or MSS fix parameters$ERROR: Failed to apply push options$NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.$Need hold release from management interface, waiting...$OPTIONS ERROR: failed to import crypto options$Protocol options: $Timers: $Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write$ciphername$dco-win doesn't yet support reopening TUN device$dco_new_peer$explicit-exit-notify %d$inactive %d$ls->info.connection_established$man_standalone_ok(man)$ping %d$ping-exit %d$ping-restart %d$protocol-flags$session-timeout %d
API String ID: 3568111874-781789071
Opcode ID: 00918f3cb5946f9bcdf09531064260c385ca47f733b1c3cb0c57d924fab4d701
Instruction ID: 1e6c973d36334fe8c35269ad92d63b975ef552536aba0adf7acff57428346f34
Opcode Fuzzy Hash: 00918f3cb5946f9bcdf09531064260c385ca47f733b1c3cb0c57d924fab4d701
Instruction Fuzzy Hash: 6752A431B0968281EB689F10D4422BDA7A1EF55B88F8C0137DA8DB76D9DF3DE564C710

Function 00007FF6D3B0A130 Relevance: 70.8, APIs: 23, Strings: 17, Instructions: 764COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A712E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A71308

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B0A357
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0A46A
htonl.WS2_32 ref: 00007FF6D3B0A49E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0A51E
htonl.WS2_32 ref: 00007FF6D3B0A552
inet_ntoa.WS2_32 ref: 00007FF6D3B0A55A
inet_ntoa.WS2_32 ref: 00007FF6D3B0A4A6

Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15837
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15846
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15855
Part of subcall function 00007FF6D3B157E0: VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B1587A
Part of subcall function 00007FF6D3B157E0: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B158A4
Part of subcall function 00007FF6D3B157E0: memset.VCRUNTIME140 ref: 00007FF6D3B158CA
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B158E0
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B158F1
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15902
Part of subcall function 00007FF6D3B157E0: VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B15922
Part of subcall function 00007FF6D3B157E0: memset.VCRUNTIME140 ref: 00007FF6D3B1594F
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15965
Part of subcall function 00007FF6D3B157E0: VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15976

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0A6A7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0A858
htonl.WS2_32 ref: 00007FF6D3B0A88E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0A8E3
htonl.WS2_32 ref: 00007FF6D3B0A91C
inet_ntoa.WS2_32 ref: 00007FF6D3B0A924
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AB04
htonl.WS2_32 ref: 00007FF6D3B0AB3B
inet_ntoa.WS2_32 ref: 00007FF6D3B0AB43
inet_ntoa.WS2_32 ref: 00007FF6D3B0A896

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AA96
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AAC4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AB8C
htonl.WS2_32 ref: 00007FF6D3B0ABC5
inet_ntoa.WS2_32 ref: 00007FF6D3B0ABCD
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B0ACC9

Strings

%s%s interface ip set %s %lu static %s, xrefs: 00007FF6D3B0A448
wins, xrefs: 00007FF6D3B0AA72
NETSH, xrefs: 00007FF6D3B0A2DC, 00007FF6D3B0A33A, 00007FF6D3B0A620, 00007FF6D3B0AC4C, 00007FF6D3B0ACAE
win_sys_path, xrefs: 00007FF6D3B0A6DC, 00007FF6D3B0ACD6
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3B0A6E8, 00007FF6D3B0ACE2
\system32\netsh.exe, xrefs: 00007FF6D3B0A2AC, 00007FF6D3B0A5C7, 00007FF6D3B0AC15
NETSH: %lu %s %s [already set], xrefs: 00007FF6D3B0A591
validate=no, xrefs: 00007FF6D3B0A5FB
dns, xrefs: 00007FF6D3B0A182, 00007FF6D3B0A702, 00007FF6D3B0A9B1
ERROR: command failed, xrefs: 00007FF6D3B0A2F1, 00007FF6D3B0A635, 00007FF6D3B0AC61
%s: command failed, xrefs: 00007FF6D3B0A346, 00007FF6D3B0ACB5
%s%s interface ip set address %lu static %s %s, xrefs: 00007FF6D3B0AC21
@, xrefs: 00007FF6D3B0A3CF
@, xrefs: 00007FF6D3B0AB7B
NETSH: %lu %s/%s [already set], xrefs: 00007FF6D3B0A960
%s%s interface ip delete %s %lu all, xrefs: 00007FF6D3B0A2B7
%s%s interface ip add %s %lu %s, xrefs: 00007FF6D3B0A374, 00007FF6D3B0A417

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ConditionMask$malloc$htonlinet_ntoa$_exitfree$InfoVerifyVersionmemset$__stdio_common_vsprintf
String ID: %s%s interface ip add %s %lu %s$%s%s interface ip delete %s %lu all$%s%s interface ip set %s %lu static %s$%s%s interface ip set address %lu static %s %s$%s: command failed$@$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$ERROR: command failed$NETSH$NETSH: %lu %s %s [already set]$NETSH: %lu %s/%s [already set]$\system32\netsh.exe$dns$validate=no$win_sys_path$wins
API String ID: 4218250786-2387101687
Opcode ID: e1ff9ccd0bf782ba9bdad7d86b8e7d095152664a1e2f91f96dd29296ef80efd3
Instruction ID: 67be1bebf5084c89720229b57294cb54297abc4a22461db1008fa78a49866b5d
Opcode Fuzzy Hash: e1ff9ccd0bf782ba9bdad7d86b8e7d095152664a1e2f91f96dd29296ef80efd3
Instruction Fuzzy Hash: E672DF22E0AB8286FB55CF65D5022BDA3B0FF66348F044536DE8DA6695DF3CE565C300

Function 00007FF6D3A73440 Relevance: 62.0, APIs: 22, Strings: 13, Instructions: 739COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7346B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A734D3
memcpy.VCRUNTIME140 ref: 00007FF6D3A73500
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A73600
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A7363B
memcpy.VCRUNTIME140(?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A736F8
memcpy.VCRUNTIME140(?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A7373C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A73745
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FF6D3A9E26A), ref: 00007FF6D3A7375B

Part of subcall function 00007FF6D3A83310: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83319
Part of subcall function 00007FF6D3A83310: fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83329
Part of subcall function 00007FF6D3A83310: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A83333

Part of subcall function 00007FF6D3A72610: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A72640
Part of subcall function 00007FF6D3A72610: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A72690

Part of subcall function 00007FF6D3AD3F50: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3AD3F8E
Part of subcall function 00007FF6D3AD3F50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD3FA5
Part of subcall function 00007FF6D3AD3F50: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3AD3FD9
Part of subcall function 00007FF6D3AD3F50: _wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF6D3AD3FE5
Part of subcall function 00007FF6D3AD3F50: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD3FF6

Part of subcall function 00007FF6D3AD3D20: MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3D65
Part of subcall function 00007FF6D3AD3D20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3D7C
Part of subcall function 00007FF6D3AD3D20: MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DAB
Part of subcall function 00007FF6D3AD3D20: MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DC8
Part of subcall function 00007FF6D3AD3D20: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DDF
Part of subcall function 00007FF6D3AD3D20: MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E0B
Part of subcall function 00007FF6D3AD3D20: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E17
Part of subcall function 00007FF6D3AD3D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E26

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7388C
fread.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A738F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A73933
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7394A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A739A2

Strings

buf_inc_len(&ret, (int)read_size), xrefs: 00007FF6D3A739E0
@, xrefs: 00007FF6D3A73D50
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c, xrefs: 00007FF6D3A73536, 00007FF6D3A7354F, 00007FF6D3A739EC
ol->head, xrefs: 00007FF6D3A7352A
client-nat: bad netmask: %s, xrefs: 00007FF6D3A73EA4
CNAT[%d] t=%d %s/%s/%s, xrefs: 00007FF6D3A73C32
client-nat: bad foreign network: %s, xrefs: 00007FF6D3A73E76
client-nat: bad network: %s, xrefs: 00007FF6D3A73ED2
!ol->head, xrefs: 00007FF6D3A73543, 00007FF6D3A73A03, 00007FF6D3A73A04
snat, xrefs: 00007FF6D3A73CEE
WARNING: client-nat table overflow (max %d entries), xrefs: 00007FF6D3A73E19
@, xrefs: 00007FF6D3A73DC7
*** CNAT list, xrefs: 00007FF6D3A73A39

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$ByteCharMultiWide$free$memcpy$calloc$__acrt_iob_func_exit_wfopen_wstat64i32exitfclosefprintffread
String ID: CNAT[%d] t=%d %s/%s/%s$!ol->head$*** CNAT list$@$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c$WARNING: client-nat table overflow (max %d entries)$buf_inc_len(&ret, (int)read_size)$client-nat: bad foreign network: %s$client-nat: bad netmask: %s$client-nat: bad network: %s$ol->head$snat
API String ID: 2294394663-4267946636
Opcode ID: d257b4cad0f0ad5defe3afda91f942d32cc3782afc45b3c45fa968fafb194dbf
Instruction ID: f1c465be9df8406209ccf2f870177948c3ac2dca068d7beb82bd1da39419f3c0
Opcode Fuzzy Hash: d257b4cad0f0ad5defe3afda91f942d32cc3782afc45b3c45fa968fafb194dbf
Instruction Fuzzy Hash: 0452A372F09B8286E7188F20D48237DB3A0FF55B88F198536DA4DA6799DF3CE5618740

Function 00007FF6D3AF5C20 Relevance: 60.2, APIs: 18, Strings: 16, Instructions: 676COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5C6F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5C94
memcpy.VCRUNTIME140 ref: 00007FF6D3AF5E19
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5E85

Part of subcall function 00007FF6D3AE3350: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE33C5

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5EA8
htonl.WS2_32 ref: 00007FF6D3AF5FD8
htonl.WS2_32 ref: 00007FF6D3AF6012
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF6031
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF6056
htonl.WS2_32 ref: 00007FF6D3AF614F
htonl.WS2_32 ref: 00007FF6D3AF617F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF619F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF61C4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF6306
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF6329
htonl.WS2_32 ref: 00007FF6D3AF6483
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF6524
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF64FF

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

Strings

%02x, xrefs: 00007FF6D3AF5F13, 00007FF6D3AF6382, 00007FF6D3AF6583
%s, xrefs: 00007FF6D3AF642F
tls_crypt_hmac=%s, xrefs: 00007FF6D3AF6403
sid=%s, xrefs: 00007FF6D3AF5DBB
tls_hmac=%s, xrefs: 00007FF6D3AF5F96
[ #%u, xrefs: 00007FF6D3AF6083, 00007FF6D3AF61F1
P, xrefs: 00007FF6D3AF64E8
DATA %s, xrefs: 00007FF6D3AF6601
tls_auth_hmac_size <= MAX_HMAC_KEY_LENGTH, xrefs: 00007FF6D3AF666B
pid=%s, xrefs: 00007FF6D3AF60FF, 00007FF6D3AF626D
pid=%u, xrefs: 00007FF6D3AF648C
%s kid=%d, xrefs: 00007FF6D3AF5D44
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AF6677
/ time = (%u) %s, xrefs: 00007FF6D3AF60BD, 00007FF6D3AF622B
DATA UNDEF len=%d, xrefs: 00007FF6D3AF5CDE
DATA len=%d, xrefs: 00007FF6D3AF6613

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$htonl$__stdio_common_vsprintfmemcpy
String ID: %s$ / time = (%u) %s$ DATA %s$ DATA len=%d$ pid=%s$ pid=%u$ sid=%s$ tls_crypt_hmac=%s$ tls_hmac=%s$%02x$%s kid=%d$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$DATA UNDEF len=%d$P$[ #%u$tls_auth_hmac_size <= MAX_HMAC_KEY_LENGTH
API String ID: 1384873380-3281156924
Opcode ID: d06eb2533d4ac6bcd58374a834234b5388003a6d6476eaea5038797e83c87b23
Instruction ID: 5f917930cfcebca19a56ad3c38340e38599a2c78110871c5c79325646465ca94
Opcode Fuzzy Hash: d06eb2533d4ac6bcd58374a834234b5388003a6d6476eaea5038797e83c87b23
Instruction Fuzzy Hash: 3B52E562F09B4246EB698F14D54227DE761FF55788F084237EE8DE66A9EF3CE4608700

Function 00007FF6D3B157E0 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15837
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15846
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15855
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B1587A
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B158A4
memset.VCRUNTIME140 ref: 00007FF6D3B158CA
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B158E0
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B158F1
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15902
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B15922
memset.VCRUNTIME140 ref: 00007FF6D3B1594F
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15965
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15976
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15987
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B159AE
memset.VCRUNTIME140 ref: 00007FF6D3B159E1
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B159F7
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15A08
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15A19
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B15A40
memset.VCRUNTIME140 ref: 00007FF6D3B15A73
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15A89
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15A9A
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15AAB
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B15AD2
memset.VCRUNTIME140 ref: 00007FF6D3B15B05
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15B1B
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15B2C
VerSetConditionMask.KERNEL32 ref: 00007FF6D3B15B3D
VerifyVersionInfoW.KERNEL32 ref: 00007FF6D3B15B5D

Strings

Error: Windows version must be XP or greater., xrefs: 00007FF6D3B15890

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion$memset$_exit
String ID: Error: Windows version must be XP or greater.
API String ID: 2007392446-681966143
Opcode ID: c4257da68e6beeba14109d7818ada4f2101440bcbf2f1321422ff0f9df8df272
Instruction ID: 5ef29d14af1eacd8aa0ce89583ff181b708dcfd8ca60b5af88eb00bd8944454a
Opcode Fuzzy Hash: c4257da68e6beeba14109d7818ada4f2101440bcbf2f1321422ff0f9df8df272
Instruction Fuzzy Hash: 37A19431A0A60186E760CF30E4553AEF3A1FB95748F04613AE68ED7B68EF7CD5558B40

Function 00007FF6D3AF37C0 Relevance: 47.8, APIs: 14, Strings: 13, Instructions: 586COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF3815
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,?,?,00007FF6D3AF3C1B), ref: 00007FF6D3AF3967
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,?,?,00007FF6D3AF3C1B), ref: 00007FF6D3AF3994
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF3A19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF3A44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,?,?,00007FF6D3AF3C1B), ref: 00007FF6D3AF3A96
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,?,?,00007FF6D3AF3C1B), ref: 00007FF6D3AF3AC4
ERR_clear_error.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6D3AF576C), ref: 00007FF6D3AF3C1B

Part of subcall function 00007FF6D3AE8AB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE8B02
Part of subcall function 00007FF6D3AE8AB0: memset.VCRUNTIME140 ref: 00007FF6D3AE8B4C
Part of subcall function 00007FF6D3AE8AB0: getnameinfo.WS2_32 ref: 00007FF6D3AE8C50
Part of subcall function 00007FF6D3AE8AB0: FormatMessageA.KERNEL32 ref: 00007FF6D3AE8C87

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

Strings

(deferred), xrefs: 00007FF6D3AF39E0
TLS Error: local/remote TLS keys are out of sync: %s (received key id: %d, known key ids: %s), xrefs: 00007FF6D3AF3941
TLS: tls_pre_decrypt, key_id=%d, IP=%s, xrefs: 00007FF6D3AF3EFC
Key %s [%d] not initialized (yet), dropping packet., xrefs: 00007FF6D3AF3A71
false, xrefs: 00007FF6D3AF3ADD, 00007FF6D3AF3F80, 00007FF6D3AF3FE5
[NULL], xrefs: 00007FF6D3AF38AF, 00007FF6D3AF3B0B, 00007FF6D3AF3DAD, 00007FF6D3AF3EF2
ks->crypto_options.key_ctx_bi.initialized, xrefs: 00007FF6D3AF3FB2
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3AF3FA5
Key %s [%d] not authorized%s, dropping packet., xrefs: 00007FF6D3AF39F5
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_common.h, xrefs: 00007FF6D3AF3AE9, 00007FF6D3AF3F8C
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AF3F73, 00007FF6D3AF3FBE
buf_advance(buf, 1), xrefs: 00007FF6D3AF3F67
Protocol error: received P_DATA_V2 from %s but length is < 4, xrefs: 00007FF6D3AF3DB7

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$malloc$FormatMessageR_clear_error__stdio_common_vsprintfgetnameinfomemset
String ID: (deferred)$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_common.h$Key %s [%d] not authorized%s, dropping packet.$Key %s [%d] not initialized (yet), dropping packet.$Protocol error: received P_DATA_V2 from %s but length is < 4$TLS Error: local/remote TLS keys are out of sync: %s (received key id: %d, known key ids: %s)$TLS: tls_pre_decrypt, key_id=%d, IP=%s$[NULL]$buf_advance(buf, 1)$false$ks->crypto_options.key_ctx_bi.initialized
API String ID: 4060640804-123584870
Opcode ID: 32c1891dfc93897cc81d07f3c4c9767992b474515c2eee7126025d0356e5fd11
Instruction ID: e2d2a4eb664b0adb763412a9301e81eea61de2a9dc257759075d17fa178143a4
Opcode Fuzzy Hash: 32c1891dfc93897cc81d07f3c4c9767992b474515c2eee7126025d0356e5fd11
Instruction Fuzzy Hash: B432AE36B0AA5286FB188B11D5462BCA3A0FF55B84F484077EE8DA7B95DF3CE465C340

Function 00007FF6D3AE48D0 Relevance: 47.7, APIs: 10, Strings: 17, Instructions: 449windowCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF6D3AE4A15
getaddrinfo.WS2_32 ref: 00007FF6D3AE4B52
FormatMessageA.KERNEL32 ref: 00007FF6D3AE4C1F
freeaddrinfo.WS2_32 ref: 00007FF6D3AE4C74
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AE4C86
FormatMessageA.KERNEL32 ref: 00007FF6D3AE4CDD
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AE4D79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE4D93
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE4DC4
htonl.WS2_32 ref: 00007FF6D3AE4F52

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.c, xrefs: 00007FF6D3AE4E11, 00007FF6D3AE4E2A, 00007FF6D3AE4E43
buf_inc_len(&ret, (int)read_size), xrefs: 00007FF6D3AE48D4
gfff, xrefs: 00007FF6D3AE4A3C
undefined, xrefs: 00007FF6D3AE4A79
RESOLVE: Cannot resolve host address: %s:%s (%s) (I would have retried this name query if you had specified the --resolv-retry option.), xrefs: 00007FF6D3AE4A9A
!(flags & GETADDR_HOST_ORDER), xrefs: 00007FF6D3AE4E37
%u.%u.%u.%u, xrefs: 00007FF6D3AE4F00
hostname || servname, xrefs: 00007FF6D3AE4E1E
WARNING: ignoring --remote-random-hostname because the hostname is an IP address, xrefs: 00007FF6D3AE4D1B
!@, xrefs: 00007FF6D3AE4997
res, xrefs: 00007FF6D3AE4E05
RESOLVE: Ignored SIGUSR1 signal received during DNS resolution attempt, xrefs: 00007FF6D3AE4BA6
!, xrefs: 00007FF6D3AE4907
RESOLVE: signal received during DNS resolution attempt, xrefs: 00007FF6D3AE4D61
RESOLVE: Cannot resolve host address: %s:%s (%s), xrefs: 00007FF6D3AE4A85
RESOLVE: Cannot parse IP address: %s:%s (%s), xrefs: 00007FF6D3AE4CE8
GETADDRINFO flags=0x%04x ai_family=%d ai_socktype=%d, xrefs: 00007FF6D3AE4B23

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: FormatMessagefreegetaddrinfo$_errno_exitfreeaddrinfohtonl
String ID: !$!(flags & GETADDR_HOST_ORDER)$!@$%u.%u.%u.%u$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.c$GETADDRINFO flags=0x%04x ai_family=%d ai_socktype=%d$RESOLVE: Cannot parse IP address: %s:%s (%s)$RESOLVE: Cannot resolve host address: %s:%s (%s)$RESOLVE: Cannot resolve host address: %s:%s (%s) (I would have retried this name query if you had specified the --resolv-retry option.)$RESOLVE: Ignored SIGUSR1 signal received during DNS resolution attempt$RESOLVE: signal received during DNS resolution attempt$WARNING: ignoring --remote-random-hostname because the hostname is an IP address$buf_inc_len(&ret, (int)read_size)$gfff$hostname || servname$res$undefined
API String ID: 2288921036-1362950862
Opcode ID: 76c340e7498f22dd36503456e82e4f5e2c9a800d13fc7fc81f48d8c99a384097
Instruction ID: d0d2cb651d0418f09ad9b38e97e5082e943713db4629bf99dd98e8ec6c9e5aa3
Opcode Fuzzy Hash: 76c340e7498f22dd36503456e82e4f5e2c9a800d13fc7fc81f48d8c99a384097
Instruction Fuzzy Hash: FE12BF32B0978286FA688B14E4523BDE294FF99794F484136DA8DF7795DF3CE8608740

Function 00007FF8A7306E60 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 248windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 00007FF8A7306F1D

Part of subcall function 00007FF8A737E45C: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E46C

SHBrowseForFolderW.SHELL32 ref: 00007FF8A7306F7C
SHGetPathFromIDListW.SHELL32 ref: 00007FF8A7306F95
CoTaskMemFree.OLE32 ref: 00007FF8A7306F9E
BeginPaint.USER32 ref: 00007FF8A7307072
GetClientRect.USER32 ref: 00007FF8A7307083
LoadImageW.USER32 ref: 00007FF8A73070DD
CreateCompatibleDC.GDI32 ref: 00007FF8A73070F2
SelectObject.GDI32 ref: 00007FF8A7307101
GetObjectW.GDI32 ref: 00007FF8A7307113
BitBlt.GDI32 ref: 00007FF8A730715A
DeleteDC.GDI32 ref: 00007FF8A7307163
DeleteObject.GDI32 ref: 00007FF8A730716C
EndPaint.USER32 ref: 00007FF8A730717A
DrawTextW.USER32 ref: 00007FF8A73071A2
EndPaint.USER32 ref: 00007FF8A73071B0
PostQuitMessage.USER32 ref: 00007FF8A7307208
CreateWindowExW.USER32 ref: 00007FF8A730725F
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF8A7307289
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF8A730729F
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF8A73072AA

Part of subcall function 00007FF8A737E3F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E400
Part of subcall function 00007FF8A737E3F0: ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8A737E440

Strings

BUTTON, xrefs: 00007FF8A7307256
No BMP files found. Select a folder., xrefs: 00007FF8A7307198
Select Folder, xrefs: 00007FF8A730724F
%, xrefs: 00007FF8A7307185
IOjai fafoi awoa oiavj auighsaegiu, xrefs: 00007FF8A7306F65
, xrefs: 00007FF8A730713C

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Cpp_errorExclusiveLockObjectPaintThrow_std::_$AcquireCreateDeleteWindow$BeginBrowseClientCompatibleDrawFolderFreeFromImageListLoadMessagePathPostProcQuitRectReleaseSelectTaskText
String ID: $%$BUTTON$IOjai fafoi awoa oiavj auighsaegiu$No BMP files found. Select a folder.$Select Folder
API String ID: 2467847484-3208520512
Opcode ID: a6e59bd310273697161e5ad1631593eb8f08dc6d655f79b7f88ce3316410bd97
Instruction ID: fe98219c0e76dd50a7721b9410d0291c6e07f208e42332947eb8d151adbfbdbe
Opcode Fuzzy Hash: a6e59bd310273697161e5ad1631593eb8f08dc6d655f79b7f88ce3316410bd97
Instruction Fuzzy Hash: 9FC18A32A0BB42A6EB10CF65E8502BD63A5FB84BC4F914135EA4D47AA8CF3CE555E740

Function 00007FF6D3A79460 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 229COMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A794AC
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A794C3
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3A794D1
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3A794E0
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A794F4
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A79527
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A79538
EVP_CIPHER_get_nid.LIBCRYPTO-3-X64 ref: 00007FF6D3A79548
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A79558
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A79566
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A7959A
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A795AB
EVP_CIPHER_get_nid.LIBCRYPTO-3-X64 ref: 00007FF6D3A795BB
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A795CD
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A79607
EVP_CIPHER_get_iv_length.LIBCRYPTO-3-X64 ref: 00007FF6D3A79613
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7961E

Part of subcall function 00007FF6D3A7DC50: EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DC85

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A7974B
ciphername, xrefs: 00007FF6D3A7973F, 00007FF6D3A79758
buf_init(&work, frame->buf.headroom), xrefs: 00007FF6D3A79474
none, xrefs: 00007FF6D3A79640
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_backend.h, xrefs: 00007FF6D3A79764

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_fetchR_free$R_get_mode$R_get_flagsR_get_nid$R_get_iv_length
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_backend.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$buf_init(&work, frame->buf.headroom)$ciphername$none
API String ID: 3412402220-4141282390
Opcode ID: 92499ea3f1b541d0bca4b9cd6c5dfebe2429d77057c766d004109f9d386fe082
Instruction ID: 3867659f26c87452b919b954bd1493545835d2bdc01fa149916828c121fafc7d
Opcode Fuzzy Hash: 92499ea3f1b541d0bca4b9cd6c5dfebe2429d77057c766d004109f9d386fe082
Instruction Fuzzy Hash: C281A266F0D64642FE689B21949617DE391AF5AF80F4D043BDE4EA7799EE2CE4248300

Function 00007FF6D3A7BD20 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 344COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D3A7BD97
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A7BF45
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A7BFEE
isprint.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A7C0C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7C1E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7C214
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A7C274

Strings

Footer text not found in file '%s' (%d/%d/%d bytes found/min/max), xrefs: 00007FF6D3A7C194
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c, xrefs: 00007FF6D3A7C28D, 00007FF6D3A7C2A6, 00007FF6D3A7C2BF
[[INLINE]], xrefs: 00007FF6D3A7C085, 00007FF6D3A7C0B0, 00007FF6D3A7C175
hb_index >= 0 && hb_index < 2, xrefs: 00007FF6D3A7C29A
Non-Hex character ('%c') found at line %d in key file '%s' (%d/%d/%d bytes found/min/max), xrefs: 00007FF6D3A7C0D4
Non-Hex, unprintable character (0x%02x) found at line %d in key file '%s' (%d/%d/%d bytes found/min/max), xrefs: 00007FF6D3A7C0E0
sscanf((const char *)hex_byte, "%x", &u) == 1, xrefs: 00007FF6D3A7C281
key2->n >= 0 && key2->n <= (int) SIZE(key2->keys), xrefs: 00007FF6D3A7C2B3
Read error on key file ('%s'), xrefs: 00007FF6D3A7C25E
Insufficient key material or header text not found in file '%s' (%d/%d/%d bytes found/min/max), xrefs: 00007FF6D3A7C12F
[NULL], xrefs: 00007FF6D3A7C0BC, 00007FF6D3A7C11C, 00007FF6D3A7C181

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$_exitisprintisspaceisxdigitmemset
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c$Footer text not found in file '%s' (%d/%d/%d bytes found/min/max)$Insufficient key material or header text not found in file '%s' (%d/%d/%d bytes found/min/max)$Non-Hex character ('%c') found at line %d in key file '%s' (%d/%d/%d bytes found/min/max)$Non-Hex, unprintable character (0x%02x) found at line %d in key file '%s' (%d/%d/%d bytes found/min/max)$Read error on key file ('%s')$[NULL]$[[INLINE]]$hb_index >= 0 && hb_index < 2$key2->n >= 0 && key2->n <= (int) SIZE(key2->keys)$sscanf((const char *)hex_byte, "%x", &u) == 1
API String ID: 234695541-3277667424
Opcode ID: 9667e0df7e27633eda6f266013e97829e05f5fba4efad342a6f661836cd84ca1
Instruction ID: d55d4fb4abdfe1289cf92193a4a57bc9a1c948e823e7364177bd608959259a6e
Opcode Fuzzy Hash: 9667e0df7e27633eda6f266013e97829e05f5fba4efad342a6f661836cd84ca1
Instruction Fuzzy Hash: BCE1C2B2F0C68195E6288B10E5823BEF7A1FB95790F194133DA8DA3698DF7CE465C740

Function 00007FF6D3B134A0 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 119registrynetworkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF6D3B134C5
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B134F3
memset.VCRUNTIME140 ref: 00007FF6D3B13519
memset.VCRUNTIME140 ref: 00007FF6D3B1353C
RegOpenKeyExW.ADVAPI32 ref: 00007FF6D3B13584
RegGetValueW.ADVAPI32 ref: 00007FF6D3B135B7
RegCloseKey.ADVAPI32 ref: 00007FF6D3B135C4
_wgetenv_s.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF6D3B13653
memset.VCRUNTIME140 ref: 00007FF6D3B13670
_wputenv_s.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FF6D3B136A9

Strings

%ls, xrefs: 00007FF6D3B135DA
%ls\ssl\%ls, xrefs: 00007FF6D3B1367F
WSAStartup failed, xrefs: 00007FF6D3B134DD
\, xrefs: 00007FF6D3B1360B
SOFTWARE\OpenVPN, xrefs: 00007FF6D3B13541
C:\Windows\System32, xrefs: 00007FF6D3B135CE

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: memset$CloseOpenStartupValue_exit_wgetenv_s_wputenv_s
String ID: %ls$%ls\ssl\%ls$C:\Windows\System32$SOFTWARE\OpenVPN$WSAStartup failed$\
API String ID: 3173856009-2305895326
Opcode ID: 59bf6e5c4f8308b5e52ee5288ccbafa06450be1b17c4ac6d29538fcc033bb539
Instruction ID: 493c013561808a837f7f011cbf43282cf1feb379121f941a70db32dd7380312b
Opcode Fuzzy Hash: 59bf6e5c4f8308b5e52ee5288ccbafa06450be1b17c4ac6d29538fcc033bb539
Instruction Fuzzy Hash: 8751A331A1DA8181EB20DB11E4423BEE361FBAA754F844237D6CDA3A99DF7DD564C700

Function 00007FF6D3B053C0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 201sleepCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF6D3B054E7
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B05515
GetIpInterfaceEntry.IPHLPAPI ref: 00007FF6D3B0558E
Sleep.KERNEL32 ref: 00007FF6D3B055CB

Part of subcall function 00007FF6D3B13A50: CreateEventA.KERNEL32 ref: 00007FF6D3B13A93
Part of subcall function 00007FF6D3B13A50: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B13AC6
Part of subcall function 00007FF6D3B13A50: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B13AF7

Part of subcall function 00007FF6D3B13A50: CreateEventA.KERNEL32 ref: 00007FF6D3B13BE4
Part of subcall function 00007FF6D3B13A50: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B13C8A

CreateFileMappingA.KERNEL32 ref: 00007FF6D3B0565B
CreateFileMappingA.KERNEL32 ref: 00007FF6D3B05682
CreateEventA.KERNEL32 ref: 00007FF6D3B056A7
CreateEventA.KERNEL32 ref: 00007FF6D3B056BE
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B05718

Strings

Cannot allocate memory for ring buffer, xrefs: 00007FF6D3B05702
interface %ld not yet ready, retrying, xrefs: 00007FF6D3B055B5
Cannot create events for ring buffer, xrefs: 00007FF6D3B056EB
DeviceIoControl(OVPN_IOCTL_START_VPN) failed, xrefs: 00007FF6D3B054FF
dco_start_tun, xrefs: 00007FF6D3B05498

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Create$Event_exit$FileMapping$ControlDeviceEntryInterfaceSleepcalloc
String ID: Cannot allocate memory for ring buffer$Cannot create events for ring buffer$DeviceIoControl(OVPN_IOCTL_START_VPN) failed$dco_start_tun$interface %ld not yet ready, retrying
API String ID: 1686616596-1354142042
Opcode ID: a3873a7debbf371e659541d8e994e9e6f7a501c3c1eeedc020323e72f4ef3824
Instruction ID: 974f5b2fffd33a8e3850093bc37643067ac55a2cafc9152dfd0c356170ad45ba
Opcode Fuzzy Hash: a3873a7debbf371e659541d8e994e9e6f7a501c3c1eeedc020323e72f4ef3824
Instruction Fuzzy Hash: 01A1A632E19B8186F714CF64E5462BDB360FBAA748F445236DB8D63A56DF38A1A4C700

Function 00007FF8A7304960 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 295windowregistryCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF8A7304C45
PostQuitMessage.USER32 ref: 00007FF8A7304C4D

Part of subcall function 00007FF8A738A434: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A738A448

RegisterClassW.USER32 ref: 00007FF8A7304D4F
CreateWindowExW.USER32 ref: 00007FF8A7304D9B
ShowWindow.USER32 ref: 00007FF8A7304DA6
GetMessageW.USER32 ref: 00007FF8A7304DCE
TranslateMessage.USER32 ref: 00007FF8A7304DE5
DispatchMessageW.USER32 ref: 00007FF8A7304DF0
GetMessageW.USER32 ref: 00007FF8A7304E03

Strings

Game Over!, xrefs: 00007FF8A7304C3C
TetrisGame, xrefs: 00007FF8A7304D28
Tetris, xrefs: 00007FF8A7304C35, 00007FF8A7304D5A
gfff, xrefs: 00007FF8A7304BBC

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Message$TimeWindow$ClassCreateDispatchFilePostQuitRegisterShowSystemTranslate
String ID: Game Over!$Tetris$TetrisGame$gfff
API String ID: 3409167224-4281476174
Opcode ID: 6a8e2ee31f89f1506d9e6260157c56aa40c6a8c858e7d1219ab940021e6583af
Instruction ID: fe87c2da305f7075a0703626f2e9b3f9249b818fad4449b2ef9a2c20219a771d
Opcode Fuzzy Hash: 6a8e2ee31f89f1506d9e6260157c56aa40c6a8c858e7d1219ab940021e6583af
Instruction Fuzzy Hash: FAD1C372A0AB86A2EB10CF65E8403AD73A1FB89BC4F854235DA9D07B95DF3CE151D740

Function 00007FF8A7304790 Relevance: 21.1, APIs: 14, Instructions: 101memorythreadtimeCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 00007FF8A730480D
SetThreadStackGuarantee.KERNEL32 ref: 00007FF8A7304815
GetFileAttributesW.KERNEL32 ref: 00007FF8A730481D
GetHandleInformation.KERNEL32 ref: 00007FF8A7304827
VirtualProtectEx.KERNEL32 ref: 00007FF8A7304840
IsBadStringPtrW.KERNEL32 ref: 00007FF8A730484A
GlobalAlloc.KERNEL32 ref: 00007FF8A7304854
GetLastError.KERNEL32 ref: 00007FF8A730485A
VirtualFree.KERNEL32 ref: 00007FF8A7304867
SystemTimeToTzSpecificLocalTimeEx.KERNEL32 ref: 00007FF8A7304874
DeleteFiber.KERNEL32 ref: 00007FF8A730487C
HeapDestroy.KERNEL32 ref: 00007FF8A7304884
GetCurrentProcessorNumberEx.KERNEL32 ref: 00007FF8A730488C
CreateIoCompletionPort.KERNEL32 ref: 00007FF8A730489C

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: TimeVirtual$AllocAttributesCompletionCreateCurrentDeleteDestroyErrorFiberFileFreeGlobalGuaranteeHandleHeapInformationLastLocalNumberPortProcessorProtectSpecificStackStringSystemThread
String ID:
API String ID: 3682930597-0
Opcode ID: c17ad66c9da7a2edcf83afdf4b378c13429e38af40f238ff695b4d2edf032777
Instruction ID: efde10e5f22e7e44700ecec47a33d6484736239ba32a6202bf3742dc19827839
Opcode Fuzzy Hash: c17ad66c9da7a2edcf83afdf4b378c13429e38af40f238ff695b4d2edf032777
Instruction Fuzzy Hash: 0D514972A06B45AAEB14DF74E4553ED33A1FF48348F81403AEA5E46A68DF3CD259C384

Function 00007FF6D3AB4D00 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

SetConsoleOutputCP.KERNEL32(?,?,00000000,0000027C), ref: 00007FF6D3AB4D39
memset.VCRUNTIME140(?,00000000,0000027C), ref: 00007FF6D3AB4D4B
memset.VCRUNTIME140(?,00000000,0000027C), ref: 00007FF6D3AB4D5F

Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71017
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A71037
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71040
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A710C2
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A710CB

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,0000027C), ref: 00007FF6D3AB4DC9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,0000027C), ref: 00007FF6D3AB4DDA

Strings

struct session *, xrefs: 00007FF6D3AB4E1E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: CountTick$__acrt_iob_func_time64memset$ConsoleOutput
String ID: struct session *
API String ID: 3769645568-2659699318
Opcode ID: f033218f381563d25998beaf72996a7715b0c51a260d1b4b5d2fa2b22a61a1bd
Instruction ID: cc1094cf9d9aa18912018c6c885387a58322ea419f068fed560dfeac5614f4d8
Opcode Fuzzy Hash: f033218f381563d25998beaf72996a7715b0c51a260d1b4b5d2fa2b22a61a1bd
Instruction Fuzzy Hash: 8F51C871A0ABC385F314CB21AC166BDB794FB66354F04423BC99DAAA95DF7CA124C740

Function 00007FF6D3AD6060 Relevance: 18.3, APIs: 7, Strings: 5, Instructions: 254COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD6306

Strings

@, xrefs: 00007FF6D3AD6237
%s,%s,%s, xrefs: 00007FF6D3AD62CB
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\pool.c, xrefs: 00007FF6D3AD636C, 00007FF6D3AD6BB6, 00007FF6D3AD6BCF
IFCONFIG POOL LIST, xrefs: 00007FF6D3AD6AB7
buf_init(&in, 0), xrefs: 00007FF6D3AD6BC3

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: %s,%s,%s$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\pool.c$IFCONFIG POOL LIST$buf_init(&in, 0)
API String ID: 1294909896-2098788154
Opcode ID: 9374a39a8ad1decf306c01e6d18613cb583b323946ed3adff0c03bc9b47242d0
Instruction ID: 0323d9dd78709420513c4435a2ea9625c1a16b3d4c92fbc48d56e29ceb8cffe1
Opcode Fuzzy Hash: 9374a39a8ad1decf306c01e6d18613cb583b323946ed3adff0c03bc9b47242d0
Instruction Fuzzy Hash: 67C19422E19B8286E714CB10E4153BDB764FBE9744F4A9236DE8C63665EF78E1A1C300

Function 00007FF6D3A80520 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 167COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF6D3A806EC
GetLastError.KERNEL32 ref: 00007FF6D3A806F6
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A80727

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco_win.c, xrefs: 00007FF6D3A8076B
dco_create_socket, xrefs: 00007FF6D3A8056D
AF_INET6, xrefs: 00007FF6D3A8060B
DCO: Socket bind failed: Address to bind lacks %s record, xrefs: 00007FF6D3A8061F
AF_INET, xrefs: 00007FF6D3A80618
AF_UNSPEC, xrefs: 00007FF6D3A80604
DeviceIoControl(OVPN_IOCTL_NEW_PEER) failed, xrefs: 00007FF6D3A80711

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ControlDeviceErrorLast_exit
String ID: AF_INET$AF_INET6$AF_UNSPEC$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco_win.c$DCO: Socket bind failed: Address to bind lacks %s record$DeviceIoControl(OVPN_IOCTL_NEW_PEER) failed$dco_create_socket
API String ID: 1951653295-4195604906
Opcode ID: d11c1b9b8987b98baaee62f842e04ab4e0080f85ed5320c793462e998d1d5be9
Instruction ID: 06e712cab6ea567c850525c9eb1f0e39f5feecd2322fedb2bfc75d6a8b9aa9c7
Opcode Fuzzy Hash: d11c1b9b8987b98baaee62f842e04ab4e0080f85ed5320c793462e998d1d5be9
Instruction Fuzzy Hash: 2B71A562F09A9299F718CF6095022BDB371AF59348F448136DE8DB6695EF3CA5A1C340

Function 00007FF8A7302D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 70windowregistryCOMMON

Download Yara Rule

APIs

RegisterClassW.USER32 ref: 00007FF8A7302DE7
CreateWindowExW.USER32 ref: 00007FF8A7302E33
ShowWindow.USER32 ref: 00007FF8A7302E43
GetMessageW.USER32 ref: 00007FF8A7302E6B
TranslateMessage.USER32 ref: 00007FF8A7302E7A
DispatchMessageW.USER32 ref: 00007FF8A7302E85
GetMessageW.USER32 ref: 00007FF8A7302E98

Strings

JsonEditorWindow, xrefs: 00007FF8A7302DC5
JSON Formatter, xrefs: 00007FF8A7302DF2

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Message$Window$ClassCreateDispatchRegisterShowTranslate
String ID: JSON Formatter$JsonEditorWindow
API String ID: 4062082325-1842938598
Opcode ID: 8edcb8fc9f459f25238f23a7c56082279130a4e957a71a659666dd67eb753ba3
Instruction ID: cb54c175f524bb9daa4f5f172e9585399ec6121d5d3f5e742be6712d0ef49ef6
Opcode Fuzzy Hash: 8edcb8fc9f459f25238f23a7c56082279130a4e957a71a659666dd67eb753ba3
Instruction Fuzzy Hash: 9E31C332A1DB8192E710CF61F84866E73A4FB98780FA69235EB9D43A14DF7CE585C740

Function 00007FF8A73A220C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A73A1DF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73A1E31
Part of subcall function 00007FF8A73A1DF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73A1EAF
Part of subcall function 00007FF8A73A1DF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73A1F00

CreateFileW.KERNEL32 ref: 00007FF8A73A2312
CreateFileW.KERNEL32 ref: 00007FF8A73A2362
GetLastError.KERNEL32 ref: 00007FF8A73A2392
GetFileType.KERNEL32 ref: 00007FF8A73A23A7
GetLastError.KERNEL32 ref: 00007FF8A73A23B1
CloseHandle.KERNEL32 ref: 00007FF8A73A23E4
CloseHandle.KERNEL32 ref: 00007FF8A73A2547
CreateFileW.KERNEL32 ref: 00007FF8A73A257C
GetLastError.KERNEL32 ref: 00007FF8A73A258B

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4914d2ff6dfac0a5d4988cd2caafd7893ef85a21cdb11bb5dd5a266b69118104
Instruction ID: 626e41f90415be576fab092784b41d2d5cb8807d104a991354d61cf3479f3787
Opcode Fuzzy Hash: 4914d2ff6dfac0a5d4988cd2caafd7893ef85a21cdb11bb5dd5a266b69118104
Instruction Fuzzy Hash: 09C1BE37B2AE4295EB14CF69C4912AC37A1FB89BE8B424235DE2E97394CF39D055D340

Function 00007FF6D3AFABD0 Relevance: 12.8, APIs: 10, Instructions: 305COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFADD4
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFAE0D
memcpy.VCRUNTIME140 ref: 00007FF6D3AFAE29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFAE49
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFAE82
memcpy.VCRUNTIME140 ref: 00007FF6D3AFAE9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFAEB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFAEE4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB026
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB054

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$callocmemcpy
String ID:
API String ID: 603207647-0
Opcode ID: 8ac5b759bd5b427ad2ada5b5de7e2a59a2c1e524992cffaf2b347350a8697257
Instruction ID: b47f97bd5f136891a2e943e2d07ac8c9f4811f9572e0bd016c598c0f8cd5e3c5
Opcode Fuzzy Hash: 8ac5b759bd5b427ad2ada5b5de7e2a59a2c1e524992cffaf2b347350a8697257
Instruction Fuzzy Hash: 41C1D536B09B8282EA59CB21D4512BDE3A0FF85B84F4C4532EE5DA7755DF3CE4618B00

Function 00007FF8A739ECC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

TranslateName.LIBCMT ref: 00007FF8A739ED2A
TranslateName.LIBCMT ref: 00007FF8A739ED65
GetACP.KERNEL32 ref: 00007FF8A739EDAC
IsValidCodePage.KERNEL32 ref: 00007FF8A739EDE4
GetLocaleInfoW.KERNEL32 ref: 00007FF8A739EFA1

Strings

utf8, xrefs: 00007FF8A739EEC8

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: f136e67c62ae989a57d9da26231beeb4fa2657d1bd8bca1b33ee1c049a215729
Instruction ID: 483a116ebbb89d43c967e2625265fe0f7276dc4add1b2f911aa6cc248ecac2cf
Opcode Fuzzy Hash: f136e67c62ae989a57d9da26231beeb4fa2657d1bd8bca1b33ee1c049a215729
Instruction Fuzzy Hash: 00917833A4AF82A6EB349F2194612BD23A4EF44BC0F8A4531DA4D47795EF3CE951E340

Function 00007FF8A739F708 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

Part of subcall function 00007FF8A7390A80: FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AC5

GetUserDefaultLCID.KERNEL32 ref: 00007FF8A739F878

Part of subcall function 00007FF8A7390A80: FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AF2
Part of subcall function 00007FF8A7390A80: FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390B03
Part of subcall function 00007FF8A7390A80: FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390B14

EnumSystemLocalesW.KERNEL32 ref: 00007FF8A739F85F
ProcessCodePage.LIBCMT ref: 00007FF8A739F8A2
IsValidCodePage.KERNEL32 ref: 00007FF8A739F8B4
IsValidLocale.KERNEL32 ref: 00007FF8A739F8CA
GetLocaleInfoW.KERNEL32 ref: 00007FF8A739F926
GetLocaleInfoW.KERNEL32 ref: 00007FF8A739F942

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: ecbbed6f480fe09eb987de698c24de9da97edde6f0b35f2b086395f558261317
Instruction ID: d723dd2afed8fd954a33e9298a47f3e69e31835cfef14b85a15f3a05ae55d7e0
Opcode Fuzzy Hash: ecbbed6f480fe09eb987de698c24de9da97edde6f0b35f2b086395f558261317
Instruction Fuzzy Hash: 00715A22B0AE03A9EB51AF61D8606BD73A4FF48BC8F864135CA1D53695EF3CE445E350

Function 00007FF8A7396F74 Relevance: 9.3, APIs: 6, Instructions: 335timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF8A7396FB9

Part of subcall function 00007FF8A7396630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A7396644

Part of subcall function 00007FF8A7393734: HeapFree.KERNEL32 ref: 00007FF8A739374A
Part of subcall function 00007FF8A7393734: GetLastError.KERNEL32 ref: 00007FF8A7393754

Part of subcall function 00007FF8A73A14F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73A1443

_get_daylight.LIBCMT ref: 00007FF8A7396FA8

Part of subcall function 00007FF8A7396690: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73966A4

_get_daylight.LIBCMT ref: 00007FF8A739721E
_get_daylight.LIBCMT ref: 00007FF8A739722F
_get_daylight.LIBCMT ref: 00007FF8A7397240
GetTimeZoneInformation.KERNEL32 ref: 00007FF8A7397267

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 355007559-0
Opcode ID: 26fafc58d1105fc267672cbcea811129835ec4f39cc52474e6b167b5d084b39f
Instruction ID: a1d5bcc69f78b36ce2d546dcc1f53d9f0fcae0756e0a54555f704a51e2f2ce1e
Opcode Fuzzy Hash: 26fafc58d1105fc267672cbcea811129835ec4f39cc52474e6b167b5d084b39f
Instruction Fuzzy Hash: 11D1D022A0BE42A6E7209F22D8A15BD6761EF847D4FC24035EA5D476C5EF3CE841E780

Function 00007FF8A738A4A8 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A738A4CA
_get_daylight.LIBCMT ref: 00007FF8A738A52A
_get_daylight.LIBCMT ref: 00007FF8A738A53B
_get_daylight.LIBCMT ref: 00007FF8A738A54C
_isindst.LIBCMT ref: 00007FF8A738A59D
_isindst.LIBCMT ref: 00007FF8A738A5F0

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 7b526105e023ef1ca23fee429104555463677fcf834fc9184794dcbed6c27eee
Instruction ID: 2c83b855512c629b5d6d33f01e639f0ef838a8e73c032999fc39de577856dedc
Opcode Fuzzy Hash: 7b526105e023ef1ca23fee429104555463677fcf834fc9184794dcbed6c27eee
Instruction Fuzzy Hash: CF9106B2B06B469BFB588F65C9113BD23A5EB54BC8F859035EA0D4B789EF3CE4419700

Function 00007FF8A738B230 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8A738B2A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A738B2C1
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A738B2FC
IsDebuggerPresent.KERNEL32 ref: 00007FF8A738B335
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A738B33F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A738B34A

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e29b1efd654e05d66a1fbb63a6d23c7290edc2bea8cb0b5b8ad06d09aa7e5fcf
Instruction ID: 3a09bfb37ced3dbc0901871552dfa1cc5c1118619644be8dc9c50958fcc20643
Opcode Fuzzy Hash: e29b1efd654e05d66a1fbb63a6d23c7290edc2bea8cb0b5b8ad06d09aa7e5fcf
Instruction Fuzzy Hash: 3D319332609F8296EB60CF25E8407AE73A0FB89798F950135EA9D43BA4DF3CD145DB00

Function 00007FF6D3A80C90 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.NCRYPT ref: 00007FF6D3A80CB5
BCryptCloseAlgorithmProvider.NCRYPT ref: 00007FF6D3A80CC6

Strings

CHACHA20_POLY1305, xrefs: 00007FF6D3A80CA6
AES-128-GCM:AES-256-GCM:AES-192-GCM:CHACHA20-POLY1305, xrefs: 00007FF6D3A80CCC
AES-128-GCM:AES-256-GCM:AES-192-GCM, xrefs: 00007FF6D3A80CE5

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: AlgorithmCryptProvider$CloseOpen
String ID: AES-128-GCM:AES-256-GCM:AES-192-GCM$AES-128-GCM:AES-256-GCM:AES-192-GCM:CHACHA20-POLY1305$CHACHA20_POLY1305
API String ID: 58216706-2740195256
Opcode ID: 2ea88a768574f7140f9c6bdb60ca1e451349dddb716a2ea06b16f70317851d7b
Instruction ID: c5afd7ed598e416763f7746eb92f0104735c2b7f85635a438f59d4977f2b2020
Opcode Fuzzy Hash: 2ea88a768574f7140f9c6bdb60ca1e451349dddb716a2ea06b16f70317851d7b
Instruction Fuzzy Hash: 3AF01266B09A4281FA209B11E85757EA760BFEA798FC41133D98DA6625DD2CE225CB00

Function 00007FF6D3A7E520 Relevance: 7.5, APIs: 5, Instructions: 32encryptionCOMMON

Download Yara Rule

APIs

NCryptFreeObject.NCRYPT ref: 00007FF6D3A7E54F
CryptReleaseContext.ADVAPI32 ref: 00007FF6D3A7E559
CertFreeCertificateContext.CRYPT32 ref: 00007FF6D3A7E567
EVP_PKEY_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7E571
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7E57A

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ContextCryptFree$CertCertificateObjectReleaseY_freefree
String ID:
API String ID: 495936466-0
Opcode ID: 5ef17ea75df53297c9e12b94e7b80db9d7b20e3c939c2c0894eddc9f2a82afb3
Instruction ID: e322a128012d3cba8fcf3e157a384d69dd8a30ecef8c178b45da923636e837dc
Opcode Fuzzy Hash: 5ef17ea75df53297c9e12b94e7b80db9d7b20e3c939c2c0894eddc9f2a82afb3
Instruction Fuzzy Hash: FD01A2B5F0650686FF1CCB25C49A53CA361AF94B45F1C0632C90D91294EF3CE8B58600

Function 00007FF8A738D06C Relevance: 5.5, APIs: 3, Instructions: 1005COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A738D4A2
_get_daylight.LIBCMT ref: 00007FF8A738D53D
_get_daylight.LIBCMT ref: 00007FF8A738D556

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 97a120aa5bcc87e1b148557f5b8c6abbdb06df0dd7dd4484c869f2ca58362072
Instruction ID: 454028a3ae68199480f5bb5df6938ffed3bb23bf9139fa1b766227640f8de601
Opcode Fuzzy Hash: 97a120aa5bcc87e1b148557f5b8c6abbdb06df0dd7dd4484c869f2ca58362072
Instruction Fuzzy Hash: EF92BE32A2AA8696F7648F24945017D37E1FF897C4F968135EA8D07B98DF3DE511E300

Function 00007FF8A7394188 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF8A73941FC

Strings

GetLocaleInfoEx, xrefs: 00007FF8A73941A4, 00007FF8A73941B5

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 98721c12ef23f0b36cae32fa06e732b9806c6251a668ace2faa272e06fa53f4d
Instruction ID: c7bb5e4c6d8765cd7d4d9b13303ec3c99281039564feffb4ff422a0219009284
Opcode Fuzzy Hash: 98721c12ef23f0b36cae32fa06e732b9806c6251a668ace2faa272e06fa53f4d
Instruction Fuzzy Hash: 5601A725B0AF41A6E7049F86B4500AEB364FF98FC0F958036DE4D03B55CE3CD5519780

Function 00007FF8A730E7B0 Relevance: 3.0, Strings: 2, Instructions: 488COMMON

Download Yara Rule

Strings

%, xrefs: 00007FF8A730EC0A
+, xrefs: 00007FF8A730EC16

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: ec7d417479a44e010914b1a43e80047ee9bd714a24f89e2bc73640c54b3c6c58
Instruction ID: 98e43ff65bd03e0725939cd9bb56c382b63bc104cc94d17a94f2abc7d86bcb6e
Opcode Fuzzy Hash: ec7d417479a44e010914b1a43e80047ee9bd714a24f89e2bc73640c54b3c6c58
Instruction Fuzzy Hash: 57121412B5AAD199FB219EA4E8403BD2761EF54BD8F854231EE5D17BC9DE3CD482E300

Function 00007FF8A73885C8 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8A7388978
, xrefs: 00007FF8A7388736

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 4c4026a035e9081923aeba8c3756962f26ce34cb3abe2c167403cca7f92f9c55
Instruction ID: 7cf3b18dac291cbc8e8fc45eb18560148426efc56a0431d0370229eced3a98b9
Opcode Fuzzy Hash: 4c4026a035e9081923aeba8c3756962f26ce34cb3abe2c167403cca7f92f9c55
Instruction Fuzzy Hash: EBE1D632B2AE4696FB688E2581501BD33A0FF45BC8FA65235DA4E07794DF7DE841E700

Function 00007FF6D3AFE470 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

key->n == 2 && other->n == 2, xrefs: 00007FF6D3AFE6EF
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tls_crypt.c, xrefs: 00007FF6D3AFE6FB

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID:
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tls_crypt.c$key->n == 2 && other->n == 2
API String ID: 0-2684567639
Opcode ID: 120f2afdc7dd5c3ea57313a9a2338e5117b65b4b447236ae7c18a5bf4b9cf8c1
Instruction ID: 5e92fc21acd1d414faee4d77aaed10d512ff9e0224f46c2a51b14e19deaa46cb
Opcode Fuzzy Hash: 120f2afdc7dd5c3ea57313a9a2338e5117b65b4b447236ae7c18a5bf4b9cf8c1
Instruction Fuzzy Hash: DE918B8340E6E005C70B877990A05BEBFE0D9ABD2575F86DAD7E24F293C409C39ADB51

Function 00007FF8A7395008 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF8A7395192
e+000, xrefs: 00007FF8A7395115

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 2fddd67754c4f3c4534ee5e0c408859824c0ec40c41af95da4819b802978c8df
Instruction ID: 55b94d2cba453e9b5c18ca43fa773416dd26d73a92502d244e5beadbfd1f6bec
Opcode Fuzzy Hash: 2fddd67754c4f3c4534ee5e0c408859824c0ec40c41af95da4819b802978c8df
Instruction Fuzzy Hash: 1D518A62B1AFC696E7248E35D81176D7B91E744BD4F8A8231CBA84BBC5DF3ED4808701

Function 00007FF8A739D5B4 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5327fcaf3aa5ec308ae14740d122a3f673a74432323bf6260b806e43989119b4
Instruction ID: dec21d161651c71619590dca527281a94ac1a8aebf09abb783374c059d06d56a
Opcode Fuzzy Hash: 5327fcaf3aa5ec308ae14740d122a3f673a74432323bf6260b806e43989119b4
Instruction Fuzzy Hash: C5E16C22A09F81A6E720DF61E4912EE77A4FB957C8F814631DB8D53B56EF38E245D300

Function 00007FF8A739F3CC Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

Part of subcall function 00007FF8A7390A80: FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AC5

GetLocaleInfoW.KERNEL32 ref: 00007FF8A739F434

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: d5387c35539635b75c51c71e0dad2a7d549367f3ea96316e4c803c70a92eb5a4
Instruction ID: b9a40aad0a4200001810446b7b7f1707a3ca8de6d60e691f6f846585cd8e6594
Opcode Fuzzy Hash: d5387c35539635b75c51c71e0dad2a7d549367f3ea96316e4c803c70a92eb5a4
Instruction Fuzzy Hash: 0D319C32A0AE8396FB64DF21E9617AE73A1FB887C4F858135DA5D83285DF3CE4409740

Function 00007FF8A739F01C Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

EnumSystemLocalesW.KERNEL32 ref: 00007FF8A739F0BA

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 2285d4dfefe9222df06f967bb8ed0dd2a8a02afa38494b05b22eac07527ad43a
Instruction ID: c2779fc68eda4525255b515a2d72145500ad7f902432075d6eaf03fc88ef632f
Opcode Fuzzy Hash: 2285d4dfefe9222df06f967bb8ed0dd2a8a02afa38494b05b22eac07527ad43a
Instruction Fuzzy Hash: 9E112463E09E469AEB508F15D8902BC7BA0FB80BE0F968131CA29433C0CE78D5D1D740

Function 00007FF8A739F5D4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

GetLocaleInfoW.KERNEL32 ref: 00007FF8A739F60B

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: f3771613046af1ddfff88d3ab7e72ce8ca33636c133fd525483b6612a7db920f
Instruction ID: 31772d69cb055f3087d1204301313e31b9d7c2efb6a63b48864670a86707c08c
Opcode Fuzzy Hash: f3771613046af1ddfff88d3ab7e72ce8ca33636c133fd525483b6612a7db920f
Instruction Fuzzy Hash: 0A115C32F19F5393E7749F25A460A7E22A0EB447E4F964231D67D436D4EF2ED841A700

Function 00007FF8A739F0EC Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7390A80: GetLastError.KERNEL32 ref: 00007FF8A7390A8F
Part of subcall function 00007FF8A7390A80: FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
Part of subcall function 00007FF8A7390A80: SetLastError.KERNEL32 ref: 00007FF8A7390B2F

EnumSystemLocalesW.KERNEL32 ref: 00007FF8A739F16A

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 6f98319e16ffe1862749e3f05d27034d8858bcae96bab2180bf4ec373f7f1bb6
Instruction ID: ed8ced3e4135b63cc434b3e9177511451de7939da970ab36bf5f46ea621ed684
Opcode Fuzzy Hash: 6f98319e16ffe1862749e3f05d27034d8858bcae96bab2180bf4ec373f7f1bb6
Instruction Fuzzy Hash: 0F019E72A09E8396E7104F26EC90BBD76A1EB40BE4F968232D679476D4CF689481E740

Function 00007FF8A7394B74 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF8A7394EB6

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 80d16441b38b8acf040d0f1f0cdd1b167e4568000192880a9ac61ec35a512a23
Instruction ID: 4ece657628534d96549b8729ff6abdb679f27d7500511006c916a7b65e188ed0
Opcode Fuzzy Hash: 80d16441b38b8acf040d0f1f0cdd1b167e4568000192880a9ac61ec35a512a23
Instruction Fuzzy Hash: A1A14563A0AFC6A6EB21CF29A0207AE7790EB50BC4F468131DE8D47786DE3DE401D741

Function 00007FF8A7387830 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8A7387A0C

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b5b851760bae031b93d36d5261d2c73f329d8a5815f55342ee9ba07cff80e991
Instruction ID: aab60a643310adb3837858bb3cdee14ae0b96c9e2976f654cffab318cb82802b
Opcode Fuzzy Hash: b5b851760bae031b93d36d5261d2c73f329d8a5815f55342ee9ba07cff80e991
Instruction Fuzzy Hash: 9BB1A07290AB8596FB658F79C09127C3BA2F759B88FAA0135CB4E47395CF3AD441E700

Function 00007FF8A739A330 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A739A3D5

Part of subcall function 00007FF8A73928D4: HeapAlloc.KERNEL32 ref: 00007FF8A7392929

Part of subcall function 00007FF8A7393734: HeapFree.KERNEL32 ref: 00007FF8A739374A
Part of subcall function 00007FF8A7393734: GetLastError.KERNEL32 ref: 00007FF8A7393754

Part of subcall function 00007FF8A73A2630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A73A2663

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 3139c0e60bd2e69a8bf79971c67d2a54a999a2395de6ba948643918b006e785c
Instruction ID: f96afb46e8c7488a3bd5714cd531b40beb0aeb882d44648bf6f7136da480b733
Opcode Fuzzy Hash: 3139c0e60bd2e69a8bf79971c67d2a54a999a2395de6ba948643918b006e785c
Instruction Fuzzy Hash: 7C41C222B0BE5361EA709E2668657BFA2D0EF85BC4FC64235DE4D47B85DE3CE401E600

Function 00007FF8A738C6A0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2b4d9b3f7dbde067adcbd80de2674d158a5a6ec4a57264fde5b5ddddd29788
Instruction ID: 39ef134189a05ac63701d8b14f433c7d8d42f006e2ac32262ddd2a98be564f68
Opcode Fuzzy Hash: 4f2b4d9b3f7dbde067adcbd80de2674d158a5a6ec4a57264fde5b5ddddd29788
Instruction Fuzzy Hash: E7C12673B1AA8697E724CF29A04466EB791F784BC4F868135DB4E47B44DB3DE801CB40

Function 00007FF8A73881C4 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4477514b800ad01454d6224d24da253fefa706f06b897830142d496be6e1a028
Instruction ID: f997259ccba139ea00e9ab68982ddabe8b56a96576dd636eef549b4a4c54df8d
Opcode Fuzzy Hash: 4477514b800ad01454d6224d24da253fefa706f06b897830142d496be6e1a028
Instruction Fuzzy Hash: E8D1D766B2AE4696FB68CE29C4502BD23A0EF45BC8F964235CE0D076D5CFBDD841E340

Function 00007FF8A739144C Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 7c0ac1c71315a572907c4a5483402d8a73d6b78b06ad064158061ecc2a85b049
Instruction ID: 88e1a4b03558c713a1d8b6fda22599ce93dec525e238ce6f36698ed40f556ab4
Opcode Fuzzy Hash: 7c0ac1c71315a572907c4a5483402d8a73d6b78b06ad064158061ecc2a85b049
Instruction Fuzzy Hash: E3C1C266A0AE82A5FB609F7194203BE67A0FB847C8F824131DF8E57695DF3CD944E700

Function 00007FF8A739E730 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: efef25bc6c940c14aa6570e1484978dd86e8338afa02fef7049a3bafe6fe6423
Instruction ID: 05d4fdeb614e2daec2ce711a72d95e4ceb4fdc9e4abb61a7d7437822d5820448
Opcode Fuzzy Hash: efef25bc6c940c14aa6570e1484978dd86e8338afa02fef7049a3bafe6fe6423
Instruction Fuzzy Hash: 3EB10623A0AE46A2EB749F61D4216BE33A1FF44BC8F854231DA59436C9DF3CD541E740

Function 00007FF8A7395688 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434faeee4a27197c75c9da3b46acd530d03a0790d0b3f5f255c4f81cac577be1
Instruction ID: f8e56d5cd44a6771669f4fdd29b33e3f9e134aca5b76eb40d421eb9bb0b3460b
Opcode Fuzzy Hash: 434faeee4a27197c75c9da3b46acd530d03a0790d0b3f5f255c4f81cac577be1
Instruction Fuzzy Hash: D7810172A0EF8196EB64CF19946037EA690FB857E4F954235DA8D47BC9CE3CE5809B00

Function 00007FF8A7386564 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: f26cf91a17c182d09d693fb4e9ffa8908e166d072109d5ef25b8357abbf8c827
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 90519A76A15E51D2F7248F2AC06423C37B0EB44BA8F664231DE4D57799CB3AE843D740

Function 00007FF8A7386D84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: a5e5d0b80d006d1945a994e97bc1aea0bd5607843b224e2d1a523854aa9737f1
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 51518372A1AE51D6F7248F2AC16123C37A0EB45B98FA54132DE4D07796CB3AF853D780

Function 00007FF8A7386974 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 7852a3ab6ce2f938990fb5bcb94783c3e1027b2897ddf93741495507b1c74003
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: E1517376A19E51D2F7248F2AD06423C37A1EB44B98F668131CE8D177D6CB3AE842D740

Function 00007FF8A7386770 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94732f3cefc08f3353ec1d41df61ecd9287c8128d91118fe05b88be5c63bb7a7
Instruction ID: 262df990387d4ab77a1714b70dcd82eb8ef8cb8caae42e859643c39455e1fe24
Opcode Fuzzy Hash: 94732f3cefc08f3353ec1d41df61ecd9287c8128d91118fe05b88be5c63bb7a7
Instruction Fuzzy Hash: A251A636A19E51D6F7248F2AD06423C37A0EB44F98FA64131DE4C57796CB3AE853D780

Function 00007FF8A7386360 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12e7c255ce155637cc1c594d063d6d5db3739567eb3a2ecc9f2d19ad292e395
Instruction ID: 9b7474f6b423c738037e64a662215acc780faeed6952fc136905d6f8353c4286
Opcode Fuzzy Hash: e12e7c255ce155637cc1c594d063d6d5db3739567eb3a2ecc9f2d19ad292e395
Instruction Fuzzy Hash: 1D51A676A19E61D6F7248F2AD06023C37A0EB44B98FA94131CE4C177A6CB7AE853D740

Function 00007FF8A7386B80 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13152d3c0e899f1d8cddaeb5d170b213aa300ddb1a30ae017dd591a5b86a8be
Instruction ID: 0da791230fbb3ac119cf03de330531c7ea0296fde5dcb127d2b1ce6054e8369b
Opcode Fuzzy Hash: c13152d3c0e899f1d8cddaeb5d170b213aa300ddb1a30ae017dd591a5b86a8be
Instruction Fuzzy Hash: 1D519172A1AE51D6F7258F2AC06033C37A0EB45B98FA64131CE4D177A6CB3AE853D740

Function 00007FF8A738F528 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7541f5697427e3613ca2e8b4f80152fa35360097edf076e60d984faa0d927f92
Instruction ID: ba44a69fdcf1ea2581e914d23cf26f154d04d6266bd52a66171c43effde38277
Opcode Fuzzy Hash: 7541f5697427e3613ca2e8b4f80152fa35360097edf076e60d984faa0d927f92
Instruction Fuzzy Hash: 2341E2A2B15E5592EF44CF2AD9241AD63A1FB58FC0B8A9036DE0D87B68DE3CC0419300

Function 00007FF8A73A4CF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b682b933a62985321db009908df921a5b873b4c7c62373ec9b75ea043c0e62
Instruction ID: 68bf569543ac70ac7306376b7fbdb82c5d30a9e18d8ec44b49fe9335e05bc1a7
Opcode Fuzzy Hash: b7b682b933a62985321db009908df921a5b873b4c7c62373ec9b75ea043c0e62
Instruction Fuzzy Hash: 7EF06272B1A6959ADBA48F2CA84262D77D0E7083C0F908079D68D87B14DA3C90609F48

Function 00007FF8A7432B48 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e538d56f040bf909fb4b778eb89895b13802768848a22c9754ae856cdcac5ba8
Instruction ID: 6e33ee3df1c34039ec4dc33ae23e80626a15afdd3b3b02a60123b05365cb4a59
Opcode Fuzzy Hash: e538d56f040bf909fb4b778eb89895b13802768848a22c9754ae856cdcac5ba8
Instruction Fuzzy Hash: 06C0128BA0FBC207F3138D64182D71E3EC08757965F1A02AECBB8571D3D51915019205

Function 00007FF8A7432520 Relevance: .0, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73853b4ffde9bdfb3c9110f89cab85f5a5905065ebe1fd90ec6a3cb313b27d7
Instruction ID: 44c3bbcf8eb2cefcd16e17dea04dea5d50864be66d404c92762aaf1ade1dd8e0
Opcode Fuzzy Hash: e73853b4ffde9bdfb3c9110f89cab85f5a5905065ebe1fd90ec6a3cb313b27d7
Instruction Fuzzy Hash: 7FC04C86E0FB9365F1574454186635916E1DF126A5E09023A893C862C69A1B1D065144

Function 00007FF8A7432DE8 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9025721b4734cf216ff9161dcb72c60a7b93c9289a9a52723133faa327573b8
Instruction ID: 4cefd50d1c9ba925575938aa59d14428042512a825f22dd26fb75e1c8ab95d92
Opcode Fuzzy Hash: b9025721b4734cf216ff9161dcb72c60a7b93c9289a9a52723133faa327573b8
Instruction Fuzzy Hash:

Function 00007FF8A74323C8 Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103d6254a6d94bacc82e822885185f56c69cb799ec5124c0aa405e386975151b
Instruction ID: 33f440db8dcf76ed1806d7bd443262935e64228566635c654bb1f16f699d93a5
Opcode Fuzzy Hash: 103d6254a6d94bacc82e822885185f56c69cb799ec5124c0aa405e386975151b
Instruction Fuzzy Hash:

Function 00007FF6D3B0BCB0 Relevance: 100.1, APIs: 18, Strings: 39, Instructions: 359COMMON

Download Yara Rule

APIs

FlushIpNetTable.IPHLPAPI ref: 00007FF6D3B0BDE0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0BF11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0BFD6
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B0C030
htonl.WS2_32 ref: 00007FF6D3B0C075
htonl.WS2_32 ref: 00007FF6D3B0C084
AddIPAddress.IPHLPAPI ref: 00007FF6D3B0C0A1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0C0E8
htonl.WS2_32 ref: 00007FF6D3B0C11E
inet_ntoa.WS2_32 ref: 00007FF6D3B0C126
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0C176
htonl.WS2_32 ref: 00007FF6D3B0C1AD
inet_ntoa.WS2_32 ref: 00007FF6D3B0C1B5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0C227
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0C254

Part of subcall function 00007FF6D3B15E10: WriteFile.KERNEL32(?,00007FF6D3A83267,?,?,?,00007FF6D3A712AC), ref: 00007FF6D3B15E50
Part of subcall function 00007FF6D3B15E10: ReadFile.KERNEL32(?,00007FF6D3A83267,?,?,?,00007FF6D3A712AC), ref: 00007FF6D3B15E6E

Strings

Notified TAP-Windows driver to set a DHCP IP/netmask of %s/%s on interface %s [DHCP-serv: %s, lease-time: %d], xrefs: 00007FF6D3B0CDEC
DHCP option string: %s, xrefs: 00007FF6D3B0D00D
tap-windows6, xrefs: 00007FF6D3B0D32F
ERROR: Wintun requires SYSTEM privileges and therefore should be used with interactive service. If you want to use openvpn from command line, you need to do SYSTEM elevation yourself (for example with psexec)., xrefs: 00007FF6D3B0C6D0
ERROR: The TAP-Windows driver rejected a DeviceIoControl call to set TAP_WIN_IOCTL_CONFIG_DHCP_MASQ mode, xrefs: 00007FF6D3B0CC35
Using device interface: %s, xrefs: 00007FF6D3B0D2A0
DHCP option string not set due to error, xrefs: 00007FF6D3B0D0CF
Adapter %s is already in use, xrefs: 00007FF6D3B0C6A9
ERROR: The TAP-Windows driver rejected a DeviceIoControl call to set Point-to-Point mode, which is required for --dev tun, xrefs: 00007FF6D3B0C7CD
CreateFile failed on %s device: %s, xrefs: 00007FF6D3B0D339
tt->type == DEV_TYPE_TAP, xrefs: 00007FF6D3B0D13D
Succeeded in adding a temporary IP/netmask of %s/%s to interface %s using the Win32 IP Helper API, xrefs: 00007FF6D3B0C1ED
ep[3] > 0, xrefs: 00007FF6D3B0D156
I am having trouble using the Windows 'IP helper API' to automatically set the IP address -- consider using other --ip-win32 methods (not 'ipapi'), xrefs: 00007FF6D3B0C010, 00007FF6D3B0C3C6
SUCCEEDED, xrefs: 00007FF6D3B0CA25, 00007FF6D3B0CACE
ERROR: The TAP-Windows driver rejected a TAP_WIN_IOCTL_CONFIG_DHCP_SET_OPT DeviceIoControl call, xrefs: 00007FF6D3B0D0A4
NOTE: You have selected (explicitly or by default) '--ip-win32 ipapi', which has a better chance of working correctly if the TAP-Windows TCP/IP properties are set to 'Obtain an IP address automatically', xrefs: 00007FF6D3B0C04F
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tun.c, xrefs: 00007FF6D3B0D149, 00007FF6D3B0D162
WARNING: You have selected '--ip-win32 dynamic', which will not work unless the TAP-Windows TCP/IP properties are set to 'Obtain an IP address automatically', xrefs: 00007FF6D3B0BE86
.tap, xrefs: 00007FF6D3B0D1BE
%02x, xrefs: 00007FF6D3B0CF86
FAILED, xrefs: 00007FF6D3B0CA2C, 00007FF6D3B0CAD5
%s%s%s, xrefs: 00007FF6D3B0D1D6
wintun, xrefs: 00007FF6D3B0D326
Set TAP-Windows TUN with fake IPv4 [%s], xrefs: 00007FF6D3B0CAE2
unspecified, xrefs: 00007FF6D3B0D31D
Ring buffers registered via service, xrefs: 00007FF6D3B0C5F1
Register ring buffers failed using service: %s [status=0x%x], xrefs: 00007FF6D3B0C543
\\.\Global\, xrefs: 00007FF6D3B0D1CA
Failed to register %s adapter ring buffers, xrefs: 00007FF6D3B0D384
Set TAP-Windows TUN subnet mode network/local/netmask = %s/%s/%s [%s], xrefs: 00007FF6D3B0CA3A
ERROR: AddIPAddress %s/%s failed on interface %s, index=%lu, status=%lu (windows error: '%s') -- %s, xrefs: 00007FF6D3B0C3D5
ERROR: --dev tun also requires --ifconfig, xrefs: 00007FF6D3B0C738
Successful ARP Flush on interface [%lu] %s, xrefs: 00007FF6D3B0BE04
Failed to register ring buffers, xrefs: 00007FF6D3B0C67F
ERROR: unable to get adapter index for interface %s -- %s, xrefs: 00007FF6D3B0C01A
Register ring buffers, xrefs: 00007FF6D3B0C4D4
TUN, xrefs: 00007FF6D3B0BD54
ovpn-dco, xrefs: 00007FF6D3B0D1A6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: htonl$freemalloc$Fileinet_ntoa$AddressFlushReadTableWrite_exit
String ID: %02x$%s%s%s$.tap$Adapter %s is already in use$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tun.c$CreateFile failed on %s device: %s$DHCP option string not set due to error$DHCP option string: %s$ERROR: Wintun requires SYSTEM privileges and therefore should be used with interactive service. If you want to use openvpn from command line, you need to do SYSTEM elevation yourself (for example with psexec).$ERROR: --dev tun also requires --ifconfig$ERROR: AddIPAddress %s/%s failed on interface %s, index=%lu, status=%lu (windows error: '%s') -- %s$ERROR: The TAP-Windows driver rejected a DeviceIoControl call to set Point-to-Point mode, which is required for --dev tun$ERROR: The TAP-Windows driver rejected a DeviceIoControl call to set TAP_WIN_IOCTL_CONFIG_DHCP_MASQ mode$ERROR: The TAP-Windows driver rejected a TAP_WIN_IOCTL_CONFIG_DHCP_SET_OPT DeviceIoControl call$ERROR: unable to get adapter index for interface %s -- %s$FAILED$Failed to register %s adapter ring buffers$Failed to register ring buffers$I am having trouble using the Windows 'IP helper API' to automatically set the IP address -- consider using other --ip-win32 methods (not 'ipapi')$NOTE: You have selected (explicitly or by default) '--ip-win32 ipapi', which has a better chance of working correctly if the TAP-Windows TCP/IP properties are set to 'Obtain an IP address automatically'$Notified TAP-Windows driver to set a DHCP IP/netmask of %s/%s on interface %s [DHCP-serv: %s, lease-time: %d]$Register ring buffers$Register ring buffers failed using service: %s [status=0x%x]$Ring buffers registered via service$SUCCEEDED$Set TAP-Windows TUN subnet mode network/local/netmask = %s/%s/%s [%s]$Set TAP-Windows TUN with fake IPv4 [%s]$Succeeded in adding a temporary IP/netmask of %s/%s to interface %s using the Win32 IP Helper API$Successful ARP Flush on interface [%lu] %s$TUN$Using device interface: %s$WARNING: You have selected '--ip-win32 dynamic', which will not work unless the TAP-Windows TCP/IP properties are set to 'Obtain an IP address automatically'$\\.\Global\$ep[3] > 0$ovpn-dco$tap-windows6$tt->type == DEV_TYPE_TAP$unspecified$wintun
API String ID: 3908182678-2654160778
Opcode ID: 604c5edc02341e383df48ed9fdb2a8e50ed2ea4648dd6dcb13bc3f4685389dcc
Instruction ID: 0318108935dcf8b29887c85b55c90c1c84834512d30be64557b8e0c57712c39b
Opcode Fuzzy Hash: 604c5edc02341e383df48ed9fdb2a8e50ed2ea4648dd6dcb13bc3f4685389dcc
Instruction Fuzzy Hash: 1E02A332E0AB8285EB10CF65D4422BDB7A0FB9A784F140236DACDA7695DF7CE564C700

Function 00007FF6D3B07400 Relevance: 64.9, APIs: 21, Strings: 16, Instructions: 181COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B07484
htonl.WS2_32 ref: 00007FF6D3B074B7
inet_ntoa.WS2_32 ref: 00007FF6D3B074BF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B07502
htonl.WS2_32 ref: 00007FF6D3B07533
inet_ntoa.WS2_32 ref: 00007FF6D3B0753B
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B0758A

Part of subcall function 00007FF6D3A83310: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83319
Part of subcall function 00007FF6D3A83310: fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83329
Part of subcall function 00007FF6D3A83310: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A83333

printf.MSPDB140-MSVCRT ref: 00007FF6D3B075C8

Part of subcall function 00007FF6D3A75580: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,?,00007FF6D3A7C7B0), ref: 00007FF6D3A755A8
Part of subcall function 00007FF6D3A75580: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,?,00007FF6D3A7C7B0), ref: 00007FF6D3A755C7

printf.MSPDB140-MSVCRT ref: 00007FF6D3B075D4
printf.MSPDB140-MSVCRT ref: 00007FF6D3B075E0
printf.MSPDB140-MSVCRT ref: 00007FF6D3B075EC
printf.MSPDB140-MSVCRT ref: 00007FF6D3B075F8
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07604
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07610
printf.MSPDB140-MSVCRT ref: 00007FF6D3B0761C
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07628
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07634
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07640
printf.MSPDB140-MSVCRT ref: 00007FF6D3B0765D
printf.MSPDB140-MSVCRT ref: 00007FF6D3B07672
printf.MSPDB140-MSVCRT ref: 00007FF6D3B0768B

Strings

As an example, the following option would be correct:, xrefs: 00007FF6D3B07615
subnet. The following list shows examples of endpoint, xrefs: 00007FF6D3B075F1
because [5,6] is part of the below list., xrefs: 00007FF6D3B07639
remote endpoints must be part of the same 255.255.255.252, xrefs: 00007FF6D3B075E5
imposed by this approach is that the --ifconfig local and, xrefs: 00007FF6D3B075D9
There is a problem in your selection of --ifconfig endpoints [local=%s, remote=%s]. The local and remote VPN endpoints %s. Try 'openvpn --show-valid-subnets' option for more info., xrefs: 00007FF6D3B07574
--ifconfig 10.7.0.5 10.7.0.6 (on host A), xrefs: 00007FF6D3B07621
must be different, xrefs: 00007FF6D3B07415
--ifconfig 10.7.0.6 10.7.0.5 (on host B), xrefs: 00007FF6D3B0762D
must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver, xrefs: 00007FF6D3B07429
pairs which satisfy this requirement. Only the final, xrefs: 00007FF6D3B075FD
[%3d,%3d] , xrefs: 00007FF6D3B07656
is emulated by the TAP-Windows driver. The major limitation, xrefs: 00007FF6D3B075CD
component of the IP address pairs is at issue., xrefs: 00007FF6D3B07609
cannot use the first or last address within a given 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver, xrefs: 00007FF6D3B0744E
On Windows, point-to-point IP support (i.e. --dev tun), xrefs: 00007FF6D3B075BF

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: printf$__acrt_iob_funchtonlinet_ntoamalloc$__stdio_common_vfprintf_exitexitfprintf
String ID: --ifconfig 10.7.0.5 10.7.0.6 (on host A)$ --ifconfig 10.7.0.6 10.7.0.5 (on host B)$As an example, the following option would be correct:$On Windows, point-to-point IP support (i.e. --dev tun)$There is a problem in your selection of --ifconfig endpoints [local=%s, remote=%s]. The local and remote VPN endpoints %s. Try 'openvpn --show-valid-subnets' option for more info.$[%3d,%3d] $because [5,6] is part of the below list.$cannot use the first or last address within a given 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver$component of the IP address pairs is at issue.$imposed by this approach is that the --ifconfig local and$is emulated by the TAP-Windows driver. The major limitation$must be different$must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver$pairs which satisfy this requirement. Only the final$remote endpoints must be part of the same 255.255.255.252$subnet. The following list shows examples of endpoint
API String ID: 2945620666-3734294087
Opcode ID: df0c1468a43f14069af28afbceb465faf2f01f358c2680085dc89d864996bb2f
Instruction ID: 4a63fe68d33a5cf24a2de620a9ec04ae0f4f391f53c130f84fc7ff0fee33695f
Opcode Fuzzy Hash: df0c1468a43f14069af28afbceb465faf2f01f358c2680085dc89d864996bb2f
Instruction Fuzzy Hash: E8719021F1AA4285FB14DB64D8931BCE761FF66344F880437DA8DA26A9EF3CE565C300

Function 00007FF6D3B0E060 Relevance: 64.9, APIs: 4, Strings: 33, Instructions: 119COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0E131
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B0E190
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0E1D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0E204

Strings

All %s adapters on this system are currently in use or disabled., xrefs: 00007FF6D3B0DB95
tap-windows6, xrefs: 00007FF6D3B0D6E4, 00007FF6D3B0D76A, 00007FF6D3B0DA1A, 00007FF6D3B0DB8E, 00007FF6D3B0E0CF
%s%s interface ip set address %lu dhcp, xrefs: 00007FF6D3B0DE2D
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3B0E045
There are no TAP-Windows, Wintun or ovpn-dco adapters on this system. You should be able to create an adapter by using tapctl.exe utility., xrefs: 00007FF6D3B0D433
(DEBUG), xrefs: 00007FF6D3B0DC82
device_number >= 0, xrefs: 00007FF6D3B0DBB8
ERROR: command failed, xrefs: 00007FF6D3B0DE61
NOTE: could not get adapter index for %s, xrefs: 00007FF6D3B0DB41
WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will not work. Upgrade your Tap-Win32 driver., xrefs: 00007FF6D3B0DCED
Unknown virtual device type: '%s', xrefs: 00007FF6D3B0E17A
WARNING: The TAP-Windows driver rejected a TAP_WIN_IOCTL_SET_MEDIA_STATUS DeviceIoControl call., xrefs: 00007FF6D3B0DF86
ERROR: Tap-Win32 driver version %d.%d is buggy regarding small IPv4 packets in TUN mode. Upgrade your Tap-Win32 driver., xrefs: 00007FF6D3B0DD29
Some --dhcp-option or --dns options require DHCP server, which is not supported by the selected %s driver. They will be ignored., xrefs: 00007FF6D3B0E0D6
Sleeping for %d seconds..., xrefs: 00007FF6D3B0DFBB
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tun.c, xrefs: 00007FF6D3B0DBC4
ERROR: This version of OpenVPN requires a TAP-Windows driver that is at least version %d.%d -- If you recently upgraded your OpenVPN distribution, a reboot is probably required at this point to get Windows to see the new driver., xrefs: 00007FF6D3B0E019
NETSH, xrefs: 00007FF6D3B0DE4C, 00007FF6D3B0DEA8
win_sys_path, xrefs: 00007FF6D3B0E039
wintun, xrefs: 00007FF6D3B0D6DB, 00007FF6D3B0D761, 00007FF6D3B0DA11, 00007FF6D3B0DB85, 00007FF6D3B0E0C6
\system32\netsh.exe, xrefs: 00007FF6D3B0DE22
\DEVICE\TCPIP_%hs, xrefs: 00007FF6D3B0DA3C
Adapter '%s' is using %s driver, %s expected. If you want to use this device, adjust --windows-driver., xrefs: 00007FF6D3B0D6F7
Failed to open %s adapter: %s, xrefs: 00007FF6D3B0D774
unspecified, xrefs: 00007FF6D3B0D6C9, 00007FF6D3B0D74F, 00007FF6D3B0D979, 00007FF6D3B0D9FF, 00007FF6D3B0E0B4
TAP-Windows Driver Version %d.%d %s, xrefs: 00007FF6D3B0DC98
%s: command failed, xrefs: 00007FF6D3B0DEAF
%s device [%s] opened, xrefs: 00007FF6D3B0DA28
open_tun, xrefs: 00007FF6D3B0E114
TAP-Windows MTU=%d, xrefs: 00007FF6D3B0DD97
null, xrefs: 00007FF6D3B0E143
Adapter '%s' not found, xrefs: 00007FF6D3B0D68C
ovpn-dco, xrefs: 00007FF6D3B0D6D2, 00007FF6D3B0D758, 00007FF6D3B0DA08, 00007FF6D3B0DB7C, 00007FF6D3B0E0BD

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$_exitcalloc
String ID: %s device [%s] opened$%s%s interface ip set address %lu dhcp$%s: command failed$(DEBUG)$Adapter '%s' is using %s driver, %s expected. If you want to use this device, adjust --windows-driver.$Adapter '%s' not found$All %s adapters on this system are currently in use or disabled.$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tun.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$ERROR: Tap-Win32 driver version %d.%d is buggy regarding small IPv4 packets in TUN mode. Upgrade your Tap-Win32 driver.$ERROR: This version of OpenVPN requires a TAP-Windows driver that is at least version %d.%d -- If you recently upgraded your OpenVPN distribution, a reboot is probably required at this point to get Windows to see the new driver.$ERROR: command failed$Failed to open %s adapter: %s$NETSH$NOTE: could not get adapter index for %s$Sleeping for %d seconds...$Some --dhcp-option or --dns options require DHCP server, which is not supported by the selected %s driver. They will be ignored.$TAP-Windows Driver Version %d.%d %s$TAP-Windows MTU=%d$There are no TAP-Windows, Wintun or ovpn-dco adapters on this system. You should be able to create an adapter by using tapctl.exe utility.$Unknown virtual device type: '%s'$WARNING: Tap-Win32 driver version %d.%d does not support IPv6 in TUN mode. IPv6 will not work. Upgrade your Tap-Win32 driver.$WARNING: The TAP-Windows driver rejected a TAP_WIN_IOCTL_SET_MEDIA_STATUS DeviceIoControl call.$\DEVICE\TCPIP_%hs$\system32\netsh.exe$device_number >= 0$null$open_tun$ovpn-dco$tap-windows6$unspecified$win_sys_path$wintun
API String ID: 1149598282-1342652516
Opcode ID: 1194d315558a40a4b633e7a5d27ab28d27d955a5cc1992e76dd99b28db390ec9
Instruction ID: 1c720a5813bd5b1749e8ccba44ae4cab8057b8bc24f932a6837d410a22ce4328
Opcode Fuzzy Hash: 1194d315558a40a4b633e7a5d27ab28d27d955a5cc1992e76dd99b28db390ec9
Instruction Fuzzy Hash: C4517F35A0AA8281FA689B11D6563BCE391AF677C4F4C0037DA8EA7795DF3DE460C201

Function 00007FF6D3A9F8E0 Relevance: 63.4, APIs: 9, Strings: 27, Instructions: 396COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,buf_inc_len(&ret, (int)read_size),00000000,?,rand_bytes(output, len),?,00007FF6D3AA2767), ref: 00007FF6D3A9F965
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,buf_inc_len(&ret, (int)read_size),00000000,?,rand_bytes(output, len),?,00007FF6D3AA2767), ref: 00007FF6D3A9F9BA
SetEvent.KERNEL32 ref: 00007FF6D3A9FB13
ResetEvent.KERNEL32 ref: 00007FF6D3A9FB1B
SetEvent.KERNEL32 ref: 00007FF6D3A9FCF3
memcpy.VCRUNTIME140 ref: 00007FF6D3A9FEA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9FEC7

Part of subcall function 00007FF6D3B14370: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D3B143BE), ref: 00007FF6D3B1438B

ResetEvent.KERNEL32 ref: 00007FF6D3A9FCFB

Part of subcall function 00007FF6D3A9F2F0: WSAEnumNetworkEvents.WS2_32 ref: 00007FF6D3A9F330
Part of subcall function 00007FF6D3A9F2F0: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A9F35E

memset.VCRUNTIME140 ref: 00007FF6D3A9FE80

Strings

buf_inc_len(&ret, (int)read_size), xrefs: 00007FF6D3A9F8E5
pk-sign, xrefs: 00007FF6D3AA0694
PK_SIGN, xrefs: 00007FF6D3AA06CE
username/password, xrefs: 00007FF6D3A9FA13
confirmation, xrefs: 00007FF6D3A9F9D1
SUCCESS: %s command succeeded, xrefs: 00007FF6D3AA04E6
Need password(s) from management interface, waiting..., xrefs: 00007FF6D3A9FAAE
SC:%d,%s, xrefs: 00007FF6D3A9FA61
Need information from management interface, waiting..., xrefs: 00007FF6D3AA0132
Need hold release from management interface, waiting..., xrefs: 00007FF6D3AA0CBF
>%s:%s, xrefs: 00007FF6D3AA0063
rand_bytes(output, len), xrefs: 00007FF6D3A9F8E2
RSA_SIGN, xrefs: 00007FF6D3AA06A8
>%s:Need '%s' %s, xrefs: 00007FF6D3A9FA2C
rsa-sign, xrefs: 00007FF6D3AA06BD
NEED-STR, xrefs: 00007FF6D3A9F9E5
MSG:%s, xrefs: 00007FF6D3A9FA49
PASSWORD, xrefs: 00007FF6D3A9F9F5
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3A9FF0B, 00007FF6D3A9FF2A, 00007FF6D3A9FF43, 00007FF6D3AA05B4, 00007FF6D3AA05CD, 00007FF6D3AA05E6
man_standalone_ok(man), xrefs: 00007FF6D3A9FF1E, 00007FF6D3AA05A8, 00007FF6D3AA060C, 00007FF6D3AA0BF3
NEED-OK, xrefs: 00007FF6D3A9F9CA
[[BLANK]], xrefs: 00007FF6D3A9FE3E
>%s, xrefs: 00007FF6D3AA00DC
certificate, xrefs: 00007FF6D3AA0ABF
string, xrefs: 00007FF6D3A9F9EC
password, xrefs: 00007FF6D3A9FA07
Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write, xrefs: 00007FF6D3A9FB33, 00007FF6D3A9FD13, 00007FF6D3AA01B6, 00007FF6D3AA0398, 00007FF6D3AA0D45

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Event$Resetmemset$EnumEventsNetworkObjectSingleWait_exitfreemallocmemcpy
String ID: MSG:%s$ SC:%d,%s$>%s$>%s:%s$>%s:Need '%s' %s$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$NEED-OK$NEED-STR$Need hold release from management interface, waiting...$Need information from management interface, waiting...$Need password(s) from management interface, waiting...$PASSWORD$PK_SIGN$RSA_SIGN$SUCCESS: %s command succeeded$Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write$[[BLANK]]$buf_inc_len(&ret, (int)read_size)$certificate$confirmation$man_standalone_ok(man)$password$pk-sign$rand_bytes(output, len)$rsa-sign$string$username/password
API String ID: 3810465939-1946045651
Opcode ID: bc92622e5fe118b8c23c6cf0a2fa1997a3e8bc8d0173ad730354a53e997ced13
Instruction ID: 13fb1febe3b2a39bde1248053f4b4c5d39d4c16185483e5cab5e21bbb45a38e2
Opcode Fuzzy Hash: bc92622e5fe118b8c23c6cf0a2fa1997a3e8bc8d0173ad730354a53e997ced13
Instruction Fuzzy Hash: B0128A32B096828AFB189F61D5563FCA3A0FB25749F880037CA4DB7695DF2DA535C390

Function 00007FF6D3AED520 Relevance: 58.0, APIs: 25, Strings: 8, Instructions: 281COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71017
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A71037
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A71040
Part of subcall function 00007FF6D3A71000: _time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3A710C2
Part of subcall function 00007FF6D3A71000: GetTickCount.KERNEL32 ref: 00007FF6D3A710CB

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED55D
SSL_new.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED582
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED5C3
SSL_set_ex_data.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED5D6
BIO_f_ssl.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED5DC
BIO_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED5E5
BIO_s_mem.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED5F8
BIO_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED601
BIO_s_mem.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED614
BIO_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED61D
SSL_set_accept_state.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED638
SSL_set_connect_state.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED640
SSL_set_bio.LIBSSL-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED651
BIO_ctrl.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,00007FF6D3AEDE77), ref: 00007FF6D3AED665
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED6AF
memset.VCRUNTIME140 ref: 00007FF6D3AED6D0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED6DA
memset.VCRUNTIME140 ref: 00007FF6D3AED6FB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED705
memset.VCRUNTIME140 ref: 00007FF6D3AED726
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED730
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED758
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED794
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED7D7
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AED83A

Strings

(ks_ssl->ssl_bio = BIO_new(BIO_f_ssl())), xrefs: 00007FF6D3AED9B5
SSL_new failed, xrefs: 00007FF6D3AED5AD
NULL != ssl_ctx, xrefs: 00007FF6D3AED983
SSL, xrefs: 00007FF6D3AED906
(ks_ssl->ct_out = BIO_new(BIO_s_mem())), xrefs: 00007FF6D3AED9E7
ks_ssl, xrefs: 00007FF6D3AED99C
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c, xrefs: 00007FF6D3AED98F, 00007FF6D3AED9A8, 00007FF6D3AED9C1, 00007FF6D3AED9DA, 00007FF6D3AED9F3
(ks_ssl->ct_in = BIO_new(BIO_s_mem())), xrefs: 00007FF6D3AED9CE

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memset$CountO_newTickcalloc$O_s_mem_time64$L_newL_set_accept_stateL_set_bioL_set_connect_stateL_set_ex_dataO_ctrlO_f_ssl_exit
String ID: (ks_ssl->ct_in = BIO_new(BIO_s_mem()))$(ks_ssl->ct_out = BIO_new(BIO_s_mem()))$(ks_ssl->ssl_bio = BIO_new(BIO_f_ssl()))$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c$NULL != ssl_ctx$SSL$SSL_new failed$ks_ssl
API String ID: 867739977-2320342599
Opcode ID: 6ae3cc5008533ea429a7b6deb9a284841f70acada3213dac2e63e7feb9f9c3bd
Instruction ID: 90e6478d9e4fe22e3613b544ec9b39d4d683235f3e3520562b1e49f9c5980e85
Opcode Fuzzy Hash: 6ae3cc5008533ea429a7b6deb9a284841f70acada3213dac2e63e7feb9f9c3bd
Instruction Fuzzy Hash: 89D18F32B0AB8286E759CF24D4412BDB3A1FB99B44F088136DA8DA7755EF3CE560C700

Function 00007FF6D3AD5800 Relevance: 51.0, APIs: 14, Strings: 15, Instructions: 226COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD5871
htonl.WS2_32 ref: 00007FF6D3AD58AB
inet_ntoa.WS2_32 ref: 00007FF6D3AD58B3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD58F6
htonl.WS2_32 ref: 00007FF6D3AD5934
inet_ntoa.WS2_32 ref: 00007FF6D3AD593C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD59D6
htonl.WS2_32 ref: 00007FF6D3AD5A10
inet_ntoa.WS2_32 ref: 00007FF6D3AD5A18
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD5A5B
htonl.WS2_32 ref: 00007FF6D3AD5A95
inet_ntoa.WS2_32 ref: 00007FF6D3AD5A9D
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AD5AF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD5B08

Strings

pool: IPv4 (%s) and IPv6 (%s) have different offsets! Relying on IPv4, xrefs: 00007FF6D3AD698D
ifconfig_pool_read(), in='%s', xrefs: 00007FF6D3AD65CA
@, xrefs: 00007FF6D3AD6237
--ifconfig-pool start IP [%s] is greater than end IP [%s], xrefs: 00007FF6D3AD5972
pool: IPv6 (%s) out of pool range for CN=%s, xrefs: 00007FF6D3AD695D
pool: invalid IPv4 (%s) for CN=%s, xrefs: 00007FF6D3AD67A8
@, xrefs: 00007FF6D3AD6876
pool: IPv4 (%s) out of pool range for CN=%s, xrefs: 00007FF6D3AD6791
%s,%s,%s, xrefs: 00007FF6D3AD62CB
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\pool.c, xrefs: 00007FF6D3AD636C, 00007FF6D3AD6BB6, 00007FF6D3AD6BCF
pool: invalid IPv6 (%s) for CN=%s, xrefs: 00007FF6D3AD68C5
@, xrefs: 00007FF6D3AD6128
buf_init(&in, 0), xrefs: 00007FF6D3AD6BC3
succeeded -> ifconfig_pool_set(hand=%d), xrefs: 00007FF6D3AD69D6
--ifconfig-pool address range is too large [%s -> %s]. Current maximum is %d addresses, as defined by IFCONFIG_POOL_MAX variable., xrefs: 00007FF6D3AD5AD9

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: htonlinet_ntoamalloc$_exitfree
String ID: %s,%s,%s$--ifconfig-pool address range is too large [%s -> %s]. Current maximum is %d addresses, as defined by IFCONFIG_POOL_MAX variable.$--ifconfig-pool start IP [%s] is greater than end IP [%s]$@$@$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\pool.c$buf_init(&in, 0)$ifconfig_pool_read(), in='%s'$pool: IPv4 (%s) and IPv6 (%s) have different offsets! Relying on IPv4$pool: IPv4 (%s) out of pool range for CN=%s$pool: IPv6 (%s) out of pool range for CN=%s$pool: invalid IPv4 (%s) for CN=%s$pool: invalid IPv6 (%s) for CN=%s$succeeded -> ifconfig_pool_set(hand=%d)
API String ID: 2635534324-923689359
Opcode ID: 154d702eb50b2afce556cbb564693237eed630efcc800d2d5dcad352e65c4461
Instruction ID: d20d3f0f0b2abd879d76d40f56e31903d39e1a2b039da1fb5b5a7bc7bff18d66
Opcode Fuzzy Hash: 154d702eb50b2afce556cbb564693237eed630efcc800d2d5dcad352e65c4461
Instruction Fuzzy Hash: 2791C222F09B428AFB158F64E4413BCA361EF59788F48443ADF4DB6789EF7CA5658340

Function 00007FF6D3B020C0 Relevance: 50.9, APIs: 5, Strings: 24, Instructions: 156COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B02133
memset.VCRUNTIME140 ref: 00007FF6D3B0217B
RAND_bytes.LIBCRYPTO-3-X64 ref: 00007FF6D3B02189

Strings

ERROR: could not write metadata to file, xrefs: 00007FF6D3B01C52
%s: failed to read tag, xrefs: 00007FF6D3B01887
tls_crypt_v2_unwrap_client_key(&test_client_key2, &test_metadata, test_wrapped_client_key, &server_key), xrefs: 00007FF6D3B028CA
cipher_ctx_final(cipher_ctx, BEND(&work), &outlen), xrefs: 00007FF6D3B00D9B
buf_inc_len(&metadata, decoded_len), xrefs: 00007FF6D3B02898
Can not read tls-crypt-v2 client key length, xrefs: 00007FF6D3B02062
reliable_ack_write (ks->rec_ack, ks->lru_acks, buf, &ks->session_id_remote, max_ack, prepend_ack), xrefs: 00007FF6D3B00608
buf_write(&metadata, &TLS_CRYPT_METADATA_TYPE_TIMESTAMP, 1), xrefs: 00007FF6D3B028FC
buf_write(&work, &net_len, sizeof(net_len)), xrefs: 00007FF6D3B00DB4
ERROR: no metadata type, xrefs: 00007FF6D3B01CC2
buf_write(&metadata, &TLS_CRYPT_METADATA_TYPE_USER, 1), xrefs: 00007FF6D3B028B1
buf_inc_len(&plaintext, outlen), xrefs: 00007FF6D3B01950, 00007FF6D3B01969
buf_inc_len(dst, outlen), xrefs: 00007FF6D3B00201, 00007FF6D3B0021A, 00007FF6D3B00603, 00007FF6D3B00E2B
%s: failed to read length, xrefs: 00007FF6D3B018A3
buf_inc_len(buf, -(BLEN(&wrapped_client_key))), xrefs: 00007FF6D3B02099, 00007FF6D3B02935
buf_inc_len(&work, outlen), xrefs: 00007FF6D3B00DCD, 00007FF6D3B00DE6, 00007FF6D3B00DFF
OpenVPN tls-crypt-v2 server key, xrefs: 00007FF6D3B00509
Can not locate tls-crypt-v2 client key, xrefs: 00007FF6D3B02042
tls_crypt_v2_metadata_, xrefs: 00007FF6D3B01A55
cipher_ctx_reset(cipher_ctx, tag), xrefs: 00007FF6D3B00D82
buf_write(&dst, client_key.keys, sizeof(client_key.keys)), xrefs: 00007FF6D3B02915
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tls_crypt.c, xrefs: 00007FF6D3B00159, 00007FF6D3B00172, 00007FF6D3B0018B, 00007FF6D3B001A4, 00007FF6D3B001DB, 00007FF6D3B001F4, 00007FF6D3B0020D, 00007FF6D3B00226, 00007FF6D3B00D8E, 00007FF6D3B00DA7, 00007FF6D3B00DC0, 00007FF6D3B00DD9, 00007FF6D3B00DF2, 00007FF6D3B00E0B, 00007FF6D3B01943, 00007FF6D3B0195C, 00007FF6D3B01975, 00007FF6D3B020A5, 00007FF6D3B028A4, 00007FF6D3B028BD, 00007FF6D3B028D6, 00007FF6D3B028EF, 00007FF6D3B02908, 00007FF6D3B02921
tls_crypt_v2_unwrap_client_key, xrefs: 00007FF6D3B01022, 00007FF6D3B01121, 00007FF6D3B01836, 00007FF6D3B018AA
buf_write(&metadata, &timestamp, sizeof(timestamp)), xrefs: 00007FF6D3B028E3

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: D_bytesmallocmemset
String ID: %s: failed to read length$%s: failed to read tag$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\tls_crypt.c$Can not locate tls-crypt-v2 client key$Can not read tls-crypt-v2 client key length$ERROR: could not write metadata to file$ERROR: no metadata type$OpenVPN tls-crypt-v2 server key$buf_inc_len(&metadata, decoded_len)$buf_inc_len(&plaintext, outlen)$buf_inc_len(&work, outlen)$buf_inc_len(buf, -(BLEN(&wrapped_client_key)))$buf_inc_len(dst, outlen)$buf_write(&dst, client_key.keys, sizeof(client_key.keys))$buf_write(&metadata, &TLS_CRYPT_METADATA_TYPE_TIMESTAMP, 1)$buf_write(&metadata, &TLS_CRYPT_METADATA_TYPE_USER, 1)$buf_write(&metadata, &timestamp, sizeof(timestamp))$buf_write(&work, &net_len, sizeof(net_len))$cipher_ctx_final(cipher_ctx, BEND(&work), &outlen)$cipher_ctx_reset(cipher_ctx, tag)$reliable_ack_write (ks->rec_ack, ks->lru_acks, buf, &ks->session_id_remote, max_ack, prepend_ack)$tls_crypt_v2_metadata_$tls_crypt_v2_unwrap_client_key$tls_crypt_v2_unwrap_client_key(&test_client_key2, &test_metadata, test_wrapped_client_key, &server_key)
API String ID: 3934451180-1528554916
Opcode ID: 28281e9dddb5d3ccd1d6e26cadaa78ed8b1aaf86a469be7b47d737f3814390b2
Instruction ID: 0ea8ed898bbf756c08bf828bb4f2f02a9b352b59668cb6deebc94772a8ab1de5
Opcode Fuzzy Hash: 28281e9dddb5d3ccd1d6e26cadaa78ed8b1aaf86a469be7b47d737f3814390b2
Instruction Fuzzy Hash: 2D71A426E1AB8586E300CF24D9452BDB360FBAA348F549136DB8D67656EF3CE5A4C300

Function 00007FF6D3AD20C0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 161COMMON

Download Yara Rule

APIs

pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD20FB
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD211B
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD212D
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD214D
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD2168
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD2188
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD21D6
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD21DE
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD21FE
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AD22EF
pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3AD230F

Strings

PKCS#11: pkcs11_initialize - entered, xrefs: 00007FF6D3AD20E3
PKCS#11: Cannot set hooks %ld-'%s', xrefs: 00007FF6D3AD218E, 00007FF6D3AD223F, 00007FF6D3AD2276
PKCS#11: Cannot set Pcache period %ld-'%s', xrefs: 00007FF6D3AD22D3
PKCS#11: Cannot set protected authentication mode %ld-'%s', xrefs: 00007FF6D3AD22A6
PKCS#11: Cannot set fork mode %ld-'%s', xrefs: 00007FF6D3AD2204
PKCS#11: Cannot initialize %ld-'%s', xrefs: 00007FF6D3AD2153
PKCS#11: pkcs11_initialize - return %ld-'%s', xrefs: 00007FF6D3AD2318
PKCS#11: Cannot initialize system engine %ld-'%s', xrefs: 00007FF6D3AD2121

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Any_expkcs11h_certificate_sign$_exit
String ID: PKCS#11: Cannot initialize %ld-'%s'$PKCS#11: Cannot initialize system engine %ld-'%s'$PKCS#11: Cannot set Pcache period %ld-'%s'$PKCS#11: Cannot set fork mode %ld-'%s'$PKCS#11: Cannot set hooks %ld-'%s'$PKCS#11: Cannot set protected authentication mode %ld-'%s'$PKCS#11: pkcs11_initialize - entered$PKCS#11: pkcs11_initialize - return %ld-'%s'
API String ID: 1701562497-2041442361
Opcode ID: dde52242e299306392b4896a17b697389e40ef2269dd809d6d453ab9d70c453c
Instruction ID: 5d46341ce266debf3e84e9f1564b462d9f51cb1fa8ad7471b898473136d209b9
Opcode Fuzzy Hash: dde52242e299306392b4896a17b697389e40ef2269dd809d6d453ab9d70c453c
Instruction Fuzzy Hash: 06613C34B0D64782FB5C5B60A86627C9352AF997C9F484037DD8EFA2D2EE5CE865D300

Function 00007FF6D3A81CC0 Relevance: 44.1, APIs: 7, Strings: 18, Instructions: 323COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A81D83
htonl.WS2_32 ref: 00007FF6D3A81DB7
inet_ntoa.WS2_32 ref: 00007FF6D3A81DBF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A81E1C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A81EBA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A82197

Strings

dnssec = %s, xrefs: 00007FF6D3A81FE5
%s, xrefs: 00007FF6D3A8216B
sni = %s, xrefs: 00007FF6D3A8208C
optional, xrefs: 00007FF6D3A81FCC
DoT, xrefs: 00007FF6D3A82038
%s, xrefs: 00007FF6D3A820ED
address = %s, xrefs: 00007FF6D3A81F5F
unset, xrefs: 00007FF6D3A81FC3, 00007FF6D3A8202F
DoH, xrefs: 00007FF6D3A82041
DNS search domains:, xrefs: 00007FF6D3A8213A
address = [%s]:%s, xrefs: 00007FF6D3A81E95
transport = %s, xrefs: 00007FF6D3A82051
yes, xrefs: 00007FF6D3A81FD5
plain, xrefs: 00007FF6D3A8204A
DNS server #%d:, xrefs: 00007FF6D3A81D3A
%hu, xrefs: 00007FF6D3A81ED8
address = %s:%s, xrefs: 00007FF6D3A81DEB, 00007FF6D3A81DFD
resolve domains:, xrefs: 00007FF6D3A820C1

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$freehtonlinet_ntoa
String ID: %s$ %s$ address = %s$ address = %s:%s$ address = [%s]:%s$ dnssec = %s$ resolve domains:$ sni = %s$ transport = %s$ DNS search domains:$ DNS server #%d:$%hu$DoH$DoT$optional$plain$unset$yes
API String ID: 2730236656-895546441
Opcode ID: c3ee3a3b2d9848beab5940d8c9a7b20e4caf0ea0b3466d4511e56c0654a5cf62
Instruction ID: 45183c4b3aa3256c8734703d6170519e4e1bfc86d7598c9355e218e83634dba1
Opcode Fuzzy Hash: c3ee3a3b2d9848beab5940d8c9a7b20e4caf0ea0b3466d4511e56c0654a5cf62
Instruction Fuzzy Hash: 00E19F35B0968289FA289F50D5067BDA3A2BF15788F4C4137CA4DBB296DF3CE865C340

Function 00007FF6D3A80D00 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 376stringnetworkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6D3A80D5D
htons.WS2_32 ref: 00007FF6D3A80D6F
htonl.WS2_32 ref: 00007FF6D3A80E78
memcpy.VCRUNTIME140 ref: 00007FF6D3A80EA4
memset.VCRUNTIME140 ref: 00007FF6D3A80EB4
htons.WS2_32 ref: 00007FF6D3A80EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A80F63
htonl.WS2_32 ref: 00007FF6D3A80F9D
inet_ntoa.WS2_32 ref: 00007FF6D3A80FA5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A80FF6
strchr.VCRUNTIME140 ref: 00007FF6D3A81088
strrchr.VCRUNTIME140 ref: 00007FF6D3A81099
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A810CA
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6D3A810E1
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A810EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A8112F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6D3A81147
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A81150
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A811A4
htonl.WS2_32 ref: 00007FF6D3A811FA
freeaddrinfo.WS2_32 ref: 00007FF6D3A81242

Strings

@, xrefs: 00007FF6D3A80F55
[, xrefs: 00007FF6D3A810AC
Extracted DHCP router address: %s, xrefs: 00007FF6D3A80FDB

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _errno$htonlhtons$strtoul$freefreeaddrinfoinet_ntoamallocmemcpymemsetstrchrstrncpystrrchr
String ID: @$Extracted DHCP router address: %s$[
API String ID: 2276591152-3936728288
Opcode ID: 2fc44ded3b16ad6db27e62fcee6bbdf3de91d672ec5eaa257c1550ea3b7240ba
Instruction ID: b48c2a8a6c016bc3e2f38964c77030372440198e1341e24b09257c2b79c92bc5
Opcode Fuzzy Hash: 2fc44ded3b16ad6db27e62fcee6bbdf3de91d672ec5eaa257c1550ea3b7240ba
Instruction Fuzzy Hash: B9F1F532B096D296EB688B14D4462BEF7A1FF56784F494136DA8DA3794EF3CE461C300

Function 00007FF6D3AF78E0 Relevance: 42.3, APIs: 12, Strings: 12, Instructions: 251COMMON

Download Yara Rule

APIs

BIO_write.LIBCRYPTO-3-X64 ref: 00007FF6D3AF791A
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7977
BIO_test_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AF792F

Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D3A7C6F5), ref: 00007FF6D3A7CF45
Part of subcall function 00007FF6D3A7CF10: ERR_error_string.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D01A
Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D0AE

ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3AF79CA
BIO_read.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7AB2
BIO_test_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7AC9
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7B14
EVP_MD_get_type.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7BE9
EVP_PKEY_is_a.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7BFC
EVP_PKEY_get_group_name.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7C19
EVP_PKEY_get0_type_name.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7C41
EVP_PKEY_get_bits.LIBCRYPTO-3-X64 ref: 00007FF6D3AF7C58

Strings

(error getting type), xrefs: 00007FF6D3AF7BCB
%d bits %s%s, xrefs: 00007FF6D3AF7C63
size >= 0, xrefs: 00007FF6D3AF7A25, 00007FF6D3AF7BA5
(error getting public key type), xrefs: 00007FF6D3AF7C4A
buf->len >= 0, xrefs: 00007FF6D3AF7B7B
BIO read %s %d bytes, xrefs: 00007FF6D3AF7B42
TLS_ERROR: BIO read %s error, xrefs: 00007FF6D3AF7AFB
BIO write %s %d bytes, xrefs: 00007FF6D3AF79EF
TLS ERROR: BIO write %s error, xrefs: 00007FF6D3AF7961
TLS ERROR: BIO write %s incomplete %d/%d, xrefs: 00007FF6D3AF79B4
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c, xrefs: 00007FF6D3AF7A31, 00007FF6D3AF7B87
(error getting curve name), xrefs: 00007FF6D3AF7C26

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_clear_error$O_test_flagsR_get_error_all$D_get_typeO_readO_writeR_error_stringY_get0_type_nameY_get_bitsY_get_group_nameY_is_a
String ID: %d bits %s%s$(error getting curve name)$(error getting public key type)$(error getting type)$BIO read %s %d bytes$BIO write %s %d bytes$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c$TLS ERROR: BIO write %s error$TLS ERROR: BIO write %s incomplete %d/%d$TLS_ERROR: BIO read %s error$buf->len >= 0$size >= 0
API String ID: 1898786375-3872497648
Opcode ID: 6f7af5c6db88070ce8c38aa76c3a5eaef490aa2031e1e66f9894eba5352499ca
Instruction ID: c2f906ba30e3e7357794c29f82e736de243780c4762069b7a0d283aea77e886a
Opcode Fuzzy Hash: 6f7af5c6db88070ce8c38aa76c3a5eaef490aa2031e1e66f9894eba5352499ca
Instruction Fuzzy Hash: FFA1E331B0964286F6189B11E8422BDE360FF9ABC4F484137EA8DE7796CF3DE5648740

Function 00007FF6D3A80880 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 180stringCOMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A80954
EVP_CIPHER_get_key_length.LIBCRYPTO-3-X64 ref: 00007FF6D3A80960
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A8096C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A809B2
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A809CD
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A809E0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A809F3
memcpy.VCRUNTIME140 ref: 00007FF6D3A80A5E
memcpy.VCRUNTIME140 ref: 00007FF6D3A80A8A
DeviceIoControl.KERNEL32 ref: 00007FF6D3A80AE7
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A80B15

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco_win.c, xrefs: 00007FF6D3A80B66
dco_new_key, xrefs: 00007FF6D3A80903
AES-128-GCM, xrefs: 00007FF6D3A809C3
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A80B4D
crypto_data.CipherAlg > 0, xrefs: 00007FF6D3A80B5A
ciphername, xrefs: 00007FF6D3A80B41
AES-256-GCM, xrefs: 00007FF6D3A80975
CHACHA20-POLY1305, xrefs: 00007FF6D3A809E9
%s: slot %d, key-id %d, peer-id %d, cipher %s, xrefs: 00007FF6D3A8090E
DCO: provided unsupported cipher: %s, xrefs: 00007FF6D3A80A18
AES-192-GCM, xrefs: 00007FF6D3A809D6
DeviceIoControl(OVPN_IOCTL_NEW_KEY) failed, xrefs: 00007FF6D3A80AFF

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: strcmp$_exitmemcpy$ControlDeviceR_fetchR_freeR_get_key_length
String ID: %s: slot %d, key-id %d, peer-id %d, cipher %s$AES-128-GCM$AES-192-GCM$AES-256-GCM$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\dco_win.c$CHACHA20-POLY1305$DCO: provided unsupported cipher: %s$DeviceIoControl(OVPN_IOCTL_NEW_KEY) failed$ciphername$crypto_data.CipherAlg > 0$dco_new_key
API String ID: 3389766186-522471507
Opcode ID: 622622f20ed82f8a2ed51833332abc861bb1b25190db24bfad7429967bf5b5a4
Instruction ID: b800a3dac982dcdfcdcdcf16337f04c5bee4d045201c0fa5fc2ebaa96168ebcb
Opcode Fuzzy Hash: 622622f20ed82f8a2ed51833332abc861bb1b25190db24bfad7429967bf5b5a4
Instruction Fuzzy Hash: 7A716D36A0D7C285EA64DB15A8023BEE3A1FB99784F484136DA8DA7B55DF3CD065C700

Function 00007FF6D3B0E820 Relevance: 38.6, APIs: 11, Strings: 11, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CancelIo.KERNEL32 ref: 00007FF6D3B0E8A1
CloseHandle.KERNEL32 ref: 00007FF6D3B0E904
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0E934
CloseHandle.KERNEL32 ref: 00007FF6D3B0E984
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0E9B4
CloseHandle.KERNEL32 ref: 00007FF6D3B0EA08
CloseHandle.KERNEL32 ref: 00007FF6D3B0EA54
CloseHandle.KERNEL32 ref: 00007FF6D3B0EA61
UnmapViewOfFile.KERNEL32 ref: 00007FF6D3B0EA6E
UnmapViewOfFile.KERNEL32 ref: 00007FF6D3B0EA7B
CloseHandle.KERNEL32 ref: 00007FF6D3B0EA88

Strings

tap-windows6, xrefs: 00007FF6D3B0E85E
Attempting close of overlapped read event on %s adapter, xrefs: 00007FF6D3B0E8E7
Attempting CancelIO on %s adapter, xrefs: 00007FF6D3B0E889
wintun, xrefs: 00007FF6D3B0E855
Warning: CloseHandle failed on overlapped I/O event object, xrefs: 00007FF6D3B0E91C, 00007FF6D3B0E99C
Warning: CancelIO failed on %s adapter, xrefs: 00007FF6D3B0E8BC
Warning: CloseHandle failed on %s adapter, xrefs: 00007FF6D3B0EA23
unspecified, xrefs: 00007FF6D3B0E843
Attempting CloseHandle on %s adapter, xrefs: 00007FF6D3B0E9F0
Attempting close of overlapped write event on %s adapter, xrefs: 00007FF6D3B0E967
ovpn-dco, xrefs: 00007FF6D3B0E84C

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: CloseHandle$FileUnmapViewfree$Cancel
String ID: Attempting CancelIO on %s adapter$Attempting CloseHandle on %s adapter$Attempting close of overlapped read event on %s adapter$Attempting close of overlapped write event on %s adapter$Warning: CancelIO failed on %s adapter$Warning: CloseHandle failed on %s adapter$Warning: CloseHandle failed on overlapped I/O event object$ovpn-dco$tap-windows6$unspecified$wintun
API String ID: 2372062577-3847859075
Opcode ID: 02c851123909b747ebf2581ccf9ea455bb02ae87896b604a53d454477ab177e0
Instruction ID: c72146a54de08b415490ea1e8b3a00cd5b2e4b3bf37f4f2f8c89ade868ac0d5c
Opcode Fuzzy Hash: 02c851123909b747ebf2581ccf9ea455bb02ae87896b604a53d454477ab177e0
Instruction Fuzzy Hash: F2614031A0EA4281FB549B62E55A2BC9351AF67BC8F4C0037C9CDFA295DF2CA464C350

Function 00007FF6D3A82D10 Relevance: 37.1, APIs: 12, Strings: 9, Instructions: 329stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6D3A82D65
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A82D76
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A82DC5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A82DE3
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A82E35
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A82E6C
fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A82FF9
fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83053
fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A8308D

Part of subcall function 00007FF6D3A82BE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00000801,00007FF6D3A8332E), ref: 00007FF6D3A82C17

fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83095
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A830C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A830F4

Strings

Options error: %s, xrefs: 00007FF6D3A82EA1
%s%s%s, xrefs: 00007FF6D3A82F11
%d variation(s) on previous %d message(s) suppressed by --mute, xrefs: 00007FF6D3A83253
%s %s%s%s%s, xrefs: 00007FF6D3A8303C
NOTE: --mute triggered..., xrefs: 00007FF6D3A831F0
%s: %s (errno=%d), xrefs: 00007FF6D3A82E76
%s%s%s%s, xrefs: 00007FF6D3A83081
Exiting due to fatal error, xrefs: 00007FF6D3A83170
%lli.%06ld %x %s%s%s%s, xrefs: 00007FF6D3A82FD2

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: fprintf$freemalloc$ErrorLast__stdio_common_vfprintf__stdio_common_vsprintf_errnofflushstrerror
String ID: %d variation(s) on previous %d message(s) suppressed by --mute$%lli.%06ld %x %s%s%s%s$%s %s%s%s%s$%s%s%s$%s%s%s%s$%s: %s (errno=%d)$Exiting due to fatal error$NOTE: --mute triggered...$Options error: %s
API String ID: 2823709519-693231598
Opcode ID: aac27f8f85629e8160903a391073dd32c1392fba12c743ca6ed6b689570057e6
Instruction ID: 959a6678c53ba765d10c374d8f5f57d2fa82d29dc097f45063bc07cdc02a592e
Opcode Fuzzy Hash: aac27f8f85629e8160903a391073dd32c1392fba12c743ca6ed6b689570057e6
Instruction Fuzzy Hash: F8E18E39B0AB8286FA689B11A84227DF7A0FF55780F484437D98CA7796DF3CE4648740

Function 00007FF6D3AEDC30 Relevance: 37.1, APIs: 9, Strings: 12, Instructions: 323COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,0000009A,00007FF6D3A95860), ref: 00007FF6D3AEDC99
RAND_bytes.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,00000000,?,0000009A,00007FF6D3A95860), ref: 00007FF6D3AEDCC9
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,0000009A,00007FF6D3A95860), ref: 00007FF6D3AEDDBD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,0000009A,00007FF6D3A95860), ref: 00007FF6D3AEDED6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,0000009A,00007FF6D3A95860), ref: 00007FF6D3AEDF04

Part of subcall function 00007FF6D3A72610: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A72640
Part of subcall function 00007FF6D3A72610: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A72690

Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D3A7C6F5), ref: 00007FF6D3A7CF45
Part of subcall function 00007FF6D3A7CF10: ERR_error_string.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D01A
Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D0AE

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D3AEE07E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D3AEE0A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D3AEE0B6
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D3AEE0D6

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c, xrefs: 00007FF6D3AEDF82
TLS: move_session: dest=%s src=%s reinit_src=%d, xrefs: 00007FF6D3AEDFEA
rand_bytes(output, len), xrefs: 00007FF6D3AEDF76
src >= 0 && src < TM_SIZE, xrefs: 00007FF6D3AEE133
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AEE13F, 00007FF6D3AEE158, 00007FF6D3AEE171
dest >= 0 && dest < TM_SIZE, xrefs: 00007FF6D3AEE165
TLS: tls_session_init: entry, xrefs: 00007FF6D3AEDC7C
TLS: move_session: exit, xrefs: 00007FF6D3AEE111
src != dest, xrefs: 00007FF6D3AEE14C
TLS_WRAP, xrefs: 00007FF6D3AEDDD4
TLS: tls_session_init: new session object, sid=%s, xrefs: 00007FF6D3AEDEAA
RAND_bytes() failed, xrefs: 00007FF6D3AEDF65

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$R_get_error_all$D_bytesR_error_string_exitcallocmallocmemcpymemset
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$RAND_bytes() failed$TLS: move_session: dest=%s src=%s reinit_src=%d$TLS: move_session: exit$TLS: tls_session_init: entry$TLS: tls_session_init: new session object, sid=%s$TLS_WRAP$dest >= 0 && dest < TM_SIZE$rand_bytes(output, len)$src != dest$src >= 0 && src < TM_SIZE
API String ID: 3536067934-2650966742
Opcode ID: 4815846f2b0cd161e1fa07040755a89c7ce0a74e137a2fc791ceace91797d81f
Instruction ID: fadee416b06a6d99477a802933f1463a3e0605a978522a94233a98dfb1851001
Opcode Fuzzy Hash: 4815846f2b0cd161e1fa07040755a89c7ce0a74e137a2fc791ceace91797d81f
Instruction Fuzzy Hash: 51E1A366B0AB8286EA14DB14D4562BDB361FB95B84F484137DE8DB7796DF38E4A0C300

Function 00007FF6D3ADD460 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 299stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ADD4E4
htonl.WS2_32 ref: 00007FF6D3ADD5CD
inet_ntoa.WS2_32 ref: 00007FF6D3ADD5D7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ADD6FE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ADD751
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ADD7AA
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF6D3ADD841

Strings

OpenVPN ROUTE: failed to parse/resolve route for host/network: %s, xrefs: 00007FF6D3ADD8AC
OpenVPN ROUTE: vpn_gateway undefined, xrefs: 00007FF6D3ADD523, 00007FF6D3ADD72F
OpenVPN ROUTE: remote_host undefined, xrefs: 00007FF6D3ADD5B0, 00007FF6D3ADD7E9
default, xrefs: 00007FF6D3ADD4B2
vpn_gateway, xrefs: 00007FF6D3ADD4DA, 00007FF6D3ADD6F4
OpenVPN ROUTE: route metric for network %s (%s) must be >= 0, xrefs: 00007FF6D3ADD864
remote_host, xrefs: 00007FF6D3ADD576, 00007FF6D3ADD7A0
@, xrefs: 00007FF6D3ADD7FE
OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options, xrefs: 00007FF6D3ADD889
net_gateway, xrefs: 00007FF6D3ADD52F, 00007FF6D3ADD747
OpenVPN ROUTE: net_gateway undefined -- unable to get default gateway from system, xrefs: 00007FF6D3ADD56D, 00007FF6D3ADD788

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: strcmp$atoihtonlinet_ntoa
String ID: @$OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options$OpenVPN ROUTE: failed to parse/resolve route for host/network: %s$OpenVPN ROUTE: net_gateway undefined -- unable to get default gateway from system$OpenVPN ROUTE: remote_host undefined$OpenVPN ROUTE: route metric for network %s (%s) must be >= 0$OpenVPN ROUTE: vpn_gateway undefined$default$net_gateway$remote_host$vpn_gateway
API String ID: 1180672172-3708273783
Opcode ID: f7e7a24e9030cd5283bc8c2c9d7f9358f3ca78fcf43521248b2fafb31b21dc98
Instruction ID: fa0c82c30d64caf9b1984443a746163858b735cf92fbafdb81794bf05749d431
Opcode Fuzzy Hash: f7e7a24e9030cd5283bc8c2c9d7f9358f3ca78fcf43521248b2fafb31b21dc98
Instruction Fuzzy Hash: 63D1C771B0A64285FA6D9B10A5062BCF7A5EF96348F484037DE8DF66D6EF3CE4618700

Function 00007FF6D3B02930 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3B02A32
htonl.WS2_32 ref: 00007FF6D3B02A52
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B02ACF
htonl.WS2_32 ref: 00007FF6D3B02B0B
inet_ntoa.WS2_32 ref: 00007FF6D3B02B13
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B02D09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B02D34

Strings

deleting, xrefs: 00007FF6D3B02CBD
TUN: %s address failed using service: %s [status=%u if_index=%d], xrefs: 00007FF6D3B02CCE
adding, xrefs: 00007FF6D3B02CC4
buf_inc_len(buf, -(BLEN(&wrapped_client_key))), xrefs: 00007FF6D3B02099, 00007FF6D3B02935
@, xrefs: 00007FF6D3B02AC2
INET address service: %s %s/%d, xrefs: 00007FF6D3B02B42, 00007FF6D3B02B54
remove, xrefs: 00007FF6D3B02C59
INET6 address service: %s %s/%d, xrefs: 00007FF6D3B02C48
TUN, xrefs: 00007FF6D3B02C75
add, xrefs: 00007FF6D3B02C4F
@, xrefs: 00007FF6D3B02BAD

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freehtonl$inet_ntoamallocstrncpy
String ID: @$@$INET address service: %s %s/%d$INET6 address service: %s %s/%d$TUN$TUN: %s address failed using service: %s [status=%u if_index=%d]$add$adding$buf_inc_len(buf, -(BLEN(&wrapped_client_key)))$deleting$remove
API String ID: 2718989945-3868035222
Opcode ID: b127867b6132f837a40827822edbe4b11d7b9e6828f2b67a289d1045206c4132
Instruction ID: 154cd227c2c1baf2482d1bdbab258f8690be531479b87fa4f0e8a2481c0440d8
Opcode Fuzzy Hash: b127867b6132f837a40827822edbe4b11d7b9e6828f2b67a289d1045206c4132
Instruction Fuzzy Hash: 37C19432E05B818AE720CF65D9422BCB3A0FB6A798F141236DECDABA55DF3C9555C700

Function 00007FF6D3AE37F0 Relevance: 35.2, APIs: 5, Strings: 15, Instructions: 157COMMON

Download Yara Rule

APIs

_lseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,0000027C,00007FF6D3AE3E7F), ref: 00007FF6D3AE382E

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

_lseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,0000027C,00007FF6D3AE3E7F), ref: 00007FF6D3AE39A7
_chsize.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,0000027C,00007FF6D3AE3E7F), ref: 00007FF6D3AE39B2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00000000,0000027C,00007FF6D3AE3E7F), ref: 00007FF6D3AE39DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00000000,0000027C,00007FF6D3AE3E7F), ref: 00007FF6D3AE3A06

Strings

TUN/TAP read bytes,%llu, xrefs: 00007FF6D3AE387E
buf_init(&so->read_buf, 0), xrefs: 00007FF6D3AE3A2E
TCP/UDP read bytes,%llu, xrefs: 00007FF6D3AE38AA
Updated,%s, xrefs: 00007FF6D3AE3868
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\status.c, xrefs: 00007FF6D3AE3A3A
OpenVPN STATISTICS, xrefs: 00007FF6D3AE3845
pre-decompress bytes,%llu, xrefs: 00007FF6D3AE3929
Auth read bytes,%llu, xrefs: 00007FF6D3AE38E4
post-compress bytes,%llu, xrefs: 00007FF6D3AE3916
TCP/UDP write bytes,%llu, xrefs: 00007FF6D3AE38C7
TAP-WIN32 driver status,"%s", xrefs: 00007FF6D3AE3972
TUN/TAP write bytes,%llu, xrefs: 00007FF6D3AE3894
END, xrefs: 00007FF6D3AE3981
pre-compress bytes,%llu, xrefs: 00007FF6D3AE3903
post-decompress bytes,%llu, xrefs: 00007FF6D3AE393C

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _lseekfree$_chsize_exit
String ID: Auth read bytes,%llu$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\status.c$END$OpenVPN STATISTICS$TAP-WIN32 driver status,"%s"$TCP/UDP read bytes,%llu$TCP/UDP write bytes,%llu$TUN/TAP read bytes,%llu$TUN/TAP write bytes,%llu$Updated,%s$buf_init(&so->read_buf, 0)$post-compress bytes,%llu$post-decompress bytes,%llu$pre-compress bytes,%llu$pre-decompress bytes,%llu
API String ID: 1698134751-3195016593
Opcode ID: 951f9a20e5801cb63e248ab58d775817d396937795ca495110c679be2c20503b
Instruction ID: 3e94b0e5d51ebea0874437f04ef11c4f3ff707be57048d01a17892fbbfbc9b8f
Opcode Fuzzy Hash: 951f9a20e5801cb63e248ab58d775817d396937795ca495110c679be2c20503b
Instruction Fuzzy Hash: BB616D65B0AB8292EA18DB2594125BDE361FF46B84F4C5037EA8DB7699CF3CE171C340

Function 00007FF6D3A8C500 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 208COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C53B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C55E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C5AE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C5D1
htonl.WS2_32 ref: 00007FF6D3A8C5FD
inet_ntoa.WS2_32 ref: 00007FF6D3A8C605
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C64D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C670
htonl.WS2_32 ref: 00007FF6D3A8C69D
inet_ntoa.WS2_32 ref: 00007FF6D3A8C6A5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C705
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C728
htonl.WS2_32 ref: 00007FF6D3A8C755
inet_ntoa.WS2_32 ref: 00007FF6D3A8C75D

Strings

route %s %s, xrefs: 00007FF6D3A8C6DB
network, xrefs: 00007FF6D3A8C7D8
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\helper.c, xrefs: 00007FF6D3A8C7E4
route %s, xrefs: 00007FF6D3A8C790

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$htonlinet_ntoa
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\helper.c$network$route %s$route %s %s
API String ID: 3620171695-4170088803
Opcode ID: ab1b42ebaab1c7d4b96ad394b5624d3b37f9b0b561a5a3e0a8860301148c5d9a
Instruction ID: 054f1f9dda6bb03e81f91733c22276330c67d13ca0c94bdb20d6151a39928c08
Opcode Fuzzy Hash: ab1b42ebaab1c7d4b96ad394b5624d3b37f9b0b561a5a3e0a8860301148c5d9a
Instruction Fuzzy Hash: 81915A71F0AB9285FB058F6494422BCA7A0BF59784F09553BCE8DB6B49EF3CA4608710

Function 00007FF6D3A8FC10 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 206stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A8FBA0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8FBBE
Part of subcall function 00007FF6D3A8FBA0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8FBEB

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8FC77
memset.VCRUNTIME140 ref: 00007FF6D3A8FC94
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A8FE88
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8FEB2
memset.VCRUNTIME140 ref: 00007FF6D3A8FECF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A8FEEA
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A8FF13

Strings

ntlm2, xrefs: 00007FF6D3A8FE06
port, xrefs: 00007FF6D3A8FF72
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\proxy.c, xrefs: 00007FF6D3A8FF5F
NTLM v1 authentication is deprecated and will be removed in OpenVPN 2.7, xrefs: 00007FF6D3A8FDDA
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socks.c, xrefs: 00007FF6D3A8FF7E
none, xrefs: 00007FF6D3A8FD27
o->port, xrefs: 00007FF6D3A8FF53
ntlm, xrefs: 00007FF6D3A8FDA0
HTTP_PROXY: server not specified, xrefs: 00007FF6D3A8FE72
ERROR: unknown HTTP authentication method: '%s', xrefs: 00007FF6D3A8FE51
basic, xrefs: 00007FF6D3A8FD5E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freemallocmemsetstrncpy$_exit
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\proxy.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socks.c$ERROR: unknown HTTP authentication method: '%s'$HTTP_PROXY: server not specified$NTLM v1 authentication is deprecated and will be removed in OpenVPN 2.7$basic$none$ntlm$ntlm2$o->port$port
API String ID: 3785283947-524452808
Opcode ID: ba9309e5a7b7e096211691c08a9369e06e5daec10cd978f92e20a98c072821d2
Instruction ID: 6350c57148e5a988a0052d8039ae8eea5b52dcb7071f37fb6ca3fdcbc95916ae
Opcode Fuzzy Hash: ba9309e5a7b7e096211691c08a9369e06e5daec10cd978f92e20a98c072821d2
Instruction Fuzzy Hash: 09A1B422A0C6C282E7599B24E5023BCA760FB66748F489136DB8D66296DF6CF5E5C300

Function 00007FF6D3B15070 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 151processCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B150C4
memcpy.VCRUNTIME140 ref: 00007FF6D3B150E0
memset.VCRUNTIME140 ref: 00007FF6D3B1513E
GetModuleFileNameA.KERNEL32 ref: 00007FF6D3B15153
GetStartupInfoA.KERNEL32 ref: 00007FF6D3B15169
CreateProcessA.KERNEL32 ref: 00007FF6D3B151C1
CloseHandle.KERNEL32 ref: 00007FF6D3B151D0
CloseHandle.KERNEL32 ref: 00007FF6D3B151DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B15229
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B15281
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B152A7
memcpy.VCRUNTIME140 ref: 00007FF6D3B152BF

Strings

SystemRoot, xrefs: 00007FF6D3B152D2
h, xrefs: 00007FF6D3B15174
fork_to_self: CreateProcess failed: cannot get module name via GetModuleFileName, xrefs: 00007FF6D3B15215
fork_to_self: CreateProcess failed: %s, xrefs: 00007FF6D3B151F4

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: CloseHandlecallocfreememcpy$CreateFileInfoModuleNameProcessStartupmemset
String ID: SystemRoot$fork_to_self: CreateProcess failed: %s$fork_to_self: CreateProcess failed: cannot get module name via GetModuleFileName$h
API String ID: 2744877749-1096927694
Opcode ID: a534eb0d2c1334da008c12c49629b631dd2c4b63ff811c64f041b96a7969aa09
Instruction ID: 173321ce9fb6ff34e4e247519eb6f4cbfede7755d001702d17d3d3cafd73376d
Opcode Fuzzy Hash: a534eb0d2c1334da008c12c49629b631dd2c4b63ff811c64f041b96a7969aa09
Instruction Fuzzy Hash: 5F614032A0DBC182E720DB51E4052BEE361FB9AB90F584237DA9D97B95DF7CE1608740

Function 00007FF6D3A7A880 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 111COMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A8C9
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A8DA
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A8E8
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A8F6
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A905
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A910
EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A93E
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A94F
EVP_CIPHER_get_nid.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A95F
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A96F
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3A7A97A
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A7A9A9

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c, xrefs: 00007FF6D3A7A9CC
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A7A9E5
ciphername, xrefs: 00007FF6D3A7A9D9
--no-replay cannot be used with a CFB, OFB or AEAD mode cipher, xrefs: 00007FF6D3A7A993

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_free$R_get_mode$R_fetch$R_get_flagsR_get_nid_exit
String ID: --no-replay cannot be used with a CFB, OFB or AEAD mode cipher$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$ciphername
API String ID: 3462190298-3705925875
Opcode ID: 96a96505911938c6b2960afd7d4ba49534ffe2e0d9214702be6311149b277c26
Instruction ID: 1b11a47c5119ca27c74ee0e51b23c88cfacfb2562ccb7894b3ca8f91627235af
Opcode Fuzzy Hash: 96a96505911938c6b2960afd7d4ba49534ffe2e0d9214702be6311149b277c26
Instruction Fuzzy Hash: A931B166F0E60791FE9C9B11A49617CD351AF56B80F4D0433DA8FE6799DE2CE4748200

Function 00007FF6D3B057E0 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A712E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A71308

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B05854
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3B05A77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B05AF8
inet_ntop.WS2_32 ref: 00007FF6D3B058A3

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

Strings

******** NOTE: Please manually set the IP/netmask of '%s' to %s/%s (if it is not already set), xrefs: 00007FF6D3B05CDA
NETSH, xrefs: 00007FF6D3B059FC, 00007FF6D3B05A5C
%s: command failed, xrefs: 00007FF6D3B05A63
%s%s interface ipv6 set address %lu %s/%d store=active, xrefs: 00007FF6D3B059CF
win_sys_path, xrefs: 00007FF6D3B05B3B
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3B05B47
\system32\netsh.exe, xrefs: 00007FF6D3B059C2
do_ifconfig, ipv4=%d, ipv6=%d, xrefs: 00007FF6D3B05E04
******** NOTE: Please manually set the v6 IP of '%s' to %s (if it is not already set), xrefs: 00007FF6D3B05900
ERROR: command failed, xrefs: 00007FF6D3B05A12
@, xrefs: 00007FF6D3B0581D

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$__stdio_common_vsprintf_exitfreeinet_ntop
String ID: %s%s interface ipv6 set address %lu %s/%d store=active$%s: command failed$******** NOTE: Please manually set the IP/netmask of '%s' to %s/%s (if it is not already set)$******** NOTE: Please manually set the v6 IP of '%s' to %s (if it is not already set)$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$ERROR: command failed$NETSH$\system32\netsh.exe$do_ifconfig, ipv4=%d, ipv6=%d$win_sys_path
API String ID: 2285947998-1887878019
Opcode ID: ebe38ff45c49990b50ac064d76390af77dfdb005ae656b67f4ffe13519da61a4
Instruction ID: a765af218aae741c1ffb8bc76e8a5876241065736f121009844c2372498e1f29
Opcode Fuzzy Hash: ebe38ff45c49990b50ac064d76390af77dfdb005ae656b67f4ffe13519da61a4
Instruction Fuzzy Hash: 4AA1B032E0968286F714DB61DA422FDB360FF66384F444137DA8CB7A96EF38A565C740

Function 00007FF6D3A7DC50 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 125stringCOMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DC85
EVP_CIPHER_get_block_size.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DCB3
EVP_CIPHER_get0_name.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DCBF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DD04
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DD20
strrchr.VCRUNTIME140(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DD2D
EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DD82
EVP_CIPHER_get_block_size.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DD96
EVP_CIPHER_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DDA2
EVP_CIPHER_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DDAB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3A7C79E), ref: 00007FF6D3A7DDB4

Strings

-CBC, xrefs: 00007FF6D3A7DD52
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A7DDE6
ciphername, xrefs: 00007FF6D3A7DDDA

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_fetchR_freeR_get_block_size$R_get0_namecallocfreememcpystrrchr
String ID: -CBC$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$ciphername
API String ID: 1288903254-2026270469
Opcode ID: bcfad5677919b7be15bcb3907fc78b939def9cc993f096896bbb6b7e3aea94cd
Instruction ID: 5bd0061753590226d5912472eedc6d56d46ec5d0267e82b0eea22cb08eb03741
Opcode Fuzzy Hash: bcfad5677919b7be15bcb3907fc78b939def9cc993f096896bbb6b7e3aea94cd
Instruction Fuzzy Hash: 2141B4A6F0B64282FA199B21644617DF790EF45F90F0C4532DE5DA3799EE3CE4658310

Function 00007FF6D3ADCD30 Relevance: 23.2, APIs: 5, Strings: 8, Instructions: 410COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADCE3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADCF06
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADD030
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADD106

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c, xrefs: 00007FF6D3ADCD8B, 00007FF6D3ADCF87, 00007FF6D3ADD25E, 00007FF6D3ADD277
ACK mark active outgoing ID %u, xrefs: 00007FF6D3ADD22C
ACK reliable_can_send active=%d current=%d : %s, xrefs: 00007FF6D3ADD0E9
[%u], xrefs: 00007FF6D3ADCE5E, 00007FF6D3ADD053
%u, xrefs: 00007FF6D3ADCEAA, 00007FF6D3ADD0A1
ACK output sequence broken: %s, xrefs: 00007FF6D3ADCEEC
buf_write_prepend(buf, &net_pid, sizeof(net_pid)), xrefs: 00007FF6D3ADD252
buf_init(&e->buf, rel->offset), xrefs: 00007FF6D3ADCD7F, 00007FF6D3ADCF7B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freemalloc
String ID: %u$ACK mark active outgoing ID %u$ACK output sequence broken: %s$ACK reliable_can_send active=%d current=%d : %s$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c$[%u]$buf_init(&e->buf, rel->offset)$buf_write_prepend(buf, &net_pid, sizeof(net_pid))
API String ID: 3061335427-194541766
Opcode ID: 8cfbda9d837fd605e826577ed3565588c43e0b8cf17779a0464ad1214f853263
Instruction ID: 8373d0d6ed1e652c9fb6ba96e6e9f70d9eeaceda14a01c652523f27163d33ebf
Opcode Fuzzy Hash: 8cfbda9d837fd605e826577ed3565588c43e0b8cf17779a0464ad1214f853263
Instruction Fuzzy Hash: 0CE19472B0968286EB188F14E4422BDB761FF95784F594036DE8DA7799EF3CE4A1C700

Function 00007FF6D3A7E030 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 237COMMON

Download Yara Rule

APIs

EVP_MD_fetch.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FF6D3A7A08E), ref: 00007FF6D3A7E04F
EVP_MD_get_size.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FF6D3A7A08E), ref: 00007FF6D3A7E08F
EVP_MD_get_size.LIBCRYPTO-3-X64(?,?,?,?,00000000,00007FF6D3A7A08E), ref: 00007FF6D3A7E0BF
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,00007FF6D3A7A08E), ref: 00007FF6D3A7E0E9

Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D3A7C6F5), ref: 00007FF6D3A7CF45
Part of subcall function 00007FF6D3A7CF10: ERR_error_string.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D01A
Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D0AE

EVP_MD_get0_name.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A08E), ref: 00007FF6D3A7E165
EVP_MD_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A08E), ref: 00007FF6D3A7E382

Strings

[null-digest], xrefs: 00007FF6D3A7E144
digest, xrefs: 00007FF6D3A7E101
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3A7E10D
none, xrefs: 00007FF6D3A7E126
Message hash algorithm '%s' not found, xrefs: 00007FF6D3A7E07B
Message hash algorithm '%s' uses a default hash size (%d bytes) which is larger than OpenVPN's current maximum hash size (%d bytes), xrefs: 00007FF6D3A7E0D3
@, xrefs: 00007FF6D3A7E0C8

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: D_get_sizeR_get_error_all$D_fetchD_freeD_get0_nameR_error_string_exit
String ID: @$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$Message hash algorithm '%s' not found$Message hash algorithm '%s' uses a default hash size (%d bytes) which is larger than OpenVPN's current maximum hash size (%d bytes)$[null-digest]$digest$none
API String ID: 1095403366-1202525981
Opcode ID: 1792ae8cff2c73c2ae5023ce8f89b0baa38155ddc56fdab0aef840698437d269
Instruction ID: 65674fcf1314f816670ca8ae98dc23cf2c97badf4b91dbbed15517432812bd5e
Opcode Fuzzy Hash: 1792ae8cff2c73c2ae5023ce8f89b0baa38155ddc56fdab0aef840698437d269
Instruction Fuzzy Hash: 6A910961F1E7C644EF585B6584925BCFBA1BFA2B84B4C5137D98EE3399DE2CE4208200

Function 00007FF6D3AE4130 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,?,?,buf_inc_len(&ret, (int)read_size),00000001,?,?,00007FF6D3A73D7B), ref: 00007FF6D3AE438A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,buf_inc_len(&ret, (int)read_size),00000001,?,?,00007FF6D3A73D7B), ref: 00007FF6D3AE4393

Strings

buf_inc_len(&ret, (int)read_size), xrefs: 00007FF6D3AE4134
IP prefix '%s': invalid '/bits' spec (%s), xrefs: 00007FF6D3AE4324
Can't allocate hostname buffer for getaddrinfo, xrefs: 00007FF6D3AE421B
Unsupported AF family passed to getaddrinfo for %s (%d), xrefs: 00007FF6D3AE41CC
Can't resolve null hostname!, xrefs: 00007FF6D3AE4197
Unsupported AF family for %s (%d), xrefs: 00007FF6D3AE42E2

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freefreeaddrinfo
String ID: Can't allocate hostname buffer for getaddrinfo$Can't resolve null hostname!$IP prefix '%s': invalid '/bits' spec (%s)$Unsupported AF family for %s (%d)$Unsupported AF family passed to getaddrinfo for %s (%d)$buf_inc_len(&ret, (int)read_size)
API String ID: 3926572412-1745708042
Opcode ID: c34274a1f48ea86bd3bcef78236de8dacc224ea713f9be4b803a5ba8feed8843
Instruction ID: 9aed240faccf58d73a8147f9950a25e241e113e7b1277dfa62cff6393f106b14
Opcode Fuzzy Hash: c34274a1f48ea86bd3bcef78236de8dacc224ea713f9be4b803a5ba8feed8843
Instruction Fuzzy Hash: 48619E25B0878386FB289F15E44627DE795AB99B94F880132DE8DF77D1DE3CE4618700

Function 00007FF6D3A9B800 Relevance: 21.2, APIs: 4, Strings: 10, Instructions: 215COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B844

Part of subcall function 00007FF6D3A83310: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83319
Part of subcall function 00007FF6D3A83310: fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83329
Part of subcall function 00007FF6D3A83310: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A83333

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B85A

Part of subcall function 00007FF6D3A733D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AD423F,?,?,?,?,?,?,00000000), ref: 00007FF6D3A733F8
Part of subcall function 00007FF6D3A733D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AD423F,?,?,?,?,?,?,00000000), ref: 00007FF6D3A7340D

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B902
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B918

Strings

ERROR: The %s command is not currently available, xrefs: 00007FF6D3A9B894
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3A9BA44
ERROR: proxy command failed, xrefs: 00007FF6D3A9BAAA
at least , xrefs: 00007FF6D3A9BA06
ERROR: The certificate command is not currently available, xrefs: 00007FF6D3A9B94F
proxy, xrefs: 00007FF6D3A9BACD
ERROR: The '%s' command is not supported by the current daemon mode, xrefs: 00007FF6D3A9BAD9
SUCCESS: proxy command succeeded, xrefs: 00007FF6D3A9BA8C
p[0], xrefs: 00007FF6D3A9BA38
ERROR: the '%s' command requires %s%d parameter%s, xrefs: 00007FF6D3A9BA1A

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$malloc$__acrt_iob_funcexitfprintf
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$ERROR: The %s command is not currently available$ERROR: The '%s' command is not supported by the current daemon mode$ERROR: The certificate command is not currently available$ERROR: proxy command failed$ERROR: the '%s' command requires %s%d parameter%s$SUCCESS: proxy command succeeded$at least $p[0]$proxy
API String ID: 616886165-1529070907
Opcode ID: 0fe939d1ed723ec37df7492acc45c99cabe3921fe60d3e9576efbe06d195a4f0
Instruction ID: 099d47247613fb838fb2bc0e32354a6e17074ad710bbf452822364b2a2cecffb
Opcode Fuzzy Hash: 0fe939d1ed723ec37df7492acc45c99cabe3921fe60d3e9576efbe06d195a4f0
Instruction Fuzzy Hash: D771CF75F1969282EB089B15F5463BCA3A1EF59B84F8C0033DB4CAB395DF7DA4A58700

Function 00007FF6D3A860C0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A86154
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3A861B3
memcpy.VCRUNTIME140 ref: 00007FF6D3A86220
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3A8622F
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FF6D3A8629D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A862D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A86304

Strings

WARNING: Receive control message failed, xrefs: 00007FF6D3A862BA
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3A8638A
len > 0, xrefs: 00007FF6D3A86359
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\forward.c, xrefs: 00007FF6D3A86365
multi, xrefs: 00007FF6D3A8637E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_clear_error$free$mallocmemcpy
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\forward.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$WARNING: Receive control message failed$len > 0$multi
API String ID: 2116544756-4026653125
Opcode ID: caf3e959514356ff83c52b88d999a10d7aec1a5c8995ff7b44a2ea9e895a7940
Instruction ID: 06911a79728a04d7d7f399dd8c6c081b94d84f0deab7456a185a9e1eb9620427
Opcode Fuzzy Hash: caf3e959514356ff83c52b88d999a10d7aec1a5c8995ff7b44a2ea9e895a7940
Instruction Fuzzy Hash: 1C716136B09AC282F6689B10A41637DE7A0FF95794F484136DB8DA77A5EF3CE4648700

Function 00007FF6D3B147E0 Relevance: 21.2, APIs: 3, Strings: 11, Instructions: 155stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A728B0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A728FD

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B148E2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3B14929
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3B14976

Strings

win_sys_path, xrefs: 00007FF6D3B14A3D
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3B14A49
openvpn_execve: GetExitCodeProcess %ls failed, xrefs: 00007FF6D3B14F59
password, xrefs: 00007FF6D3B1491C
PATH=, xrefs: 00007FF6D3B14969
env_block: add %s, xrefs: 00007FF6D3B149B1
env_block: default path truncated to %s, xrefs: 00007FF6D3B1484A
"%s", xrefs: 00007FF6D3B14BB3
PATH=%s\System32;%s;%s\System32\Wbem, xrefs: 00007FF6D3B14813
openvpn_execve: CreateProcess %ls failed, xrefs: 00007FF6D3B14F88
WARNING: Failed running command (%s), xrefs: 00007FF6D3B14D85

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: strncmp$__stdio_common_vsprintfmalloc
String ID: "%s"$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$PATH=$PATH=%s\System32;%s;%s\System32\Wbem$WARNING: Failed running command (%s)$env_block: add %s$env_block: default path truncated to %s$openvpn_execve: CreateProcess %ls failed$openvpn_execve: GetExitCodeProcess %ls failed$password$win_sys_path
API String ID: 442965982-2668939393
Opcode ID: 706601b7ff62a2c9f8d39e9fc0e181b74db2a5efb597cf2ad304f930467332e5
Instruction ID: 2fb7a1f9c77a520af83975b51a18b7957fdce1c6921e1748f5901f36d8a47d78
Opcode Fuzzy Hash: 706601b7ff62a2c9f8d39e9fc0e181b74db2a5efb597cf2ad304f930467332e5
Instruction Fuzzy Hash: 97618375A1EA8185EA518B11E4423BDE7A0FB96BC4F484033CACDA7789EF3DD525C700

Function 00007FF6D3AFB460 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A712E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A71308

Part of subcall function 00007FF6D3A82780: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A827FF
Part of subcall function 00007FF6D3A82780: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82825
Part of subcall function 00007FF6D3A82780: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82867
Part of subcall function 00007FF6D3A82780: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A8288A

Part of subcall function 00007FF6D3AD4030: memset.VCRUNTIME140 ref: 00007FF6D3AD4068
Part of subcall function 00007FF6D3AD4030: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AD40DE

_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AFB57D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB591
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB5A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB5B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB6BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFB6E9

Part of subcall function 00007FF6D3AFDDA0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFDDE2
Part of subcall function 00007FF6D3AFDDA0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFDE96
Part of subcall function 00007FF6D3AFDDA0: memcpy.VCRUNTIME140 ref: 00007FF6D3AFDEB2
Part of subcall function 00007FF6D3AFDDA0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AFDEDD

Part of subcall function 00007FF6D3AFDFC0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AFE032
Part of subcall function 00007FF6D3AFDFC0: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AFE09C
Part of subcall function 00007FF6D3AFDFC0: _write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AFE0FB

Strings

script_type, xrefs: 00007FF6D3AFB4CD
TLS CR Response Error: could not write crtext challenge response to file: %s, xrefs: 00007FF6D3AFB677
client-crresponse, xrefs: 00007FF6D3AFB4BB
--client-crresponse, xrefs: 00007FF6D3AFB5F5
creating file failed, xrefs: 00007FF6D3AFB670
WARNING: Failed running command (%s), xrefs: 00007FF6D3AFB5FC

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$malloc$memcpy$calloc$__stdio_common_vsprintf_close_errno_exit_writememset
String ID: --client-crresponse$TLS CR Response Error: could not write crtext challenge response to file: %s$WARNING: Failed running command (%s)$client-crresponse$creating file failed$script_type
API String ID: 3221992693-2265354738
Opcode ID: a92e95a42d677da105d82e27f275270fdab91f0ca99dd5ff0f781b0d53e6beba
Instruction ID: 969a5fee67c59a75f1af88796afce985f558efd08bb4790229d157a2e61e72ba
Opcode Fuzzy Hash: a92e95a42d677da105d82e27f275270fdab91f0ca99dd5ff0f781b0d53e6beba
Instruction Fuzzy Hash: C2718F31B0AA8281EA64DF25E4563FDE360EF99B84F484133DA8DA7656DF7CE065C700

Function 00007FF6D3A9D130 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A84A20: ioctlsocket.WS2_32 ref: 00007FF6D3A84A45
Part of subcall function 00007FF6D3A84A20: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A84A73

Part of subcall function 00007FF6D3A9D130: CreateEventA.KERNEL32 ref: 00007FF6D3A9CFA6
Part of subcall function 00007FF6D3A9D130: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A9D0E1

getpeername.WS2_32 ref: 00007FF6D3A9D1F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9D308
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9D334

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3A9D0FF
MANAGEMENT: %s %s, xrefs: 00007FF6D3A9D232, 00007FF6D3A9D273
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3A9D118
Error: init_net_event_win32: WSAEventSelect call failed, xrefs: 00007FF6D3A9D0CB
!socket_defined(ne->sd), xrefs: 00007FF6D3A9D10C
ENTER PASSWORD:, xrefs: 00007FF6D3A9D2BC
unknown, xrefs: 00007FF6D3A9D269
Error: init_net_event_win32: CreateEvent (read) failed, xrefs: 00007FF6D3A9D011
Error: init_net_event_win32: CreateEvent (write) failed, xrefs: 00007FF6D3A9CFCA

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exitfree$CreateEventgetpeernameioctlsocket
String ID: !socket_defined(ne->sd)$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$ENTER PASSWORD:$Error: init_net_event_win32: CreateEvent (read) failed$Error: init_net_event_win32: CreateEvent (write) failed$Error: init_net_event_win32: WSAEventSelect call failed$MANAGEMENT: %s %s$unknown
API String ID: 49940810-1195059737
Opcode ID: 777f54282368be6d8dbea456209c8970de7105331186c9f45df3b6172fceca60
Instruction ID: 51d303e62af1073e87faff37918e3bb6e4dd9632a31be204e09a850cfce41339
Opcode Fuzzy Hash: 777f54282368be6d8dbea456209c8970de7105331186c9f45df3b6172fceca60
Instruction Fuzzy Hash: 3A518235B0A68281FA288F1594563BCB351EB59B84F8C0137DE4DBB295DF2DE4A5C360

Function 00007FF6D3AA0BF0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 322COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF6D3AA0D25
ResetEvent.KERNEL32 ref: 00007FF6D3AA0D2D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA0E70
SetEvent.KERNEL32 ref: 00007FF6D3AA0F55
ResetEvent.KERNEL32 ref: 00007FF6D3AA0F5D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA10B6

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3A9FF0B, 00007FF6D3A9FF2A, 00007FF6D3A9FF43, 00007FF6D3AA05B4, 00007FF6D3AA05CD, 00007FF6D3AA05E6, 00007FF6D3AA1116, 00007FF6D3AA1135, 00007FF6D3AA114E
man_standalone_ok(man), xrefs: 00007FF6D3A9FF1E, 00007FF6D3AA05A8, 00007FF6D3AA060C, 00007FF6D3AA0BF3, 00007FF6D3AA110A
Need hold release from management interface, waiting..., xrefs: 00007FF6D3AA0CBF
>HOLD:Waiting for hold release:%d, xrefs: 00007FF6D3AA0E91
Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write, xrefs: 00007FF6D3A9FB33, 00007FF6D3A9FD13, 00007FF6D3AA01B6, 00007FF6D3AA0398, 00007FF6D3AA0D45, 00007FF6D3AA0F75

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Event$Reset$freemalloc
String ID: >HOLD:Waiting for hold release:%d$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$Need hold release from management interface, waiting...$Warning: SetEvent/ResetEvent failed in net_event_win32_reset_write$man_standalone_ok(man)
API String ID: 1818452640-2828361868
Opcode ID: df8696b80a146fc88bc21b0407a2282a697dfae0576f73e6af3698d9265b766c
Instruction ID: 28db15e0fc11afc5d41804b1828b6b5e07457aa109f6a47dcbe1759d12ac4743
Opcode Fuzzy Hash: df8696b80a146fc88bc21b0407a2282a697dfae0576f73e6af3698d9265b766c
Instruction Fuzzy Hash: FFF18C36B0968289FB64DF21D4067BDA3A0BB65748F48003BCE4DA7695DF39A465C350

Function 00007FF6D3A84810 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84857
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84905
memset.VCRUNTIME140 ref: 00007FF6D3A8493B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84958
memset.VCRUNTIME140 ref: 00007FF6D3A84985
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A849F0

Strings

*maxevents > 0, xrefs: 00007FF6D3A849FD
WE_INIT maxevents=%d flags=0x%08x, xrefs: 00007FF6D3A8483E
WE_INIT maxevents=%d capacity=%d, xrefs: 00007FF6D3A849A5
attempted allocation of excessively large array, xrefs: 00007FF6D3A849DA
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c, xrefs: 00007FF6D3A84A09

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memset$_exit
String ID: *maxevents > 0$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c$WE_INIT maxevents=%d capacity=%d$WE_INIT maxevents=%d flags=0x%08x$attempted allocation of excessively large array
API String ID: 171174049-2757034343
Opcode ID: 4797dd9dc1137d3957ed0928d21138b4a6a32a4a35eaaad0bba58de146ca4821
Instruction ID: 538b64fe52029d3e45fd169eaa8bb3b26e747c4ce3d7c75b1825b43e2c045df0
Opcode Fuzzy Hash: 4797dd9dc1137d3957ed0928d21138b4a6a32a4a35eaaad0bba58de146ca4821
Instruction Fuzzy Hash: BC515E35B0AB8386FB2C9B55E45227CB7A1EF48B54F48413ACA5DA3795EF2CE461C340

Function 00007FF6D3A93080 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 257COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6D3A9319D
memcmp.VCRUNTIME140 ref: 00007FF6D3A931B6

Strings

ERROR: Failed to apply DCO keepalive or MSS fix parameters, xrefs: 00007FF6D3A935E2
ERROR: failed to set crypto cipher, xrefs: 00007FF6D3A934A2
%s: peer-id %d, fd %d, xrefs: 00007FF6D3A93320
OPTIONS ERROR: failed to import crypto options, xrefs: 00007FF6D3A933CD
ERROR: Failed to apply push options, xrefs: 00007FF6D3A930EA
ERROR: Failed to apply P2P negotiated protocol options, xrefs: 00007FF6D3A934D2
ERROR: failed to negotiate cipher with peer and --data-ciphers-fallback not enabled. No usable data channel cipher, xrefs: 00007FF6D3A93512
dco_new_peer, xrefs: 00007FF6D3A93314
Cannot set parameters for DCO peer (id=%u): %s, xrefs: 00007FF6D3A935B0

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: memcmp
String ID: %s: peer-id %d, fd %d$Cannot set parameters for DCO peer (id=%u): %s$ERROR: Failed to apply DCO keepalive or MSS fix parameters$ERROR: Failed to apply P2P negotiated protocol options$ERROR: Failed to apply push options$ERROR: failed to negotiate cipher with peer and --data-ciphers-fallback not enabled. No usable data channel cipher$ERROR: failed to set crypto cipher$OPTIONS ERROR: failed to import crypto options$dco_new_peer
API String ID: 1475443563-3667031374
Opcode ID: cb2b8b61e830193cd2347674f59a0cce507d8a2f67b4aeb7fe4c6c292e5a98fb
Instruction ID: 50d46e374ce76302d0b6ceb1ee2a2bfc50c01877ce841c17fdff1be3d9921ec8
Opcode Fuzzy Hash: cb2b8b61e830193cd2347674f59a0cce507d8a2f67b4aeb7fe4c6c292e5a98fb
Instruction Fuzzy Hash: 01C18431B0968285FB589F2494463FDA3A1EB59B48F8C4037CA4DBB3D5DF7DA4A48720

Function 00007FF6D3A737D0 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 207COMMON

Download Yara Rule

Strings

buf_inc_len(&ret, (int)read_size), xrefs: 00007FF6D3A739E0
@, xrefs: 00007FF6D3A73D50
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c, xrefs: 00007FF6D3A73536, 00007FF6D3A7354F, 00007FF6D3A739EC
dnat, xrefs: 00007FF6D3A73D1F
snat, xrefs: 00007FF6D3A73CEE
client-nat: type must be 'snat' or 'dnat', xrefs: 00007FF6D3A73F0C
!ol->head, xrefs: 00007FF6D3A73543, 00007FF6D3A73A03, 00007FF6D3A73A04

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ByteCharMultiWide$malloc$free$_wfopen_wstat64i32
String ID: !ol->head$@$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c$buf_inc_len(&ret, (int)read_size)$client-nat: type must be 'snat' or 'dnat'$dnat$snat
API String ID: 668702269-3341278675
Opcode ID: e44b8c12fc42ebc2af1b4bf750c37e3a6ebdfb781c3698fb40ec67043472e91a
Instruction ID: fe031339a2abb3b4f7311cc55239a3182d8c41bc96e7d5a136cad56becc1c4f8
Opcode Fuzzy Hash: e44b8c12fc42ebc2af1b4bf750c37e3a6ebdfb781c3698fb40ec67043472e91a
Instruction Fuzzy Hash: 3F711472F0968185FA249B10A8423BDF7A0FB95B84F594132DE8DA779ADF3CE065C700

Function 00007FF6D3AA2480 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA24EC
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA250D
RAND_bytes.LIBCRYPTO-3-X64 ref: 00007FF6D3AA2543
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA2565
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AA2588

Strings

%02x, xrefs: 00007FF6D3AA25C6
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c, xrefs: 00007FF6D3AA26E2
rand_bytes(output, len), xrefs: 00007FF6D3AA26D6
RAND_bytes() failed, xrefs: 00007FF6D3AA26C5
%s.%s, xrefs: 00007FF6D3AA2641

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$D_bytes
String ID: %02x$%s.%s$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto.c$RAND_bytes() failed$rand_bytes(output, len)
API String ID: 1282830771-399443464
Opcode ID: 175758b68b3e3960387b75e77a59609e302ccec5b18d000f465a1272f7cb441d
Instruction ID: 105c37dc5c0c3ba8386203160fce65358a8f2f9e634917d65da63bfbc61a7c3e
Opcode Fuzzy Hash: 175758b68b3e3960387b75e77a59609e302ccec5b18d000f465a1272f7cb441d
Instruction Fuzzy Hash: E7619222F0AB5289FB199F60D8527BCA361FF55794F084536CE4DBA799EF3CA4618300

Function 00007FF6D3A7C920 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

RAND_bytes.LIBCRYPTO-3-X64 ref: 00007FF6D3A7C9BA
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A7CABF
printf.MSPDB140-MSVCRT ref: 00007FF6D3A7CAFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CB33
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CB64

Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D3A7C6F5), ref: 00007FF6D3A7CF45
Part of subcall function 00007FF6D3A7CF10: ERR_error_string.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D01A
Part of subcall function 00007FF6D3A7CF10: ERR_get_error_all.LIBCRYPTO-3-X64 ref: 00007FF6D3A7D0AE

Strings

ERROR: could not write key file, xrefs: 00007FF6D3A7CAA9
ERROR: could not generate random key, xrefs: 00007FF6D3A7CA10
ERROR: could not PEM-encode key, xrefs: 00007FF6D3A7CA6D
%.*s, xrefs: 00007FF6D3A7CAF3
RAND_bytes() failed, xrefs: 00007FF6D3A7C9ED

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_get_error_allfree$D_bytesR_error_string_exitprintf
String ID: %.*s$ERROR: could not PEM-encode key$ERROR: could not generate random key$ERROR: could not write key file$RAND_bytes() failed
API String ID: 916929795-1546388842
Opcode ID: ed60f51759b2d28067dac53e6e340a68aa470f1c56b497e68109d3f33530216f
Instruction ID: 530c21036674b4f985185cc7209925c384408d0e77450b66c0a21451dfe8d097
Opcode Fuzzy Hash: ed60f51759b2d28067dac53e6e340a68aa470f1c56b497e68109d3f33530216f
Instruction Fuzzy Hash: 7A61D472F19B8191F718CB10D5423BDA3A2FB99784F495237EE8DA2699DF3CE4608600

Function 00007FF6D3A988E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 138COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AA945F), ref: 00007FF6D3A98913
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AA945F), ref: 00007FF6D3A9897F
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D3AA945F), ref: 00007FF6D3A989F5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA945F), ref: 00007FF6D3A98A84
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA945F), ref: 00007FF6D3A98AAB

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h, xrefs: 00007FF6D3A98A27
n_buckets > 0, xrefs: 00007FF6D3A98A02
attempted allocation of excessively large array, xrefs: 00007FF6D3A989DF
ret > 0, xrefs: 00007FF6D3A98A1B
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\list.c, xrefs: 00007FF6D3A98A0E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freemalloc$_exit
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\list.c$attempted allocation of excessively large array$n_buckets > 0$ret > 0
API String ID: 1168006677-1341338459
Opcode ID: 102234f1d23fda941137d378d3de8da60ec6496bcad870b19c61ffbe88f4f35a
Instruction ID: 006aeb78bf49046b5447a7e90ea9b686c30a4905da33d7dcefa6b78be470556d
Opcode Fuzzy Hash: 102234f1d23fda941137d378d3de8da60ec6496bcad870b19c61ffbe88f4f35a
Instruction Fuzzy Hash: 1851D332B19B4286E758CF14E44127DB3A4FB95B84F584536EA8DA7B94DF3CE4A08700

Function 00007FF6D3AC3CB0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 124stringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AC3CDC
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AC3CF7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AC3D20
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AC3D3A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AC3D54

Strings

Pushed option accepted by filter: '%s', xrefs: 00007FF6D3AC3D99
Pushed option rejected by filter: '%s'. Restarting., xrefs: 00007FF6D3AC3DED
buf_copy(&buf2, &buf), xrefs: 00007FF6D3AC3CBF
Pushed option removed by filter: '%s', xrefs: 00007FF6D3AC3DC6
Offending option received from server, xrefs: 00007FF6D3AC3E65

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: strncmp$isspace
String ID: Offending option received from server$Pushed option accepted by filter: '%s'$Pushed option rejected by filter: '%s'. Restarting.$Pushed option removed by filter: '%s'$buf_copy(&buf2, &buf)
API String ID: 880961867-1881576087
Opcode ID: f04c1002a51d10289233de24631ff55a9c23dd9208d29967e93d8c12abf7a7be
Instruction ID: b75f5e9c9e4c6be77e15a92dc81d2d40ef3e0b7f14e735326d4f50206815d084
Opcode Fuzzy Hash: f04c1002a51d10289233de24631ff55a9c23dd9208d29967e93d8c12abf7a7be
Instruction Fuzzy Hash: 8251AB39B0968281FB288F16D5526BDA3A1AF56B84F0C8537CA4DEB6D1DF2CE421C340

Function 00007FF6D3AA1FC0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA1FD1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA2015
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA2056
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA20D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA20EE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA2104
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AA95C9), ref: 00007FF6D3AA210D

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h, xrefs: 00007FF6D3AA206F
attempted allocation of excessively large array, xrefs: 00007FF6D3AA2040
ret > 0, xrefs: 00007FF6D3AA2063

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$malloc$_exit
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h$attempted allocation of excessively large array$ret > 0
API String ID: 964013721-1229036220
Opcode ID: 11cecad8e8c9e63a91624519117bd77ee9e806f0bc49698f5b5a9d7e4fa3f5f3
Instruction ID: 996b3fe1f8cc66393c9ebbaa00a5e6492c8bd0892ca0baa88398b22892055f43
Opcode Fuzzy Hash: 11cecad8e8c9e63a91624519117bd77ee9e806f0bc49698f5b5a9d7e4fa3f5f3
Instruction Fuzzy Hash: 35418432B1964282EB588B24E44527DE3A1EF95B84F0C8536DB9E92795DF3CE8B1C240

Function 00007FF6D3B13CB0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 00007FF6D3B13CDB
ResetEvent.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D07
CloseHandle.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D39
ResetEvent.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D72
CloseHandle.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13DA5

Strings

Warning: close_net_event_win32: WSAEventSelect call failed, xrefs: 00007FF6D3B13CF3
Warning: CloseHandle (read) failed in close_net_event_win32, xrefs: 00007FF6D3B13D51
Warning: CloseHandle (write) failed in close_net_event_win32, xrefs: 00007FF6D3B13DBD
Warning: ResetEvent (write) failed in close_net_event_win32, xrefs: 00007FF6D3B13D8A
Warning: ResetEvent (read) failed in close_net_event_win32, xrefs: 00007FF6D3B13D1F

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Event$CloseHandleReset$Select
String ID: Warning: CloseHandle (read) failed in close_net_event_win32$Warning: CloseHandle (write) failed in close_net_event_win32$Warning: ResetEvent (read) failed in close_net_event_win32$Warning: ResetEvent (write) failed in close_net_event_win32$Warning: close_net_event_win32: WSAEventSelect call failed
API String ID: 3828575580-1130693431
Opcode ID: 5ce1daeb4815fc224e3375df78d7f768122360f5d16a7e6a4882a868ec7cc1d9
Instruction ID: 9a13005d317ba9d35adb3a9026d508913114c476043f0ae91119f68f60e5db48
Opcode Fuzzy Hash: 5ce1daeb4815fc224e3375df78d7f768122360f5d16a7e6a4882a868ec7cc1d9
Instruction Fuzzy Hash: 7531D070B09A4241FB18AB21E4177BCD391AF66B90F480037DA9DF62E5EF2CE8608300

Function 00007FF6D3AF5830 Relevance: 16.8, APIs: 4, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5A25

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

Part of subcall function 00007FF6D3AE8AB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE8B02
Part of subcall function 00007FF6D3AE8AB0: memset.VCRUNTIME140 ref: 00007FF6D3AE8B4C
Part of subcall function 00007FF6D3AE8AB0: getnameinfo.WS2_32 ref: 00007FF6D3AE8C50
Part of subcall function 00007FF6D3AE8AB0: FormatMessageA.KERNEL32 ref: 00007FF6D3AE8C87

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5AB0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5B96
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AF5BC4

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3AF5C08
tbs, xrefs: 00007FF6D3AF58FA
TLS: tls_update_remote_addr from IP=%s to IP=%s, xrefs: 00007FF6D3AF5B32
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_common.h, xrefs: 00007FF6D3AF58DA
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AF58C1
false, xrefs: 00007FF6D3AF58CE
ks->crypto_options.key_ctx_bi.initialized, xrefs: 00007FF6D3AF58B5

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$free$FormatMessage__stdio_common_vsprintf_exitgetnameinfomemset
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_common.h$TLS: tls_update_remote_addr from IP=%s to IP=%s$false$ks->crypto_options.key_ctx_bi.initialized$tbs
API String ID: 1953596131-561856474
Opcode ID: d7f75ecd4bcecb1f379adb264236f29bd19ce30d9ff03c085ac6bf7cda7b2581
Instruction ID: fc09237f1e2c40e6af74d91e5072453247c6959b1ce891fa5233920a4a7a0926
Opcode Fuzzy Hash: d7f75ecd4bcecb1f379adb264236f29bd19ce30d9ff03c085ac6bf7cda7b2581
Instruction Fuzzy Hash: 79B1D226F0DA46C1FB288B61D5422BCA3B1BB15B48F488037EE4DA7695DF3CE4A5C340

Function 00007FF6D3ADC420 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 275COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF6D3ADC64A

Strings

session_id_defined(sid), xrefs: 00007FF6D3ADC7D2
buf_write_u8(&sub, total_acks), xrefs: 00007FF6D3ADC7A0
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c, xrefs: 00007FF6D3ADC7AC, 00007FF6D3ADC7C5, 00007FF6D3ADC7DE, 00007FF6D3ADC7F7, 00007FF6D3ADC810
ACK write ID %u (ack->len=%d, n=%d), xrefs: 00007FF6D3ADC6A5
buf_write(&sub, &net_pid, sizeof(net_pid)), xrefs: 00007FF6D3ADC7EB
ack->len >= n, xrefs: 00007FF6D3ADC7B9
session_id_write(sid, &sub), xrefs: 00007FF6D3ADC804
buf_write(&ctx->work, &header, sizeof(header)), xrefs: 00007FF6D3ADC422

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: htonl
String ID: ACK write ID %u (ack->len=%d, n=%d)$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\reliable.c$ack->len >= n$buf_write(&ctx->work, &header, sizeof(header))$buf_write(&sub, &net_pid, sizeof(net_pid))$buf_write_u8(&sub, total_acks)$session_id_defined(sid)$session_id_write(sid, &sub)
API String ID: 2009864989-342039051
Opcode ID: 70ff3f5aafe6d0c3e608be4bcc3d60016af7eb8a5785f2a077ae66c4da1ac179
Instruction ID: 5c203956990b92deb3a6f972323bde7c9349ad18844a83063f8732eb5641bc69
Opcode Fuzzy Hash: 70ff3f5aafe6d0c3e608be4bcc3d60016af7eb8a5785f2a077ae66c4da1ac179
Instruction Fuzzy Hash: D1B1A072B0869286E718CF14E4426BDB361FB95748F998033DA4EA3B95EF3DE561C700

Function 00007FF6D3A89030 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 273networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6D3A89124
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A89260
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A89316
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A89344
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A893C1
fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A893D1

Strings

TUN READ [%d], xrefs: 00007FF6D3A8940C
Recursive routing detected, drop tun packet to %s, xrefs: 00007FF6D3A892F8
[NULL], xrefs: 00007FF6D3A892F1

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$__acrt_iob_funcfprintfhtonsmalloc
String ID: Recursive routing detected, drop tun packet to %s$TUN READ [%d]$[NULL]
API String ID: 3903222774-2675889498
Opcode ID: 63d34ef77cd91b1ba0c10f91e9a4bdef5d7e429bfd58355ff0d593a7de93a102
Instruction ID: af3cf746e996f72629d7eb10773cf7936279cbc17ec713febc724c5e09049011
Opcode Fuzzy Hash: 63d34ef77cd91b1ba0c10f91e9a4bdef5d7e429bfd58355ff0d593a7de93a102
Instruction Fuzzy Hash: BEC1B231B0DAC286FA688B14D0462BDE761FF95B84F1C413BDA8DA7695DF2DE461C700

Function 00007FF8A730AFC0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 221COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A730B072
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A730B09A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A730B0C7
std::_Facet_Register.LIBCPMT ref: 00007FF8A730B140
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A730B15A

Strings

ios_base::failbit set, xrefs: 00007FF8A730B271
ios_base::badbit set, xrefs: 00007FF8A730AFCA, 00007FF8A730B265
ios_base::eofbit set, xrefs: 00007FF8A730B278

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: ae36f19732c932597b5844d0a3fb4f29e7d0a6ae9c94f9270082f884d151e169
Instruction ID: f92385ecc12b26f9191d433ef234ada35c347cd6f0ac12d2052b063e4b5a9232
Opcode Fuzzy Hash: ae36f19732c932597b5844d0a3fb4f29e7d0a6ae9c94f9270082f884d151e169
Instruction Fuzzy Hash: C891A12260AE86A2EB14CF59E8407BD77A1FB85BC4F968136DA5D037A8DF3CD446D340

Function 00007FF8A730CDF0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 209COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A730CEA1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A730CEC9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A730CEF6
std::_Facet_Register.LIBCPMT ref: 00007FF8A730CF6F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A730CF89

Strings

ios_base::failbit set, xrefs: 00007FF8A730D09D
ios_base::badbit set, xrefs: 00007FF8A730CDF9, 00007FF8A730D091
ios_base::eofbit set, xrefs: 00007FF8A730D0A4

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: c378aed81a43e763c1c53613780900e82769c63051f92f051ee39f01bb75cd14
Instruction ID: 7862f4f2a7c968d7325ba23ec3f3af255b25223c7ad541710db8fba6d6a7de60
Opcode Fuzzy Hash: c378aed81a43e763c1c53613780900e82769c63051f92f051ee39f01bb75cd14
Instruction Fuzzy Hash: 0D917A2260AE82A2EB10CF59D4803BD77A0FB85BD4F968136DA4D037A5DF3CD44AE741

Function 00007FF6D3A9D800 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 196COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF6D3A9D875
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00007FF6D3A9E3C7), ref: 00007FF6D3A9D8F0

Part of subcall function 00007FF6D3B13CB0: WSAEventSelect.WS2_32 ref: 00007FF6D3B13CDB
Part of subcall function 00007FF6D3B13CB0: ResetEvent.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D07
Part of subcall function 00007FF6D3B13CB0: CloseHandle.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D39
Part of subcall function 00007FF6D3B13CB0: ResetEvent.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13D72
Part of subcall function 00007FF6D3B13CB0: CloseHandle.KERNEL32(?,?,FFFFFFFF,00007FF6D3A9D860), ref: 00007FF6D3B13DA5

pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1(?,00000000,?,00007FF6D3A9E3C7), ref: 00007FF6D3A9D934
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00007FF6D3A9E3C7), ref: 00007FF6D3A9D979

Strings

MANAGEMENT: Triggering management signal, xrefs: 00007FF6D3A9D9FF
management-exit, xrefs: 00007FF6D3A9DB12
management-disconnect, xrefs: 00007FF6D3A9DA66
MANAGEMENT: Client disconnected, xrefs: 00007FF6D3A9D911
MANAGEMENT: Triggering management exit, xrefs: 00007FF6D3A9DAA5

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Event$CloseHandleResetfree$Any_exSelectclosesocketpkcs11h_certificate_sign
String ID: MANAGEMENT: Client disconnected$MANAGEMENT: Triggering management exit$MANAGEMENT: Triggering management signal$management-disconnect$management-exit
API String ID: 3472691461-2089480344
Opcode ID: 39ae9d9a82c9bd800dbf03112b369a2cbffbd71b41f7e527b6339952b6648c2a
Instruction ID: ab9758bbd19863226c3a052807d8ce51d927c52aef517e26e0060f80c660e5bd
Opcode Fuzzy Hash: 39ae9d9a82c9bd800dbf03112b369a2cbffbd71b41f7e527b6339952b6648c2a
Instruction Fuzzy Hash: 12918F31B0A74281FA18CF19984627DB7A1FB55780F980036CA9EB7792CE3EE4B1C750

Function 00007FF6D3ADB4C0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADB53B

Part of subcall function 00007FF6D3A730B0: isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A730E9
Part of subcall function 00007FF6D3A730B0: isalpha.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A730FE
Part of subcall function 00007FF6D3A730B0: iscntrl.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73122
Part of subcall function 00007FF6D3A730B0: isdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73137
Part of subcall function 00007FF6D3A730B0: ispunct.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73161
Part of subcall function 00007FF6D3A730B0: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73177
Part of subcall function 00007FF6D3A730B0: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A7318D

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3ADB5B7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ADB5C3

Strings

PUSH OPTION FAILED (illegal comma (',') in string): '%s', xrefs: 00007FF6D3ADB59F
push_list->tail, xrefs: 00007FF6D3ADB615
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c, xrefs: 00007FF6D3ADB608
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\push.c, xrefs: 00007FF6D3ADB621, 00007FF6D3ADB640
str, xrefs: 00007FF6D3ADB5FC
!push_list->tail, xrefs: 00007FF6D3ADB634

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$_exitisalnumisalphaiscntrlisdigitispunctisspaceisxdigit
String ID: !push_list->tail$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\push.c$PUSH OPTION FAILED (illegal comma (',') in string): '%s'$push_list->tail$str
API String ID: 499372264-3458957402
Opcode ID: 3d168319d197b9385ecc075073af28d29e7be0d5b159e38d2ee26df6ce49c654
Instruction ID: 2a5a11f9700bab3f6d16473744065007384121aaccc7d80e5275f6741ea6e72f
Opcode Fuzzy Hash: 3d168319d197b9385ecc075073af28d29e7be0d5b159e38d2ee26df6ce49c654
Instruction Fuzzy Hash: B251C121B0978282EA188B01B4523BDE3A0EF95790F5C4437EE9EA77D5EF7CE4648300

Function 00007FF6D3AB68E0 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A82780: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A827FF
Part of subcall function 00007FF6D3A82780: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82825
Part of subcall function 00007FF6D3A82780: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82867
Part of subcall function 00007FF6D3A82780: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A8288A

Part of subcall function 00007FF6D3A728B0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A728FD

Part of subcall function 00007FF6D3A82780: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82905
Part of subcall function 00007FF6D3A82780: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A829BA

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF6D3AB69A9
GetCurrentProcessId.KERNEL32 ref: 00007FF6D3AB69DC

Strings

daemon, xrefs: 00007FF6D3AB6969
%lli, xrefs: 00007FF6D3AB69AF
daemon_log_redirect, xrefs: 00007FF6D3AB699B
config, xrefs: 00007FF6D3AB6903
verb, xrefs: 00007FF6D3AB6937
daemon_start_time, xrefs: 00007FF6D3AB69D0
daemon_pid, xrefs: 00007FF6D3AB6A03

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memcpy$CurrentProcess__stdio_common_vsprintf_time64free
String ID: %lli$config$daemon$daemon_log_redirect$daemon_pid$daemon_start_time$verb
API String ID: 2839251880-805105325
Opcode ID: 2afe0341ae483b0559f8abe0b923886b8d1d4796520687f8efd3627df63a4e5a
Instruction ID: 47dbe231ba73acc2034c0e32373adf888a6ce1f9301736bf9ef79fc49eb09ac9
Opcode Fuzzy Hash: 2afe0341ae483b0559f8abe0b923886b8d1d4796520687f8efd3627df63a4e5a
Instruction Fuzzy Hash: D141A065B08A8296EB149B61E4423FEF360FB85780F884037DB8DA7666DE7CE424C340

Function 00007FF6D3AEF110 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

X509_NAME_ENTRY_get_object.LIBCRYPTO-3-X64 ref: 00007FF6D3AEF128
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AEF131
EVP_CIPHER_CTX_get_iv_length.LIBCRYPTO-3-X64 ref: 00007FF6D3AEF140
EVP_CIPHER_CTX_get_iv_length.LIBCRYPTO-3-X64 ref: 00007FF6D3AEF153
memcpy.VCRUNTIME140 ref: 00007FF6D3AEF170

Strings

impl_iv_len <= OPENVPN_MAX_IV_LENGTH, xrefs: 00007FF6D3AEF1A2
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AEF195, 00007FF6D3AEF1AE
TLS Error: key_state not authenticated, xrefs: 00007FF6D3AEF20C
cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN, xrefs: 00007FF6D3AEF189

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: X_get_iv_length$R_get_flagsX509_Y_get_objectmemcpy
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$TLS Error: key_state not authenticated$cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN$impl_iv_len <= OPENVPN_MAX_IV_LENGTH
API String ID: 1461605756-1230769003
Opcode ID: 37b23c6766837c3aa39fa4814754199588c55890a044f5c4c5ef1e2766eff095
Instruction ID: 023004e47a3b834a9b1c1ae89e6fd8bf9a0cddab0f9b4de7ef621d353e747a14
Opcode Fuzzy Hash: 37b23c6766837c3aa39fa4814754199588c55890a044f5c4c5ef1e2766eff095
Instruction Fuzzy Hash: 8F31CE36B19A8281FB189B11E8161BDE361EF99B84F580033DA8EE3799CF3CD461C300

Function 00007FF6D3A7E420 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_id.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E457
EVP_PKEY_derive_init.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E473
EVP_md5_sha1.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E47D
EVP_PKEY_CTX_set_tls1_prf_md.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E489
EVP_PKEY_CTX_set1_tls1_prf_secret.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E49C
EVP_PKEY_CTX_add1_tls1_prf_seed.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E4AF
EVP_PKEY_derive.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E4D1
EVP_PKEY_CTX_free.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,00007FF6D3A7A07E), ref: 00007FF6D3A7E4EE

Strings

authname, xrefs: 00007FF6D3A7E428

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: P_md5_sha1X_add1_tls1_prf_seedX_freeX_new_idX_set1_tls1_prf_secretX_set_tls1_prf_mdY_deriveY_derive_init
String ID: authname
API String ID: 2490367723-2175095425
Opcode ID: 5a1e9b2602f428c6c9f60f4ea7ed1d7647e9b02976b5a3e4d8b420d2571cd78d
Instruction ID: 36bd9f25e38027b343ac90eccb89fcd151aa521ce7da7f6766309a739042a3b6
Opcode Fuzzy Hash: 5a1e9b2602f428c6c9f60f4ea7ed1d7647e9b02976b5a3e4d8b420d2571cd78d
Instruction Fuzzy Hash: 4321A421B09A4241FA748B22A896A3EE395BF9AFD0F0C0032ED8DD6754DE3CD456C700

Function 00007FF6D3A9B440 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 168COMMON

Download Yara Rule

Strings

ERROR: client-deny command failed, xrefs: 00007FF6D3A9B69E
%lu, xrefs: 00007FF6D3A9B464, 00007FF6D3A9B5C1
client-deny, xrefs: 00007FF6D3A9B6BF
SUCCESS: client-deny command succeeded, xrefs: 00007FF6D3A9B682
ERROR: cannot parse CID, xrefs: 00007FF6D3A9B49F, 00007FF6D3A9B5E7
ERROR: The '%s' command is not supported by the current daemon mode, xrefs: 00007FF6D3A9B6C6
KID, xrefs: 00007FF6D3A9B4DE, 00007FF6D3A9B628
ERROR: cannot parse %s, xrefs: 00007FF6D3A9B4EA, 00007FF6D3A9B62F

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: __stdio_common_vsscanf
String ID: %lu$ERROR: The '%s' command is not supported by the current daemon mode$ERROR: cannot parse %s$ERROR: cannot parse CID$ERROR: client-deny command failed$KID$SUCCESS: client-deny command succeeded$client-deny
API String ID: 3384879002-1508161416
Opcode ID: 97276d3129f16ec78e2f702c308d638d6f119418f6005ca91b8eee5709fecf5e
Instruction ID: aaffc8b19828411d5d2391354137d8c4d3297e007d3acaad810afd2c074c5a12
Opcode Fuzzy Hash: 97276d3129f16ec78e2f702c308d638d6f119418f6005ca91b8eee5709fecf5e
Instruction Fuzzy Hash: 6B618E65B1C69282FB189B10B4122BCA361AF56B84F880037DB8DBB395DF7EE4658611

Function 00007FF6D3A8F7C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 181COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6D3A8F84B

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF6D3A8FA06

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3A8FA81
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c, xrefs: 00007FF6D3A8FA9A
All connections have been connect-retry-max (%d) times unsuccessful, exiting, xrefs: 00007FF6D3A8F9F0
No usable connection profiles are present, xrefs: 00007FF6D3A8FA1B
proto >= 0 && proto < PROTO_N, xrefs: 00007FF6D3A8FA75
c->c1.link_socket_addr.current_remote == NULL, xrefs: 00007FF6D3A8FA8E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exit$freeaddrinfo
String ID: All connections have been connect-retry-max (%d) times unsuccessful, exiting$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$No usable connection profiles are present$c->c1.link_socket_addr.current_remote == NULL$proto >= 0 && proto < PROTO_N
API String ID: 1126526534-496913841
Opcode ID: a8ac9ce0c51e151ff2257f435da88e249651d408c73ff58dbca2df75d68f8f66
Instruction ID: 8d1db80adbdc9860e5e3b681ce6a1d3353ad2d7dce73d29c1c39f64dee4a0e3b
Opcode Fuzzy Hash: a8ac9ce0c51e151ff2257f435da88e249651d408c73ff58dbca2df75d68f8f66
Instruction Fuzzy Hash: 8C814027E08AC286F7598F2495513FCB360FB95B48F1C9636CE4DA7656DF28A9E0C310

Function 00007FF8A73196A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A7319708
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8A7319750
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A731988D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A73198A6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A73198B9

Strings

true, xrefs: 00007FF8A73197F5
false, xrefs: 00007FF8A73197C3
bad locale name, xrefs: 00007FF8A73198AC

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 461674175-1062449267
Opcode ID: 2bbbc5f0733c6cd03d5c2c042ad4d42d3ca16ece7ecde42aec9f180b2c002dae
Instruction ID: 6a528bc66ed35a5a0202fa786e88cd16296e27c92402b57afe929b256955a52a
Opcode Fuzzy Hash: 2bbbc5f0733c6cd03d5c2c042ad4d42d3ca16ece7ecde42aec9f180b2c002dae
Instruction Fuzzy Hash: 02513C22B0BB81AAFB15DFB0D4503BD23B5EF44788F450035DE4D27A9ADE38A516E384

Function 00007FF6D3AE2500 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 106stringCOMMON

Download Yara Rule

APIs

inet_pton.WS2_32 ref: 00007FF6D3AE2616
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3AE2637

Strings

succeeded, xrefs: 00007FF6D3AE2673
addition, xrefs: 00007FF6D3AE2694
deletion, xrefs: 00007FF6D3AE268A
failed because route exists, xrefs: 00007FF6D3AE267A
IPv6 route %s via service %s, xrefs: 00007FF6D3AE269B
fe80::8, xrefs: 00007FF6D3AE260F

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: inet_ptonstrncpy
String ID: IPv6 route %s via service %s$addition$deletion$failed because route exists$fe80::8$succeeded
API String ID: 2240044981-3542334874
Opcode ID: 6ab7d6a95ff79d01ec057e323377859442ccd9b3c672a3db551d166113cd8552
Instruction ID: 4ab0b7042b306a30cb73191c19fac74e392004183fca26a671b95dcb3018a856
Opcode Fuzzy Hash: 6ab7d6a95ff79d01ec057e323377859442ccd9b3c672a3db551d166113cd8552
Instruction Fuzzy Hash: 69514E72E14B858AF710CF28D8423BDA3A0F7A9358F141336EAC8A6955DF7CD554CB40

Function 00007FF6D3AF6C80 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF6D3AEC189), ref: 00007FF6D3AF6D0D
SSL_CTX_set_ciphersuites.LIBSSL-3-X64(?,?,00007FF6D3AEC189), ref: 00007FF6D3AF6D66
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00007FF6D3AEC189), ref: 00007FF6D3AF6DA8

Strings

Failed to set restricted TLS 1.3 cipher list: %s, xrefs: 00007FF6D3AF6D97
_, xrefs: 00007FF6D3AF6D37
Failed to set restricted TLS 1.3 cipher list, too long (>%d)., xrefs: 00007FF6D3AF6CE9
NULL != ctx, xrefs: 00007FF6D3AF6DC8
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c, xrefs: 00007FF6D3AF6DD4

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: X_set_ciphersuites_exitstrncpy
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl_openssl.c$Failed to set restricted TLS 1.3 cipher list, too long (>%d).$Failed to set restricted TLS 1.3 cipher list: %s$NULL != ctx$_
API String ID: 52668442-3140465670
Opcode ID: fee5b040037e2ff91fbff0099542831c3b0ccd76b33e231e10cd42e5ec0b5184
Instruction ID: 0511379a801300cda74eb0d3a898a2e8d751129fab917713a4b0d0b1ed871456
Opcode Fuzzy Hash: fee5b040037e2ff91fbff0099542831c3b0ccd76b33e231e10cd42e5ec0b5184
Instruction Fuzzy Hash: CE31F261B0998641FE689720D4063BCE390AF597A4F880733E9ADB33E6DE2CE4658300

Function 00007FF6D3AD4030 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D3AD4068

Part of subcall function 00007FF6D3A7C6A0: RAND_bytes.LIBCRYPTO-3-X64(?,?,?,?,?,?,00007FF6D3AD4077), ref: 00007FF6D3A7C6BD

Part of subcall function 00007FF6D3A728B0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A728FD

Part of subcall function 00007FF6D3AD41A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,?,00000001,?,?,00007FF6D3AD40BE), ref: 00007FF6D3AD41FB
Part of subcall function 00007FF6D3AD41A0: memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,?,00000001,?,?,00007FF6D3AD40BE), ref: 00007FF6D3AD4224
Part of subcall function 00007FF6D3AD41A0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,?,00000001,?,?,00007FF6D3AD40BE), ref: 00007FF6D3AD42C6

Part of subcall function 00007FF6D3AD3E60: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3AD3EA7
Part of subcall function 00007FF6D3AD3E60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD3EBE
Part of subcall function 00007FF6D3AD3E60: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3AD3EF2
Part of subcall function 00007FF6D3AD3E60: _wopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AD3F01
Part of subcall function 00007FF6D3AD3E60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD3F16

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AD40DE
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AD4138

Strings

Could not create temporary file '%s', xrefs: 00007FF6D3AD4123
ERROR: temporary filename too long, xrefs: 00007FF6D3AD4168
openvpn_%.*s_%08lx%08lx.tmp, xrefs: 00007FF6D3AD408C
Failed to create temporary file after %i attempts, xrefs: 00007FF6D3AD40FF
Failed to create temporary filename and path, xrefs: 00007FF6D3AD4151

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$ByteCharMultiWide$D_bytes__stdio_common_vsprintf_close_errno_wopenfreememcpymemset
String ID: Could not create temporary file '%s'$ERROR: temporary filename too long$Failed to create temporary file after %i attempts$Failed to create temporary filename and path$openvpn_%.*s_%08lx%08lx.tmp
API String ID: 2358830433-1228773596
Opcode ID: 7316762ab04186718baadfd261e2a91ec3064222fddb52315ddd0c1f62c6a8e9
Instruction ID: 696e965a182b8e538de5b3b2295f2f307d48ea7dc7af1f051832da39fa2702d9
Opcode Fuzzy Hash: 7316762ab04186718baadfd261e2a91ec3064222fddb52315ddd0c1f62c6a8e9
Instruction Fuzzy Hash: E1316061B0964381FA69AB52A8433BD9351AFD9784F480037EE4DBB3D6EE3CE4258200

Function 00007FF6D3AE54E0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 93networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF6D3AE5534
socket.WS2_32 ref: 00007FF6D3AE5560
socket.WS2_32 ref: 00007FF6D3AE5597

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.c, xrefs: 00007FF6D3AE5517, 00007FF6D3AE5652
TCP/UDP, xrefs: 00007FF6D3AE55EA
SOCKS, xrefs: 00007FF6D3AE55D6
addrinfo->ai_socktype == SOCK_STREAM, xrefs: 00007FF6D3AE5634
addrinfo->ai_socktype == SOCK_DGRAM, xrefs: 00007FF6D3AE5646

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: socket
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.c$SOCKS$TCP/UDP$addrinfo->ai_socktype == SOCK_DGRAM$addrinfo->ai_socktype == SOCK_STREAM
API String ID: 98920635-2676201798
Opcode ID: f1c6ba66c7c2ddfab39a2257a9d0e31be517bda3467ad5295e6d084e0c0a539d
Instruction ID: 6ebe2b4cf70fba4c9c7ac3fffb94f48508d20d383ba818b1f5e42b1b44f1308e
Opcode Fuzzy Hash: f1c6ba66c7c2ddfab39a2257a9d0e31be517bda3467ad5295e6d084e0c0a539d
Instruction Fuzzy Hash: E541A176B08B8686E324CF14E4062ACB361FB59B44F588133DA9CE3654DF3CE9A5C710

Function 00007FF6D3A98FC6 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A990AB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A990B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A990FD

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\lzo.c, xrefs: 00007FF6D3A990DC
LZO compression initializing, xrefs: 00007FF6D3A99010
0, xrefs: 00007FF6D3A9902A
!(compctx->flags & COMP_F_SWAP), xrefs: 00007FF6D3A990D0
Cannot initialize LZO compression library (lzo_init() returns %d), xrefs: 00007FF6D3A99095

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exitfreemalloc
String ID: !(compctx->flags & COMP_F_SWAP)$0$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\lzo.c$Cannot initialize LZO compression library (lzo_init() returns %d)$LZO compression initializing
API String ID: 1270427896-686791244
Opcode ID: b39e45e575254caf258601cc2a2dfa6c1260b80f100a7ab0dc2a800c7daf6355
Instruction ID: 032ade57da72eb484279185c3c3c9f34d81f7f5144812a27be518e26c0ab5a62
Opcode Fuzzy Hash: b39e45e575254caf258601cc2a2dfa6c1260b80f100a7ab0dc2a800c7daf6355
Instruction Fuzzy Hash: EC31E1B6A1964287F7444F10E4163ADA7A1FF55B48F48403ACB8CAA381DF3EE4A4C740

Function 00007FF6D3AA1D00 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AA1DEB), ref: 00007FF6D3AA1D5B
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AA1DEB), ref: 00007FF6D3AA1D77
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AA1E32

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c, xrefs: 00007FF6D3AA1CCA, 00007FF6D3AA1E45
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h, xrefs: 00007FF6D3AA1B22, 00007FF6D3AA1CE9, 00007FF6D3AA1E64
attempted allocation of excessively large array, xrefs: 00007FF6D3AA1E1C
0 <= x && x < mod && -mod <= y && y <= mod, xrefs: 00007FF6D3AA1B16, 00007FF6D3AA1CDD, 00007FF6D3AA1E58
capacity > 0, xrefs: 00007FF6D3AA1E39

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exitmallocmemset
String ID: 0 <= x && x < mod && -mod <= y && y <= mod$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\integer.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\manage.c$attempted allocation of excessively large array$capacity > 0
API String ID: 1198423990-458266078
Opcode ID: f969d6308fd081ac9cef798b3c2ed954c83a64a42c3a3fe6571f1acd3367c007
Instruction ID: a98dea16fc9973dde74e5ec32670cdf6c8cfd2c73221e3b45ccf4135d689ef6c
Opcode Fuzzy Hash: f969d6308fd081ac9cef798b3c2ed954c83a64a42c3a3fe6571f1acd3367c007
Instruction Fuzzy Hash: DB21D136F0968252FA6C9B50A5021BDE361BF91790F58453BD69DA2BD5DF3CE461C300

Function 00007FF6D3AA7050 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3AA70BA
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3AA70CB
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AA70D9
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AA70E8
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3AA70F7
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3AA7112

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c, xrefs: 00007FF6D3AA713D
ciphername, xrefs: 00007FF6D3AA7131

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_freeR_get_flags$R_fetchR_get_mode
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\crypto_openssl.c$ciphername
API String ID: 715063678-1112096609
Opcode ID: 8845ca7f6731cdd291132470a3a0749f533c83a7e3be9d5822a6932e5e35eee2
Instruction ID: a7b5f677bff0fc76c54993d2706cfa47bbf0a495076166a437e9fa0c36f1c4e5
Opcode Fuzzy Hash: 8845ca7f6731cdd291132470a3a0749f533c83a7e3be9d5822a6932e5e35eee2
Instruction Fuzzy Hash: FB21D672B0964282FA689B51AC4757EE391AF56BC0F4C0437DD4EE3BA5CE3DE4628340

Function 00007FF6D3A96870 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96974
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A969A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96AC7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96AF1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96AFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96B83
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96BB4

Part of subcall function 00007FF6D3A82A70: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82AF4
Part of subcall function 00007FF6D3A82A70: memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3AE913E), ref: 00007FF6D3A82B18

Strings

[CONFIG-STRING], xrefs: 00007FF6D3A96A6D
config, xrefs: 00007FF6D3A969D4

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$mallocmemset
String ID: [CONFIG-STRING]$config
API String ID: 2682772760-1041147310
Opcode ID: 2e1101ccff736f3771e331c375d9349640165a33fcdd84cb7113b8e76760d344
Instruction ID: 1ac1481d69496d83e8c046ded59963d1505266c009dd67168970c99e0a7e2e8e
Opcode Fuzzy Hash: 2e1101ccff736f3771e331c375d9349640165a33fcdd84cb7113b8e76760d344
Instruction Fuzzy Hash: D4A17D76B19A8182EB148F11A1053AEE761FF45BE4F884132CE9DA7B58DF3DE4248710

Function 00007FF6D3AEE810 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AEE86A
memcpy.VCRUNTIME140 ref: 00007FF6D3AEE8EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AEEA9C

Part of subcall function 00007FF6D3A83290: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF6D3AD0D21), ref: 00007FF6D3A832FD

Part of subcall function 00007FF6D3A72610: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A72640
Part of subcall function 00007FF6D3A72610: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A72690

Part of subcall function 00007FF6D3A83310: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A83319
Part of subcall function 00007FF6D3A83310: fprintf.MSPDB140-MSVCRT ref: 00007FF6D3A83329
Part of subcall function 00007FF6D3A83310: exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A83333

Strings

buf_write(&seed, client_seed, client_seed_len), xrefs: 00007FF6D3AEEB3F
buf_write(&seed, server_sid->id, SID_SIZE), xrefs: 00007FF6D3AEEB0D
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c, xrefs: 00007FF6D3AEEAD8, 00007FF6D3AEEB00, 00007FF6D3AEEB19, 00007FF6D3AEEB32, 00007FF6D3AEEB4B
buf_write(&seed, label, strlen(label)), xrefs: 00007FF6D3AEEACC
buf_write(&seed, server_seed, server_seed_len), xrefs: 00007FF6D3AEEB26
buf_write(&seed, client_sid->id, SID_SIZE), xrefs: 00007FF6D3AEEAF4

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exit$__acrt_iob_funccallocexitfprintffreemallocmemcpy
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\ssl.c$buf_write(&seed, client_seed, client_seed_len)$buf_write(&seed, client_sid->id, SID_SIZE)$buf_write(&seed, label, strlen(label))$buf_write(&seed, server_seed, server_seed_len)$buf_write(&seed, server_sid->id, SID_SIZE)
API String ID: 4148537450-1787283480
Opcode ID: 2650bb3fbaf213049b268901b54fd3493438d21fb76e8792f9431e8d2f689eb6
Instruction ID: 6e4fd92fb843fa378e49508022806427c69e5df7e333290ce18a8f705cd1d48c
Opcode Fuzzy Hash: 2650bb3fbaf213049b268901b54fd3493438d21fb76e8792f9431e8d2f689eb6
Instruction Fuzzy Hash: B491AE62B0AB8642FA688F1495526BDE391BF64795F1C4137CE8DF3695EF2CE8618200

Function 00007FF6D3A8C800 Relevance: 13.6, APIs: 9, Instructions: 134COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C832
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C872
htonl.WS2_32 ref: 00007FF6D3A8C8A9
inet_ntoa.WS2_32 ref: 00007FF6D3A8C8B1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C8F6
htonl.WS2_32 ref: 00007FF6D3A8C92E
inet_ntoa.WS2_32 ref: 00007FF6D3A8C936
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C97F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8C9A1

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$htonlinet_ntoa
String ID:
API String ID: 3620171695-0
Opcode ID: 10eaef6022dd912c5987964535a32e6fe1b46fec7c074d663837a341a1ea8ede
Instruction ID: b6e3c39a38e8f0bceecbd010cc635dc3c78b933825d1978faaaf5dfaea799a15
Opcode Fuzzy Hash: 10eaef6022dd912c5987964535a32e6fe1b46fec7c074d663837a341a1ea8ede
Instruction Fuzzy Hash: 34514872F05B8185EB158F60D84136CB7A4FB98B88F09893ACE8DA7758DF38D5A1C750

Function 00007FF8A7381504 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8A7381561

Part of subcall function 00007FF8A73838C4: __GetUnwindTryBlock.LIBCMT ref: 00007FF8A7383907
Part of subcall function 00007FF8A73838C4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8A738392C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8A7381639
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8A7381887
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A7381994

Strings

csm, xrefs: 00007FF8A73815E2
csm, xrefs: 00007FF8A738165C
csm, xrefs: 00007FF8A738157B

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: a78da6a6e3c7b0897b4426343e9c861a9905db6cece76cf5b09d417524f078c9
Instruction ID: 84c64551bfb03eb08c62c9afe99610e106262bbcebe7e39dd88cfd46526a6bb0
Opcode Fuzzy Hash: a78da6a6e3c7b0897b4426343e9c861a9905db6cece76cf5b09d417524f078c9
Instruction Fuzzy Hash: 26D19D32A09B429AFB209F2594403AD37A4FB457D8F960139EF8D57B99CF38E081D780

Function 00007FF6D3AE58D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE5932

Part of subcall function 00007FF6D3AE8AB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE8B02
Part of subcall function 00007FF6D3AE8AB0: memset.VCRUNTIME140 ref: 00007FF6D3AE8B4C
Part of subcall function 00007FF6D3AE8AB0: getnameinfo.WS2_32 ref: 00007FF6D3AE8C50
Part of subcall function 00007FF6D3AE8AB0: FormatMessageA.KERNEL32 ref: 00007FF6D3AE8C87

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE59E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE5A14
select.WS2_32 ref: 00007FF6D3AE5B0A

Strings

TCP: select() failed, xrefs: 00007FF6D3AE5B4E
TCP connection established with %s, xrefs: 00007FF6D3AE59C7
[NULL], xrefs: 00007FF6D3AE59C0

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: freemalloc$FormatMessage__stdio_common_vsprintfgetnameinfomemsetselect
String ID: TCP connection established with %s$TCP: select() failed$[NULL]
API String ID: 1445296572-636655359
Opcode ID: 035fa19e43ec3b68393c5302fa05d6617634575ba03c4576347e51a8d35b93a3
Instruction ID: 620e1d384f913633cc62af5b42fbad7b0494a22685e88f788f5b31683cceec23
Opcode Fuzzy Hash: 035fa19e43ec3b68393c5302fa05d6617634575ba03c4576347e51a8d35b93a3
Instruction Fuzzy Hash: 88718F32B09B4286EB148F61E8422ADB7A1FB59B84F484136DE8CB7755EF3CE464C740

Function 00007FF6D3AE2D00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3B14D80: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3B14E2B
Part of subcall function 00007FF6D3B14D80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B14E42
Part of subcall function 00007FF6D3B14D80: MultiByteToWideChar.KERNEL32 ref: 00007FF6D3B14E76
Part of subcall function 00007FF6D3B14D80: GetStartupInfoW.KERNEL32 ref: 00007FF6D3B14EAA
Part of subcall function 00007FF6D3B14D80: CreateProcessW.KERNEL32 ref: 00007FF6D3B14EFC

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE2D72
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,?,00000000,?,00000000,00007FF6D3B01B7C), ref: 00007FF6D3AE2E2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,?,00000000,?,00000000,00007FF6D3B01B7C), ref: 00007FF6D3AE2E46

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

Strings

returned error code %d, xrefs: 00007FF6D3AE2DE9
disallowed by script-security setting, xrefs: 00007FF6D3AE2DFC
%s: %s, xrefs: 00007FF6D3AE2E12
external program did not execute -- , xrefs: 00007FF6D3AE2DD5

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ByteCharMultiWidemalloc$CreateInfoProcessStartup__stdio_common_vsprintf_exitfree
String ID: %s: %s$disallowed by script-security setting$external program did not execute -- $returned error code %d
API String ID: 364472425-2576239307
Opcode ID: 30aa50b1cc64e4c9aa32d38aef4916a46f110dea9d5845b03e2ad2b759705571
Instruction ID: d3026292b1c806c1894954fa65b0f1baeb5a575bea3a090838a7d8018df46360
Opcode Fuzzy Hash: 30aa50b1cc64e4c9aa32d38aef4916a46f110dea9d5845b03e2ad2b759705571
Instruction Fuzzy Hash: B2310922F0975245FA69AB14D84237DA650AF457E4F0C0232EF9DF72D2EE3CE8A58340

Function 00007FF6D3AD13E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

_lseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6D3A8739E), ref: 00007FF6D3AD143F
_write.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6D3A8739E), ref: 00007FF6D3AD1459
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6D3A8739E), ref: 00007FF6D3AD14C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF6D3A8739E), ref: 00007FF6D3AD14F4

Strings

PID Persist Write to %s: %s, xrefs: 00007FF6D3AD14A6
Cannot seek to beginning of --replay-persist file %s, xrefs: 00007FF6D3AD1572
Cannot write to --replay-persist file %s, xrefs: 00007FF6D3AD1534

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$_lseek_write
String ID: Cannot seek to beginning of --replay-persist file %s$Cannot write to --replay-persist file %s$PID Persist Write to %s: %s
API String ID: 125306588-1022700147
Opcode ID: 507c9921a6bf259edab28b467e75d4402c693576ec4276d9871235bd2cb955bc
Instruction ID: 4fc82231ae5265316057a6806e0fed40fa31bb98fb35d57ea7e59d3642598f8c
Opcode Fuzzy Hash: 507c9921a6bf259edab28b467e75d4402c693576ec4276d9871235bd2cb955bc
Instruction Fuzzy Hash: EE416275B0964282FA58DF51E45217DA3A1FF99B88B480037DE8EAB795EF2CE460C740

Function 00007FF6D3AE8FC0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 109networkCOMMON

Download Yara Rule

APIs

inet_ntoa.WS2_32 ref: 00007FF6D3AE9065
getnameinfo.WS2_32 ref: 00007FF6D3AE90D4

Part of subcall function 00007FF6D3A728B0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A728FD

inet_ntoa.WS2_32 ref: 00007FF6D3AE9125
htons.WS2_32 ref: 00007FF6D3AE916D

Strings

%s_ip6, xrefs: 00007FF6D3AE9094
%s_port, xrefs: 00007FF6D3AE9150
%s_ip, xrefs: 00007FF6D3AE9052, 00007FF6D3AE9102

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: inet_ntoa$__stdio_common_vsprintfgetnameinfohtons
String ID: %s_ip$%s_ip6$%s_port
API String ID: 1258181430-2106722284
Opcode ID: 1b7130d6b215a8b6779ff709217f3c4be457873b4132bb16e10ffe9d66be98e5
Instruction ID: 91a4385046ddaad41d344bb7728a2c508ea4fcd3d106302618e79d5d75a3e516
Opcode Fuzzy Hash: 1b7130d6b215a8b6779ff709217f3c4be457873b4132bb16e10ffe9d66be98e5
Instruction Fuzzy Hash: B3419021B0878295F7649B51E8463FDA360FB98384F444037DA8CE3695DF7CE9A9C780

Function 00007FF6D3A88CE0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 194COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6D3A88E42
GetLastError.KERNEL32 ref: 00007FF6D3A88F21

Strings

tun-stop, xrefs: 00007FF6D3A88EB4
Wintun read error, restarting, xrefs: 00007FF6D3A88DE5
read from TUN/TAP, xrefs: 00007FF6D3A8900E
TUN/TAP interface has been stopped, exiting, xrefs: 00007FF6D3A88EED
TUN/TAP I/O operation aborted, restarting, xrefs: 00007FF6D3A88FD0
tun-abort, xrefs: 00007FF6D3A88DA2, 00007FF6D3A88F95

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ErrorLast
String ID: TUN/TAP I/O operation aborted, restarting$TUN/TAP interface has been stopped, exiting$Wintun read error, restarting$read from TUN/TAP$tun-abort$tun-stop
API String ID: 1452528299-1065770873
Opcode ID: b65dd028b4a01c0c1ecef52cbdb649a562fec86fa313eb3c398e44466420914d
Instruction ID: 51d319e588707e10676f7890e32c14831a05306233300add7dd9f48ec7ffaec9
Opcode Fuzzy Hash: b65dd028b4a01c0c1ecef52cbdb649a562fec86fa313eb3c398e44466420914d
Instruction Fuzzy Hash: B1910636B19A8286EB188B18D4462BDB361FB55748F580233DB4DA7392DF7EE466C700

Function 00007FF6D3A957C0 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9598F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A959B0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A95A28
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A95A45

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c, xrefs: 00007FF6D3A94D60, 00007FF6D3A9575B, 00007FF6D3A95774, 00007FF6D3A9578D, 00007FF6D3A95AAB
c->c2.tls_multi->opt.frame.buf.payload_size <= c->c2.frame.buf.payload_size, xrefs: 00007FF6D3A95A9F
Control Channel MTU parms, xrefs: 00007FF6D3A9588B
TLS-Auth MTU parms, xrefs: 00007FF6D3A95923

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c$Control Channel MTU parms$TLS-Auth MTU parms$c->c2.tls_multi->opt.frame.buf.payload_size <= c->c2.frame.buf.payload_size
API String ID: 2803490479-1686647437
Opcode ID: 3cc821615a7bbed5806c2d98cff0304c998a3a0bfe8fd136ee9d229b5b2638d2
Instruction ID: 90e61c0deba3f25dd4cb4bb6800ae3db94a349173b43ac7258d205bc0b1c6a36
Opcode Fuzzy Hash: 3cc821615a7bbed5806c2d98cff0304c998a3a0bfe8fd136ee9d229b5b2638d2
Instruction Fuzzy Hash: 11816E72A0AB9286E719CF24D4463BDB3A0FB84B44F488436DB4DAB745DF3DA1618750

Function 00007FF6D3B0FD10 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0FDCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0FE49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0FE74

Part of subcall function 00007FF6D3ADB6B0: memset.VCRUNTIME140 ref: 00007FF6D3ADB6ED
Part of subcall function 00007FF6D3ADB6B0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3ADB722

Strings

PUSH_REPLY, xrefs: 00007FF6D3B0FDF1
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\push.c, xrefs: 00007FF6D3B0FECD
%s,%s, xrefs: 00007FF6D3B0FDFE
auth-token %s, xrefs: 00007FF6D3B0FD75
e && e->enable, xrefs: 00007FF6D3B0FEC1

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$__stdio_common_vsprintfmallocmemset
String ID: %s,%s$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\push.c$PUSH_REPLY$auth-token %s$e && e->enable
API String ID: 971417895-3553449491
Opcode ID: 80243b0d90376ffe768bfb201f58b5b064922485182c003fa0abf4c7e14ea798
Instruction ID: 07302bcf6c9a9fca37cb1b3ef812678fbab1f0e6d4a6ef0ecb11f11b9b62a0b6
Opcode Fuzzy Hash: 80243b0d90376ffe768bfb201f58b5b064922485182c003fa0abf4c7e14ea798
Instruction Fuzzy Hash: 88515832B19B8582EA108F15E4453ADA760FBAA784F584037DBCCA7B56DF3CE465C700

Function 00007FF6D3AD3D20 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3D65
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3D7C
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DAB
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DC8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3DDF
MultiByteToWideChar.KERNEL32(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E0B
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E17
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000000,?,00007FF6D3A73837), ref: 00007FF6D3AD3E26

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ByteCharMultiWide$malloc$_wfopenfree
String ID:
API String ID: 1984783947-0
Opcode ID: 0ab7ff7130f5dc64fe8effb061116c2fc26fc835f9cfdbe10d65bb4b57b3aaef
Instruction ID: 25f4bcce4809f0f6b8940629385648f01d88658f792b8716296832d34171c4e4
Opcode Fuzzy Hash: 0ab7ff7130f5dc64fe8effb061116c2fc26fc835f9cfdbe10d65bb4b57b3aaef
Instruction Fuzzy Hash: B1314C35709B8186E724DB12B915129E6A2FF89FE0B484A36DEDD53BA8DF3CD1218704

Function 00007FF8A7398664 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A7398A91

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c280af076e365853c823278945fc9871731aa6d0db52d3a7cd996dec465e47a7
Instruction ID: d258b226f5cab1b5cde63315bd0206ff07811beacc3a048a19a1dad9736f6cc5
Opcode Fuzzy Hash: c280af076e365853c823278945fc9871731aa6d0db52d3a7cd996dec465e47a7
Instruction Fuzzy Hash: 56C19F22A0EF87A1E7619F1594502FE7B90EBC1BC0F964131EA8E03791DFBDE855A701

Function 00007FF6D3AD9890 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD99AF

Strings

info, xrefs: 00007FF6D3AD9B53
server-pushed-connection-reset, xrefs: 00007FF6D3AD9A6D
>NOTIFY:%s,%s,%s, xrefs: 00007FF6D3AD9B5F
server-pushed-halt, xrefs: 00007FF6D3AD9B19
Halt command was pushed by server ('%s'), xrefs: 00007FF6D3AD9A93
Connection reset command was pushed by server ('%s'), xrefs: 00007FF6D3AD99E3

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: >NOTIFY:%s,%s,%s$Connection reset command was pushed by server ('%s')$Halt command was pushed by server ('%s')$info$server-pushed-connection-reset$server-pushed-halt
API String ID: 1294909896-3463766527
Opcode ID: 029bf467e3e5cb06b569839f9923e658ca042fae4751e0f6ece5772a5083a5d7
Instruction ID: 2828da4e8915a8c52e6ba65993511fc41421b90fc58e175cdd340fff4f4634de
Opcode Fuzzy Hash: 029bf467e3e5cb06b569839f9923e658ca042fae4751e0f6ece5772a5083a5d7
Instruction Fuzzy Hash: FC91C172F0DA5245FB188B14A84637DA752BFD5784F58413BCE8EE76A1EF2DE4628300

Function 00007FF6D3A730B0 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

isalnum.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A730E9
isalpha.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A730FE
iscntrl.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73122
isdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73137
ispunct.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73161
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A73177
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3A7318D

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: isalnumisalphaiscntrlisdigitispunctisspaceisxdigit
String ID:
API String ID: 689186670-0
Opcode ID: 3d8b7ea4e5b55e451fddadbf5c48f5859d27f9ebf1422fb9d5763c3d302006d5
Instruction ID: 37ba9239931c473ae6e9dee0129dc890a03d40916fcfeb72f462dd3e9ed59a37
Opcode Fuzzy Hash: 3d8b7ea4e5b55e451fddadbf5c48f5859d27f9ebf1422fb9d5763c3d302006d5
Instruction Fuzzy Hash: A3510C92F0820315FF7C861A94DB33C82905F76761E3F0837E94EE11DADE2CA8A591C5

Function 00007FF6D3A84C30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D3A84DB7
SetEvent.KERNEL32 ref: 00007FF6D3A84DD6

Strings

write_wintun(): head/tail value is over capacity, xrefs: 00007FF6D3A84E08
(, xrefs: 00007FF6D3A84CE8
write_wintun(): ring is full, xrefs: 00007FF6D3A84D50
write_wintun(): drop invalid IP packet, xrefs: 00007FF6D3A84CAF

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Eventmemcpy
String ID: ($write_wintun(): drop invalid IP packet$write_wintun(): head/tail value is over capacity$write_wintun(): ring is full
API String ID: 2633924020-835648617
Opcode ID: 9c976046d321c5daaabef31ea2fd9b7f2d4379b3e3fc48bb774411c72165f352
Instruction ID: 45c1dfed740906b664475cb34bed65b0216cd2a8f35f79838d5be9302b6c1f6b
Opcode Fuzzy Hash: 9c976046d321c5daaabef31ea2fd9b7f2d4379b3e3fc48bb774411c72165f352
Instruction Fuzzy Hash: CC519372B0968386EB288F15D04627CE3A5EF49B88F1D8637CA4DE62C5DF2DE460C710

Function 00007FF6D3ABF7E0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 141stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ABF849
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ABF898
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF6D3ABF8E2

Strings

null, xrefs: 00007FF6D3ABF8A7
tap, xrefs: 00007FF6D3ABF869, 00007FF6D3ABF88E
Flag 'def1' added to --redirect-gateway (iservice is in use), xrefs: 00007FF6D3ABF9AB
tun, xrefs: 00007FF6D3ABF81A, 00007FF6D3ABF83F

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: strncmp
String ID: Flag 'def1' added to --redirect-gateway (iservice is in use)$null$tap$tun
API String ID: 1114863663-4091244182
Opcode ID: e3bf40da37610f597e57e7937d6aacc2db90c095ea5dc2726a38caf3cf7a895b
Instruction ID: 53662cde2d1ad619388ca05ca12a751f5276e923fbfe5cc25a848bc4351e2069
Opcode Fuzzy Hash: e3bf40da37610f597e57e7937d6aacc2db90c095ea5dc2726a38caf3cf7a895b
Instruction Fuzzy Hash: 56517233B1C68685FB699B6491553BDA7D0EB06B48F4C0037CA8DEB285CF2DA4B5C311

Function 00007FF8A7302130 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A730219B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8A73021E3
_Getctype.LIBCPMT ref: 00007FF8A73021FB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A73022B3
_Getwctype.LIBCPMT ref: 00007FF8A7302301

Strings

bad locale name, xrefs: 00007FF8A73022D6

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 2aad947bd19f075a4e52962b58b75208e9a7b450cc421c2c1a69ec89a45c616f
Instruction ID: 5c7cea45236812acd75fd1361d97ca0e493d832ef0895062c8a242fe3028bccd
Opcode Fuzzy Hash: 2aad947bd19f075a4e52962b58b75208e9a7b450cc421c2c1a69ec89a45c616f
Instruction Fuzzy Hash: 60519722B0AF81AAFB14DFB0D4502BD2375EF44788F868134DE4D26A56DF38E596A344

Function 00007FF6D3A9B0E0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B132
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9B17E

Part of subcall function 00007FF6D3A733D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AD423F,?,?,?,?,?,?,00000000), ref: 00007FF6D3A733F8
Part of subcall function 00007FF6D3A733D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00007FF6D3AD423F,?,?,?,?,?,?,00000000), ref: 00007FF6D3A7340D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF6D3A9E05C), ref: 00007FF6D3A9B27A

Strings

ERROR: The '%s' command is not supported by the current daemon mode, xrefs: 00007FF6D3A9B247
SUCCESS: client-auth command succeeded, xrefs: 00007FF6D3A9B1FE
client-auth, xrefs: 00007FF6D3A9B23B
ERROR: client-auth command failed, xrefs: 00007FF6D3A9B21A

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: ERROR: The '%s' command is not supported by the current daemon mode$ERROR: client-auth command failed$SUCCESS: client-auth command succeeded$client-auth
API String ID: 1294909896-1509162132
Opcode ID: 5c90ae9984ec12559021e3c70a4e09242f63b21fc7beebda96b26991b49c3cdf
Instruction ID: 26cdefe22437f9248f0b47278b7d2f9daeeeb586707c6ce19ba23859efccdaf1
Opcode Fuzzy Hash: 5c90ae9984ec12559021e3c70a4e09242f63b21fc7beebda96b26991b49c3cdf
Instruction Fuzzy Hash: 4F414A36B1869181EB089F21A1562BCA3A0FB55FC8F5C0037DF4DAB789CFA9E4618750

Function 00007FF6D3B07BE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

GetInterfaceInfo.IPHLPAPI ref: 00007FF6D3B07C15
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B07C70
GetInterfaceInfo.IPHLPAPI ref: 00007FF6D3B07C94
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B07D24

Strings

GetInterfaceInfo #2 failed (status=%u) : %s, xrefs: 00007FF6D3B07CC3
GetInterfaceInfo #1 failed (status=%u) : %s, xrefs: 00007FF6D3B07C4B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: InfoInterfacemalloc
String ID: GetInterfaceInfo #1 failed (status=%u) : %s$GetInterfaceInfo #2 failed (status=%u) : %s
API String ID: 1160929981-4053537578
Opcode ID: 20ea687225693985b825d9f675db70599eb7bd0e2c59c3b1f424d79819cbb345
Instruction ID: 8a1caac2f123c93aef8f5604bf07bc6c4034ec9f08b5575e6cc61ba0928e527d
Opcode Fuzzy Hash: 20ea687225693985b825d9f675db70599eb7bd0e2c59c3b1f424d79819cbb345
Instruction Fuzzy Hash: 4531D531A0A64246FA249F11E95727CE391FF5AB90F484137DADDE73D5EE3CE4618600

Function 00007FF6D3A850A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95networkCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6D3A8514C
WSAGetLastError.WS2_32 ref: 00007FF6D3A85154
SetLastError.KERNEL32 ref: 00007FF6D3A85173
WSASetLastError.WS2_32 ref: 00007FF6D3A8517B

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3A851CA, 00007FF6D3A851E3
proto >= 0 && proto < PROTO_N, xrefs: 00007FF6D3A851BE

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ErrorLast
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$proto >= 0 && proto < PROTO_N
API String ID: 1452528299-2292894683
Opcode ID: f3f3453fa029a2a40a7c200f6fd1cb57bcb53efb1d2c9ff07f3f322976bbecfa
Instruction ID: e2662aa107bd6de4691f9397c9a5093aa8256c735c33ded9a87632acb351d427
Opcode Fuzzy Hash: f3f3453fa029a2a40a7c200f6fd1cb57bcb53efb1d2c9ff07f3f322976bbecfa
Instruction Fuzzy Hash: 9331D072B0C78682F619AB19A5062BDF3A0FF95B84F184132DE4CE66A4CF3CE461C700

Function 00007FF6D3A907C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A9082B

Strings

Sorry but I can't chroot to '%s' because this operating system doesn't appear to support the chroot() system call, xrefs: 00007FF6D3A90815
NOTE: UID/GID downgrade %s, xrefs: 00007FF6D3A908CD
Unable to retain capabilities, xrefs: 00007FF6D3A9088E
will be delayed because of --client, --pull, or --up-delay, xrefs: 00007FF6D3A90852, 00007FF6D3A908C1
NOTE: chroot %s, xrefs: 00007FF6D3A9085E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exit
String ID: NOTE: UID/GID downgrade %s$NOTE: chroot %s$Sorry but I can't chroot to '%s' because this operating system doesn't appear to support the chroot() system call$Unable to retain capabilities$will be delayed because of --client, --pull, or --up-delay
API String ID: 3375166485-2645831157
Opcode ID: 4b62217afb8101fed7bbf5bcae204793e650bb1ed60d810250466e60fac4f71d
Instruction ID: 8683cf1ddf6916169410c57a1fe929f05c73fbca305b114407e1816e4f8bbe9f
Opcode Fuzzy Hash: 4b62217afb8101fed7bbf5bcae204793e650bb1ed60d810250466e60fac4f71d
Instruction Fuzzy Hash: AF316529F0D29255FB58EF1094063BCB651AF457C4F8C50B7DA8CB62D2CF6EA4B4C2A1

Function 00007FF8A7390A80 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A7390A8F
FlsGetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AA4
FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AC5
FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390AF2
FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390B03
FlsSetValue.KERNEL32(?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F,?,?,00000000,00007FF8A739927F), ref: 00007FF8A7390B14
SetLastError.KERNEL32 ref: 00007FF8A7390B2F

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 66954aae8a0f965e19579ab3e5cbea5785de85cb33876fc44346f064b782e7a0
Instruction ID: da78c0605ae61f4cbfb06fd3dd5cbf235056d44684718150b0f434efef36783b
Opcode Fuzzy Hash: 66954aae8a0f965e19579ab3e5cbea5785de85cb33876fc44346f064b782e7a0
Instruction Fuzzy Hash: 58219D20F0FE43A5FA586FA1696127EA141DF447F4F864734E93E077C6DE2DE400A281

Function 00007FF6D3A96060 Relevance: 10.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96078
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96095
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A960B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A960C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A960DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A960F6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9610D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96123

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 7c5113afac96eb19fc914e4bf02e69e2104bcba19fda6e9a5f5128be0f8e1733
Instruction ID: e7d63d7680f6535c011501b9320d3f9eb0e64916afb0511a997b39c5f9c01289
Opcode Fuzzy Hash: 7c5113afac96eb19fc914e4bf02e69e2104bcba19fda6e9a5f5128be0f8e1733
Instruction Fuzzy Hash: 0721BE72D26A5586E744CF35D845279A3A1FFA9B08B595336D98DE6124EF34E4E08300

Function 00007FF6D3ABF420 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D3ABF46F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF502
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF561
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF6A1
memset.VCRUNTIME140 ref: 00007FF6D3ABF6CB

Strings

WARNING: client-nat table overflow (max %d entries), xrefs: 00007FF6D3ABF726

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memset
String ID: WARNING: client-nat table overflow (max %d entries)
API String ID: 3081043919-3323060333
Opcode ID: a0c93abc6a6e11a9b24bd8e6f8d1d7df6c48477f75ac9a8cf5fbb92833b25f8d
Instruction ID: 731ba10ad25b49a076c7bbadf73b4f5ac025ab8dea0fe82c73087a0efaea4c5a
Opcode Fuzzy Hash: a0c93abc6a6e11a9b24bd8e6f8d1d7df6c48477f75ac9a8cf5fbb92833b25f8d
Instruction Fuzzy Hash: 67B14F73A09BC592E7598F28D5412EDB3A0FB99744F489226DB9D67212EF38E1F5C300

Function 00007FF6D3A74BC0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A74BFD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A74C5A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A74CB7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A74D14
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A74D6E

Strings

buf_prepend(&work, 2), xrefs: 00007FF6D3A74BC5

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc
String ID: buf_prepend(&work, 2)
API String ID: 2803490479-2162127207
Opcode ID: 5b0501c642e8c21f605fd522c7a3a02e0e811010814cddcf44b629ab6fcda811
Instruction ID: 80533b686106638ca9bcf51df4da3a6bd5fecffcab1061a1f47a4e0295b0e6af
Opcode Fuzzy Hash: 5b0501c642e8c21f605fd522c7a3a02e0e811010814cddcf44b629ab6fcda811
Instruction Fuzzy Hash: 0261C423D19BC683E705CF34995127C6360FBBAB08F15A336DE9C5516AEF68B5E0C200

Function 00007FF6D3AD0BF0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AD0CA2
memset.VCRUNTIME140 ref: 00007FF6D3AD0CB9

Strings

MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK, xrefs: 00007FF6D3AD0CF0
MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK, xrefs: 00007FF6D3AD0D28
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\packet_id.c, xrefs: 00007FF6D3AD0CFC, 00007FF6D3AD0D15, 00007FF6D3AD0D34
PID packet_id_init seq_backtrack=%d time_backtrack=%d, xrefs: 00007FF6D3AD0C29

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: mallocmemset
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\packet_id.c$MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK$MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK$PID packet_id_init seq_backtrack=%d time_backtrack=%d
API String ID: 2882185209-412962153
Opcode ID: 384e1fb786ed3cdc3a157dc024e459d28760f29e56fd23c049699e1575036a6f
Instruction ID: cf96f05fadc76404610eb156419f635ee3cebff5d383e0006fab5cf1c5e7c061
Opcode Fuzzy Hash: 384e1fb786ed3cdc3a157dc024e459d28760f29e56fd23c049699e1575036a6f
Instruction Fuzzy Hash: C9317F32A09B558AE754CF25E84126DB7E4FB98B88F184037DE8CA7759EF38D560C740

Function 00007FF6D3A9E430 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9E471
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9E4A8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9E4E4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A9E516

Part of subcall function 00007FF6D3A84810: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84857
Part of subcall function 00007FF6D3A84810: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84905
Part of subcall function 00007FF6D3A84810: memset.VCRUNTIME140 ref: 00007FF6D3A8493B
Part of subcall function 00007FF6D3A84810: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84958
Part of subcall function 00007FF6D3A84810: memset.VCRUNTIME140 ref: 00007FF6D3A84985

Part of subcall function 00007FF6D3A9D5C0: socket.WS2_32 ref: 00007FF6D3A9D629

Strings

ret, xrefs: 00007FF6D3A9E59A
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c, xrefs: 00007FF6D3A9E5A6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$callocmemset$socket
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c$ret
API String ID: 4103175331-3667186013
Opcode ID: 0160ade5daa60a738f4dd0327ed283789c38edf44960a95a8149995deb072d18
Instruction ID: 3a7bd4fbd19ab7a427e0210635e5ca546431a4d9558b36d21889cccdfedadf2b
Opcode Fuzzy Hash: 0160ade5daa60a738f4dd0327ed283789c38edf44960a95a8149995deb072d18
Instruction Fuzzy Hash: 0741A132919BC182E615CF20A0052AEB360FBA8758F084336EB9D66795EF7CE5A1C710

Function 00007FF8A737E274 Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8A737E2C5
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E2E4
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E306
sys_get_time.LIBCPMT ref: 00007FF8A737E321
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E347
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF8A737E35F

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: b24cc8a9d8e5aa3a6ada25ba1af677fdb741c4ee7f2d39a11f1162f7fc6ee6a7
Instruction ID: 3308c247bbc1751df8db495be60c249abc0f36f8e04fc17e4f7e858c6786f504
Opcode Fuzzy Hash: b24cc8a9d8e5aa3a6ada25ba1af677fdb741c4ee7f2d39a11f1162f7fc6ee6a7
Instruction Fuzzy Hash: F9410A32A5AA06E6F764CF25E48033D73A0FF54B88F854435D64D82698DF3EE895EB40

Function 00007FF6D3B0B470 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 335COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF6D3B0B684
htonl.WS2_32 ref: 00007FF6D3B0B8E7

Strings

write_dhcp_search_str: temp buffer overflow building DHCP options, xrefs: 00007FF6D3B0B5C1
write_dhcp_search_str: search domain string must be <= 255 bytes, xrefs: 00007FF6D3B0B5A0
write_search_dhcp_str: buffer overflow building DHCP options, xrefs: 00007FF6D3B0B69C

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: htonlmemcpy
String ID: write_dhcp_search_str: search domain string must be <= 255 bytes$write_dhcp_search_str: temp buffer overflow building DHCP options$write_search_dhcp_str: buffer overflow building DHCP options
API String ID: 337393518-1235938852
Opcode ID: 7c4742c5b7df6e8eb6f55428c0d9cd0793deaf074766c42f3eda5de0b09285b6
Instruction ID: e06fb8788f2cb934d9b3fcb729bcd3e39f42396ee76506bb20b4dd612d24a329
Opcode Fuzzy Hash: 7c4742c5b7df6e8eb6f55428c0d9cd0793deaf074766c42f3eda5de0b09285b6
Instruction Fuzzy Hash: E5E1A272A0A68186EB14CF16D2957BCB3A1FB52B48F448136C78DA7786DF7DE460CB40

Function 00007FF8A73186C0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A73186D5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A73186FA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A7318724
std::_Facet_Register.LIBCPMT ref: 00007FF8A731879B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A73187B5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A73187C8

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cebecce4e371bfeaf498a099b560a859d84d6c1a343e1d8f433c86c9fc8aaf2a
Instruction ID: cc1dc688f584bf3e57b4551556e30f2d8b164af8a6a7168720cdbafde428e08c
Opcode Fuzzy Hash: cebecce4e371bfeaf498a099b560a859d84d6c1a343e1d8f433c86c9fc8aaf2a
Instruction Fuzzy Hash: 16319C26B0BE42A1EF15DF25E8402BDB361FB44BE4F990231DA4D032A5DE7CE492E340

Function 00007FF8A7311400 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A7311415
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A731143A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A7311464
std::_Facet_Register.LIBCPMT ref: 00007FF8A73114DB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A73114F5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A7311508

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: abde00647ed0d21e88bb12482bf6f30ce18f6e0059fbb59ac2c4299f7a198e5f
Instruction ID: 7ea27a4701abb2139b234e3a76634b918947758f49a2c87c833e449bd4e860da
Opcode Fuzzy Hash: abde00647ed0d21e88bb12482bf6f30ce18f6e0059fbb59ac2c4299f7a198e5f
Instruction Fuzzy Hash: FA318426A0BE46A1EF15DF59E4401BD6361FB44BE4F890231DB5D073A5EE3CE452E340

Function 00007FF6D3AEB4A0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 310networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF6D3AEB534

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h, xrefs: 00007FF6D3AEB828, 00007FF6D3AEB841, 00007FF6D3AEB85A, 00007FF6D3AEB873, 00007FF6D3AEB88C
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socks.c, xrefs: 00007FF6D3AEB65A
proto >= 0 && proto < PROTO_N, xrefs: 00007FF6D3AEB81C
buf_defined(&head), xrefs: 00007FF6D3AEB64E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: htons
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socket.h$C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\socks.c$buf_defined(&head)$proto >= 0 && proto < PROTO_N
API String ID: 4207154920-3027400032
Opcode ID: 455a7c7ea4c064d778df8365da264beb6f86a9c02c94e59e624a49fe23858ee9
Instruction ID: 76148736471140d62c438a15e3ee9a0905cf5c4dfba80d6dbabb28a2e30a6497
Opcode Fuzzy Hash: 455a7c7ea4c064d778df8365da264beb6f86a9c02c94e59e624a49fe23858ee9
Instruction Fuzzy Hash: E4C1AF72B0E78686EA288B04D04A17CB3A1FB55744F588137DA4DF6794EFBDE8A1C740

Function 00007FF8A7390BF8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A7390C07
FlsSetValue.KERNEL32(?,?,0000388B8AEA1BBD,00007FF8A738B775,?,?,?,?,00007FF8A739AAF2,?,?,00000000,00007FF8A739C9D7,?,?,?), ref: 00007FF8A7390C3D
FlsSetValue.KERNEL32(?,?,0000388B8AEA1BBD,00007FF8A738B775,?,?,?,?,00007FF8A739AAF2,?,?,00000000,00007FF8A739C9D7,?,?,?), ref: 00007FF8A7390C6A
FlsSetValue.KERNEL32(?,?,0000388B8AEA1BBD,00007FF8A738B775,?,?,?,?,00007FF8A739AAF2,?,?,00000000,00007FF8A739C9D7,?,?,?), ref: 00007FF8A7390C7B
FlsSetValue.KERNEL32(?,?,0000388B8AEA1BBD,00007FF8A738B775,?,?,?,?,00007FF8A739AAF2,?,?,00000000,00007FF8A739C9D7,?,?,?), ref: 00007FF8A7390C8C
SetLastError.KERNEL32 ref: 00007FF8A7390CA7

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5b936ab62bbc7642e22ad2a681fb53c99e10bd79025463b7254c5a6fb8dc7059
Instruction ID: b05b2a44442ca7e144f6b5b139a8752ca5653ff7c780d9630b45e531947a244b
Opcode Fuzzy Hash: 5b936ab62bbc7642e22ad2a681fb53c99e10bd79025463b7254c5a6fb8dc7059
Instruction Fuzzy Hash: 96118B20F0FE43A6FA585F71697107EA182DF447F0F864734E86E0B7D6DE2DA401AA01

Function 00007FF6D3B144F0 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 22COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6D3B14549

Part of subcall function 00007FF6D3B144F0: ReleaseSemaphore.KERNEL32 ref: 00007FF6D3B1448F

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c, xrefs: 00007FF6D3B144D9
Closing Win32 semaphore '%s', xrefs: 00007FF6D3B14531
ReleaseSemaphore failed on Win32 semaphore '%s', xrefs: 00007FF6D3B144AA
s->locked, xrefs: 00007FF6D3B144CD
Releasing Win32 semaphore '%s', xrefs: 00007FF6D3B1446D

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\win32.c$Closing Win32 semaphore '%s'$ReleaseSemaphore failed on Win32 semaphore '%s'$Releasing Win32 semaphore '%s'$s->locked
API String ID: 68019002-658150072
Opcode ID: 720a034c20255792a515b2946f9d8e5cb05d4c4fd822a8ae39b7843f9631d128
Instruction ID: 7f0b30346e07c325a80fef5031d8c691d57e1e84d2f11fd1b0f50cb8c124042c
Opcode Fuzzy Hash: 720a034c20255792a515b2946f9d8e5cb05d4c4fd822a8ae39b7843f9631d128
Instruction Fuzzy Hash: 78F0F960D1F60791FE149B01A85737C92617F73748F98003BC0CDFA2AADEADA464C340

Function 00007FF6D3ADC820 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3AF642C), ref: 00007FF6D3ADC852

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

htonl.WS2_32 ref: 00007FF6D3ADC932
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D3AF642C), ref: 00007FF6D3ADC9C2

Strings

sid=%s, xrefs: 00007FF6D3ADC9AA
%u, xrefs: 00007FF6D3ADC93B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$__stdio_common_vsprintfhtonl
String ID: %u$ sid=%s
API String ID: 1710430790-3964053920
Opcode ID: a1ef33902491787b4374af9695ae4122edfc81a0093763fd5932bab84abe29d4
Instruction ID: 81b4f7d434fb80c7f47907978db2b77316efbdfb36b5449620f8e2f294ceafda
Opcode Fuzzy Hash: a1ef33902491787b4374af9695ae4122edfc81a0093763fd5932bab84abe29d4
Instruction Fuzzy Hash: C0519F76A09A8182DB248F24E44226DF361FB94B44F498533DE8ED6659EF3CD460C700

Function 00007FF6D3AE0900 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3A712E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A71308

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE0979
inet_ntop.WS2_32 ref: 00007FF6D3AE09BC

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE0A46

Strings

delete_route_ipv6(%s/%d), xrefs: 00007FF6D3AE0A06
@, xrefs: 00007FF6D3AE094B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$__stdio_common_vsprintffreeinet_ntop
String ID: @$delete_route_ipv6(%s/%d)
API String ID: 3268905867-3818792123
Opcode ID: a6c1f1feb41d1ecd8edfe366e3c8c5bfd026d9a49b06dd1f553660c26a5f599a
Instruction ID: 579c7d190b69001a83c78a328cde719834d332e141ed95e2fb87306700008d7d
Opcode Fuzzy Hash: a6c1f1feb41d1ecd8edfe366e3c8c5bfd026d9a49b06dd1f553660c26a5f599a
Instruction Fuzzy Hash: B3419C22F09B5689FB14CF65D4522FDA360EB19788F084136DE8CB7646EE38E56AC340

Function 00007FF6D3A96C20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF6D3A96D6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96DAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96DC2

Strings

PLUGIN_CLOSE: FreeLibrary() failed on plugin: %s, xrefs: 00007FF6D3A96D85
PLUGIN_CLOSE: %s, xrefs: 00007FF6D3A96D44

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free$FreeLibrary
String ID: PLUGIN_CLOSE: %s$PLUGIN_CLOSE: FreeLibrary() failed on plugin: %s
API String ID: 2580233958-3225011692
Opcode ID: a7350fe77e6b6e6283432febc3bbefbb59c2f7bda292c285a89789768139ac9f
Instruction ID: 6529e5bcf102063ea0f95e421e064e4f9c49be9101985b831981b8f4f1352184
Opcode Fuzzy Hash: a7350fe77e6b6e6283432febc3bbefbb59c2f7bda292c285a89789768139ac9f
Instruction Fuzzy Hash: B451AE22F09A8286FB588F20D4453BDA360FF51B98F4C5236DA8DB7665DF2DE4A5C300

Function 00007FF6D3B0F7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

EVP_MAC_CTX_get_mac_size.LIBCRYPTO-3-X64 ref: 00007FF6D3B0F7E7

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\auth_token.c, xrefs: 00007FF6D3B0F8E9
hmac_ctx_size(ctx) == 256/8, xrefs: 00007FF6D3B0F8DD

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: X_get_mac_size
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\auth_token.c$hmac_ctx_size(ctx) == 256/8
API String ID: 1083930163-3320193972
Opcode ID: a20067927529ae20d286d1b227213302bb9ce452d9a573db410c59e5e6195ffb
Instruction ID: bcef09297b254bb329b1ff01fefc95909e01cd4f95362c17a4c9be74315a430c
Opcode Fuzzy Hash: a20067927529ae20d286d1b227213302bb9ce452d9a573db410c59e5e6195ffb
Instruction Fuzzy Hash: 3121C332B0AA8191E6205B12D8463ADA760FF6ABC0F544433EDCCE7759DE2CE565C340

Function 00007FF6D3AC24A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3AB5E00: memset.VCRUNTIME140 ref: 00007FF6D3AB5E2A
Part of subcall function 00007FF6D3AB5E00: GetTempPathW.KERNEL32 ref: 00007FF6D3AB6064

fprintf.MSPDB140-MSVCRT ref: 00007FF6D3AC256B

Part of subcall function 00007FF6D3A82BE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?,00000801,00007FF6D3A8332E), ref: 00007FF6D3A82C17

fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AC2573

Strings

, xrefs: 00007FF6D3AC253E
%sGeneral Options:--config file : Read configuration options from file.--help : Show options.--version : Show copyright and version information.Tunnel Options:--local host : Local host name or ip address. Implies --bind.--remote ho, xrefs: 00007FF6D3AC24D6
OpenVPN 2.6.12 [git:v2.6.12/038a94bae57a446c] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jul 18 2024, xrefs: 00007FF6D3AC24C7

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: PathTemp__stdio_common_vfprintffflushfprintfmemset
String ID: $%sGeneral Options:--config file : Read configuration options from file.--help : Show options.--version : Show copyright and version information.Tunnel Options:--local host : Local host name or ip address. Implies --bind.--remote ho$OpenVPN 2.6.12 [git:v2.6.12/038a94bae57a446c] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jul 18 2024
API String ID: 2153335021-244214391
Opcode ID: 523f44a048e2eb64dcbe477bb2bb229fee1c123e573c61d05e3c761f36aa6f12
Instruction ID: 294e584619dddfcd065fe4b3b9779c8093c331d6a62f9ed848348e2752ab799b
Opcode Fuzzy Hash: 523f44a048e2eb64dcbe477bb2bb229fee1c123e573c61d05e3c761f36aa6f12
Instruction Fuzzy Hash: 4121A076A0D7C58AD768DF14F4916AABBA1F788384F14012AEA8D93B59CF3CE444CF44

Function 00007FF8A738EB94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8A738EBB9
GetProcAddress.KERNEL32 ref: 00007FF8A738EBCF
FreeLibrary.KERNEL32 ref: 00007FF8A738EBF6

Strings

mscoree.dll, xrefs: 00007FF8A738EBB0
CorExitProcess, xrefs: 00007FF8A738EBC8

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 10e54f71f9fecdd6991c38c5d173b950d533ab36cf6dbde099f36fd95994a7d7
Instruction ID: 3fab2b81181ee38a807f356c40d7277728dce75649380b97a9d3b9db461334c9
Opcode Fuzzy Hash: 10e54f71f9fecdd6991c38c5d173b950d533ab36cf6dbde099f36fd95994a7d7
Instruction Fuzzy Hash: E8F06261A1BA06A2FA158F24E85533D6320EF487E1F940735D97E452F4CF3CD445E740

Function 00007FF8A7380DD4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF8A7380EF7
__AdjustPointer.LIBCMT ref: 00007FF8A7380F42

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 048f745a177a009c450cd52e2d2a654c4298bc49eb2d07862c76f9ff832d533a
Instruction ID: 543f2fcdddb54dfb29515341c364152aebba427b1ef2f44e9e8bd5618b18a717
Opcode Fuzzy Hash: 048f745a177a009c450cd52e2d2a654c4298bc49eb2d07862c76f9ff832d533a
Instruction Fuzzy Hash: DAB1AE62A0FE86A1FA65DF11948063D6394EF44BC4F9B883ADE8D07795DF3CE442A740

Function 00007FF6D3AE4490 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 290COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A97485), ref: 00007FF6D3AE45AD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A97485), ref: 00007FF6D3AE45D7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A97485), ref: 00007FF6D3AE4656

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c, xrefs: 00007FF6D3AE46B4
Preresolving failed, xrefs: 00007FF6D3AE4889

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\buffer.c$Preresolving failed
API String ID: 2803490479-2531191563
Opcode ID: c18a7bd34b089a4fb2f71ad907e2fc46a61c30bf33f048dc9070a761aa0c9f11
Instruction ID: 83771a2cc4b31a36d8203a30b19fe553e38dc1410b422bce85b18028e926f346
Opcode Fuzzy Hash: c18a7bd34b089a4fb2f71ad907e2fc46a61c30bf33f048dc9070a761aa0c9f11
Instruction Fuzzy Hash: 2DC18F72B09B8381EB588F11E40167DB7A9FB95B84F188136DA9DE7794EF3CE4618340

Function 00007FF6D3ABF060 Relevance: 7.7, APIs: 6, Instructions: 210COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF07A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF09D
memset.VCRUNTIME140 ref: 00007FF6D3ABF0BA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF16B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF1C4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3ABF221

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memset
String ID:
API String ID: 3081043919-0
Opcode ID: 6671b83725ad276d22e188a111a49b980f637e8cec1f8ba0b20ecea24c3995a3
Instruction ID: e9ee0b34fb30b2067016c8b75d21f6d560f4d174b132805790b4f0f492d2bff4
Opcode Fuzzy Hash: 6671b83725ad276d22e188a111a49b980f637e8cec1f8ba0b20ecea24c3995a3
Instruction Fuzzy Hash: D5B1FB26A05FC586E7498F28D5453ACB3A0FBA9B48F199226DF9C57312EF35A1F5C300

Function 00007FF8A7397720 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8A739775F
_set_statfp.LIBCMT ref: 00007FF8A739777D
_set_statfp.LIBCMT ref: 00007FF8A73977A6
_set_statfp.LIBCMT ref: 00007FF8A73979E2

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 06b03220977cf5606a01477937529d57c31bfa1e933e352ec6654b94947ec25e
Instruction ID: 57879920ab5a1e99d1dac70a8fae2130f9b4a30e0e6d1606535cdac110ac5ea2
Opcode Fuzzy Hash: 06b03220977cf5606a01477937529d57c31bfa1e933e352ec6654b94947ec25e
Instruction Fuzzy Hash: 0B81E412E0EE46A5F2728F39A4613BEA790EF457D4F864331E94E266D4DF3CE481E600

Function 00007FF6D3AA4FF0 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

EVP_CIPHER_fetch.LIBCRYPTO-3-X64 ref: 00007FF6D3AA50BD
EVP_CIPHER_get_mode.LIBCRYPTO-3-X64 ref: 00007FF6D3AA50CE
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AA50DC
EVP_CIPHER_get_flags.LIBCRYPTO-3-X64 ref: 00007FF6D3AA50EB
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3AA50FA
EVP_CIPHER_free.LIBCRYPTO-3-X64 ref: 00007FF6D3AA5113

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: R_freeR_get_flags$R_fetchR_get_mode
String ID:
API String ID: 715063678-0
Opcode ID: a7636b4a08d2fda248d3df7e9bf78498008631cfaf5482156904806eca4258cc
Instruction ID: be6d7871fa0106b5d0aa6531524c784e1e492697083764740e481c7d46c5391c
Opcode Fuzzy Hash: a7636b4a08d2fda248d3df7e9bf78498008631cfaf5482156904806eca4258cc
Instruction Fuzzy Hash: 01512563F0914246EB2CAF269506A7DE291FF44BC4F4C4436DE8EA7B88DE3CE4618740

Function 00007FF6D3A96130 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A961D9
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96237
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A96285

Part of subcall function 00007FF6D3A72610: _exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3A72640
Part of subcall function 00007FF6D3A72610: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A72690

Strings

C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c, xrefs: 00007FF6D3A962D5
c->options.ce.fragment, xrefs: 00007FF6D3A962C9

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: calloc$_exitmalloc
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\init.c$c->options.ce.fragment
API String ID: 592522765-2904909447
Opcode ID: 3b70cd1d2aa48967a1056d6d39b5fa34ca0676d1e57e0dab8f93d4f942946600
Instruction ID: dc8085ffe497f38c08d057662f796025a06046d4750087ae1b0dd55989e580d6
Opcode Fuzzy Hash: 3b70cd1d2aa48967a1056d6d39b5fa34ca0676d1e57e0dab8f93d4f942946600
Instruction Fuzzy Hash: C441A332A19BC287D714CF25E50136DB360FF59788F189532EB8926A5ADF7CE5A0C700

Function 00007FF6D3B0ACF0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D3B15E10: WriteFile.KERNEL32(?,00007FF6D3A83267,?,?,?,00007FF6D3A712AC), ref: 00007FF6D3B15E50
Part of subcall function 00007FF6D3B15E10: ReadFile.KERNEL32(?,00007FF6D3A83267,?,?,?,00007FF6D3A712AC), ref: 00007FF6D3B15E6E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AE29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3B0AE64

Strings

TUN: enabling dhcp using service failed: %s [status=%u if_index=%d], xrefs: 00007FF6D3B0AE00
Enable_dhcp, xrefs: 00007FF6D3B0AD5F
DHCP enabled on interface %d using service, xrefs: 00007FF6D3B0AEBC

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Filefree$ReadWrite
String ID: DHCP enabled on interface %d using service$Enable_dhcp$TUN: enabling dhcp using service failed: %s [status=%u if_index=%d]
API String ID: 1469289904-3833270484
Opcode ID: 68d7a48dc26e9a6f03159c6897f5a83c7f424bc4741068462995dcd3378e8ef6
Instruction ID: 872e0bf5bc8122f928615bb8ae62481d9b96df44d8a4567b4febec56de7b5a84
Opcode Fuzzy Hash: 68d7a48dc26e9a6f03159c6897f5a83c7f424bc4741068462995dcd3378e8ef6
Instruction Fuzzy Hash: 38517E72E09BC18AEB50CF25D8423BDB3A0FB9A784F241236EAC896A55DF7CD050C740

Function 00007FF8A7384BD0 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A7384BFB
CreateThread.KERNEL32 ref: 00007FF8A7384C3C
GetLastError.KERNEL32 ref: 00007FF8A7384C4A
CloseHandle.KERNEL32 ref: 00007FF8A7384C60
FreeLibrary.KERNEL32 ref: 00007FF8A7384C6F

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: d7eaa0eb322d297eb5d8eed3744207796493985276d36d7069f028e18eda4c6a
Instruction ID: 2901b1b087c60371cb72cdb9fd301a8f07eab01af4f865c09125ded87b48c536
Opcode Fuzzy Hash: d7eaa0eb322d297eb5d8eed3744207796493985276d36d7069f028e18eda4c6a
Instruction Fuzzy Hash: 98216825A0BF42B6FE149F66A41007DB3A4EF88BD0F894935EE8D43B55DF3CE400A644

Function 00007FF6D3AD3C40 Relevance: 7.6, APIs: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3C7D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3C94
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CC8
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CD1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CE6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ByteCharMultiWide$DeleteFilefreemalloc
String ID:
API String ID: 4114541613-0
Opcode ID: 54bd685a69d3287877dd9866dbdafea6b2af2066d623355ce621e622b9b3feac
Instruction ID: 857ee3582f11f9417787d51aa63141f477c6e3cd9495a0b33023dd0f941f54e0
Opcode Fuzzy Hash: 54bd685a69d3287877dd9866dbdafea6b2af2066d623355ce621e622b9b3feac
Instruction Fuzzy Hash: 9B119035709B9186E714DB12B410329E7A1FB89BE0F4C0636DE9967B98CF3CD5118700

Function 00007FF8A73A4ADC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8A73A4B04
_set_statfp.LIBCMT ref: 00007FF8A73A4B1F
_set_statfp.LIBCMT ref: 00007FF8A73A4B3B
_set_statfp.LIBCMT ref: 00007FF8A73A4B77

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: 4990f235f4664b9397273acd2f2f5639e9f18e51f0a6698c0e68f7f47b32b8a5
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: 2B114622E1EF0331F6A45D9CE95737D5041EF953E0F8A0634E9AD063D6CE6E9880E105

Function 00007FF6D3A988C0 Relevance: 7.6, APIs: 5, Instructions: 56fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3C7D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3C94
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CC8
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CD1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF6D3A83A00), ref: 00007FF6D3AD3CE6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: ByteCharMultiWide$DeleteFilefreemalloc
String ID:
API String ID: 4114541613-0
Opcode ID: 01aaafa44253ba012cd191dae0e5b021d2bb3cae24bfce0ae514e8e509b112cb
Instruction ID: bd4eac985af5a53566301eac15b322faf05e823dfbef83a20ebe51d511488fc3
Opcode Fuzzy Hash: 01aaafa44253ba012cd191dae0e5b021d2bb3cae24bfce0ae514e8e509b112cb
Instruction Fuzzy Hash: 29218E35B09B9186EB24CB12B510329E7A1FB89FE0F480636DE9D67B98CF3CD5118740

Function 00007FF8A7390CC0 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF8A738B1BF,?,?,00000000,00007FF8A738B45A,?,?,?,?,?,00007FF8A738B3E6), ref: 00007FF8A7390CDF
FlsSetValue.KERNEL32(?,?,?,00007FF8A738B1BF,?,?,00000000,00007FF8A738B45A,?,?,?,?,?,00007FF8A738B3E6), ref: 00007FF8A7390CFE
FlsSetValue.KERNEL32(?,?,?,00007FF8A738B1BF,?,?,00000000,00007FF8A738B45A,?,?,?,?,?,00007FF8A738B3E6), ref: 00007FF8A7390D26
FlsSetValue.KERNEL32(?,?,?,00007FF8A738B1BF,?,?,00000000,00007FF8A738B45A,?,?,?,?,?,00007FF8A738B3E6), ref: 00007FF8A7390D37
FlsSetValue.KERNEL32(?,?,?,00007FF8A738B1BF,?,?,00000000,00007FF8A738B45A,?,?,?,?,?,00007FF8A738B3E6), ref: 00007FF8A7390D48

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8384e7e38f743ba64144e29dc749fb1f15aaeed8bc778c177ca4994dc27564df
Instruction ID: 0df5cbfdff65306b6053bc084817d1a56362d0840a1df0bfb927ddec6066efa6
Opcode Fuzzy Hash: 8384e7e38f743ba64144e29dc749fb1f15aaeed8bc778c177ca4994dc27564df
Instruction Fuzzy Hash: B9118C21F0BE0365FA586BA1696217EA141DF407F0FC64335E92D067D6DE2DF441A201

Function 00007FF8A7390B54 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F), ref: 00007FF8A7390B65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F), ref: 00007FF8A7390B84
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F), ref: 00007FF8A7390BAC
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F), ref: 00007FF8A7390BBD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF8A739D3DF,?,?,?,00007FF8A7394AFC,?,?,?,00007FF8A738941F), ref: 00007FF8A7390BCE

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8f6015701f0369db532a1ebf95531170176d3136d97655d18a592dc37753c347
Instruction ID: ba65664d4828437ad69d4f1d94e9959e17d79b763e9f298b3daaf2a452c5c956
Opcode Fuzzy Hash: 8f6015701f0369db532a1ebf95531170176d3136d97655d18a592dc37753c347
Instruction Fuzzy Hash: 2D111824E0FE07A9F9996EA558322BE5141CF413F8FC64734E93E0A3D2DD2EF441A241

Function 00007FF8A731B300 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A731B59E

Part of subcall function 00007FF8A737CF54: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A737CF5D

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A731B5A4

Strings

true, xrefs: 00007FF8A731B44A
false, xrefs: 00007FF8A731B390

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID: false$true
API String ID: 1173176844-2658103896
Opcode ID: f6c4fd4b1c330d6f06cd527e4df1beca03888b9791dda61645b4f56ecf31ba39
Instruction ID: 5c375924b5ff4b1ac5a3e1c508a4042ec88c6f3e5979cfa3555334c94e5a6172
Opcode Fuzzy Hash: f6c4fd4b1c330d6f06cd527e4df1beca03888b9791dda61645b4f56ecf31ba39
Instruction Fuzzy Hash: 8B818A22B1AB55A5EB10DF35E4402ED23A8FF58788F960136EE4C43B9AEF38D556D340

Function 00007FF8A7382148 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF8A73821B8
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8A7382203

Strings

RCC, xrefs: 00007FF8A73821D4
MOC, xrefs: 00007FF8A73821CC

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 151085f2c889f7aeaab1de41cf6773fb4b052b70401e3289720e648e39c58217
Instruction ID: 3d9a2bf975c068b724db52df04097127d1db175442c359decbe3f0c983d4b84e
Opcode Fuzzy Hash: 151085f2c889f7aeaab1de41cf6773fb4b052b70401e3289720e648e39c58217
Instruction Fuzzy Hash: 0491DF73A09B81AAE750CF64D8402AC7BA0FB557C8F55813AEE8D17B55DF38E191DB00

Function 00007FF8A7380740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8A738076B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8A7380802
RtlUnwindEx.KERNEL32 ref: 00007FF8A738085C

Strings

csm, xrefs: 00007FF8A73807E9

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: d28d4fa131c4ab51fa40fe06a1adb42c578b5902214215aba58b410215bb522f
Instruction ID: 06c5928c34f44d073853f2aee42e337feff555ed6feead3ba4778cb1df3802ce
Opcode Fuzzy Hash: d28d4fa131c4ab51fa40fe06a1adb42c578b5902214215aba58b410215bb522f
Instruction Fuzzy Hash: BE519032B1BA02AAFB548F15E444A7D7391EB44BC8F928130EA5E43798DF7CE881D740

Function 00007FF8A73826C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8A73826F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8A73827D8

Strings

csm, xrefs: 00007FF8A738282A
csm, xrefs: 00007FF8A7382712

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 83279a61b6b81b539a55623050c203c80f5c84dba175d517927559cb138459b0
Instruction ID: f515b85477bcd2fb5409888443a831fa1b98715b5588e202790277a6bd61134e
Opcode Fuzzy Hash: 83279a61b6b81b539a55623050c203c80f5c84dba175d517927559cb138459b0
Instruction Fuzzy Hash: 23519132909B82A6FB648F22944436C77A0FB64BD4F968135DA8D877D6CF3CE450E705

Function 00007FF8A73198C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A731992B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8A7319973
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A7319A03

Strings

bad locale name, xrefs: 00007FF8A7319A26

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 83cd4511ba338a600a783e429e79217e7690e16082a0f059c5054a3c9e65046e
Instruction ID: 09398ef5cc2bf5fb3fd0a656ca40d16c615dc7516677374f7cedb66ba770750c
Opcode Fuzzy Hash: 83cd4511ba338a600a783e429e79217e7690e16082a0f059c5054a3c9e65046e
Instruction Fuzzy Hash: E9413F32B0BA81A9FB14DFB1D4903BD23A4EF44788F454435DE4E26A5ADE38D516A344

Function 00007FF8A7319510 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8A731957F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8A73195C7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A731966E

Strings

bad locale name, xrefs: 00007FF8A7319691

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 20f455c59e084fcbcd06a635146fd049da23b94f532a74a9d53600c9d7fe915e
Instruction ID: b1b990b7e6543922f5aedbf8e57f6feaf4733140b8632c981ebdd0110510502e
Opcode Fuzzy Hash: 20f455c59e084fcbcd06a635146fd049da23b94f532a74a9d53600c9d7fe915e
Instruction Fuzzy Hash: E5411B32B0BA81A9FB14DFB0D4503ED23A4EF44788F854435EE4E27A5ADE38D516E354

Function 00007FF8A7310B10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8A7310C52

Strings

ios_base::failbit set, xrefs: 00007FF8A7310D4C
ios_base::badbit set, xrefs: 00007FF8A7310D40
ios_base::eofbit set, xrefs: 00007FF8A7310D53

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 118556049-1866435925
Opcode ID: 627cdb70d8073736233bdb23e959f2928869900ef80bcccde5d8ca4d1256ffb5
Instruction ID: 213b579e2ee5c175ba948341eebca9dbec581aa3dbd73faa31b2f42c69f1ab8e
Opcode Fuzzy Hash: 627cdb70d8073736233bdb23e959f2928869900ef80bcccde5d8ca4d1256ffb5
Instruction Fuzzy Hash: F431BE22B4BB89A1EE14CF55D14437D6351EB48BE4F964631EEAD0BBC9DE2CE491D300

Function 00007FF6D3AE57C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 00007FF6D3AE581E
closesocket.WS2_32 ref: 00007FF6D3AE5897

Strings

TCP: accept(%d) failed, xrefs: 00007FF6D3AE5847
TCP: Received strange incoming connection with unknown address length=%d, xrefs: 00007FF6D3AE5883

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: acceptclosesocket
String ID: TCP: Received strange incoming connection with unknown address length=%d$TCP: accept(%d) failed
API String ID: 635517647-1481401153
Opcode ID: ed7c1431c51c093124d515df3fc0d5f151abc9b16ff06f259d7420c0bbffc4ba
Instruction ID: e47a46bc5237ef21c0d61b1c1c96ece281655a5671f179af5b566e5d1f24bc93
Opcode Fuzzy Hash: ed7c1431c51c093124d515df3fc0d5f151abc9b16ff06f259d7420c0bbffc4ba
Instruction Fuzzy Hash: BF218F31F0974681FA689B14A40617DA390FF99BA4F080337E9ADB73D6DE6CE4A1D740

Function 00007FF6D3AD43C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000003,00007FF6D3AD5330), ref: 00007FF6D3AD4410
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,00000003,00007FF6D3AD5330), ref: 00007FF6D3AD4485

Strings

password, xrefs: 00007FF6D3AD4406
%s[%d] = '%s', xrefs: 00007FF6D3AD4438

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: _exitstrncmp
String ID: %s[%d] = '%s'$password
API String ID: 4142068672-2461356184
Opcode ID: a031e2f54aaa55eaafd3fd44119b7a876506f84d54ae2dea2b4f19b7393de99f
Instruction ID: dee215263cf8bd8849c77f55183dec58de8d51fcaafc141f45589126d05285d9
Opcode Fuzzy Hash: a031e2f54aaa55eaafd3fd44119b7a876506f84d54ae2dea2b4f19b7393de99f
Instruction Fuzzy Hash: DA11A272B0964286EA148F02E88127CE794FB99B94F0D043ADE9CA37A1EE7CD4658300

Function 00007FF6D3A81510 Relevance: 6.4, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8155D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A81583
memset.VCRUNTIME140 ref: 00007FF6D3A815A0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8165A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A81680

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$memset
String ID:
API String ID: 3081043919-0
Opcode ID: 3517eabb75d3eab992f18b9f652c73f5bc7d3ea1773b06e1aab2ac9e694b6190
Instruction ID: 768ee9b2cad89c03c1dabddef6583667083290f7e54f01320f1ffc0e384d5f1e
Opcode Fuzzy Hash: 3517eabb75d3eab992f18b9f652c73f5bc7d3ea1773b06e1aab2ac9e694b6190
Instruction Fuzzy Hash: 3A516522E19BC582E755CF2495116BD6360FBA9B88F099225DFCC66716EF38E1E0C300

Function 00007FF8A7392A6C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF8A7392AEB
WriteFile.KERNEL32 ref: 00007FF8A7392DB3
WriteFile.KERNEL32 ref: 00007FF8A7392DF9
GetLastError.KERNEL32 ref: 00007FF8A7392EAF

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 00b6a128b5053bb5dd22941fed2e8756657feb90b1709dcf8a1667303e1bf542
Instruction ID: a035acd033967d1940a70e27ba19266ede75dd429952c91ffff2f8d4d019f4cb
Opcode Fuzzy Hash: 00b6a128b5053bb5dd22941fed2e8756657feb90b1709dcf8a1667303e1bf542
Instruction Fuzzy Hash: EED10132F0AE8199E710CF69D4902AC37B1FB54BD8B858236DE5D97B99DE38D406D304

Function 00007FF8A739342C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF8A7393548
GetLastError.KERNEL32 ref: 00007FF8A73935D3

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 4ce2376a04b2d9b0fa752d818e9eb109f0d8d92549f4441e41010605db702c22
Instruction ID: 8e09145ecd6be4046d4f0f79cbdc36584d890dc2dcbd253c5e621066eb8276b0
Opcode Fuzzy Hash: 4ce2376a04b2d9b0fa752d818e9eb109f0d8d92549f4441e41010605db702c22
Instruction Fuzzy Hash: CC91E4A2F0AE52A9F7509F6594A02BD6BA8FB04BC8F964179DE0E57784CF3CD441E700

Function 00007FF6D3A7CD30 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CE83
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A7CEB4

Strings

ERROR: failed to read %s file (%s), xrefs: 00007FF6D3A7CDD0
ERROR: %s pem decode failed, xrefs: 00007FF6D3A7CE3E

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: ERROR: %s pem decode failed$ERROR: failed to read %s file (%s)
API String ID: 1294909896-737264123
Opcode ID: 0dcb4e2090f137f9faa67a5c944873e946179707bb343220d17045aa2c63cce1
Instruction ID: 2c28713b3d20be74889376ebddbd24fd013c27cfdb98281ea9c0a068606b43d1
Opcode Fuzzy Hash: 0dcb4e2090f137f9faa67a5c944873e946179707bb343220d17045aa2c63cce1
Instruction Fuzzy Hash: 6A41D562F1978152EA548B21E4422BEE791FF95BD4F094232EE9DA7B89DF3CD4108700

Function 00007FF6D3AFDFC0 Relevance: 6.1, APIs: 4, Instructions: 120stringCOMMON

Download Yara Rule

APIs

__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AFE032
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D3AFE09C
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3AFE0FB
strchr.VCRUNTIME140 ref: 00007FF6D3AFE152

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: __stdio_common_vsprintf_exit_writestrchr
String ID:
API String ID: 2615646571-0
Opcode ID: cd5c15d4eafd76b8efeebf3e158245b71550d77b880f36bb438fe1d6414890c4
Instruction ID: a5139a48be81e949ea414d81ad140563a8e70176180c39ec3f0b4dfd9aaa3259
Opcode Fuzzy Hash: cd5c15d4eafd76b8efeebf3e158245b71550d77b880f36bb438fe1d6414890c4
Instruction Fuzzy Hash: 7551AC32B09A8286FB249B11E54577CF7A0FB95B44F0C0136EA8DA3691DF3DE8A5C340

Function 00007FF6D3AE83C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE83F7

Part of subcall function 00007FF6D3A726F0: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF6D3A7277A

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3AE8492

Strings

S%s, xrefs: 00007FF6D3AE8466, 00007FF6D3AE84EF
@, xrefs: 00007FF6D3AE83D6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: malloc$__stdio_common_vsprintf
String ID: @$S%s
API String ID: 1056972871-4270127029
Opcode ID: d5ae3be8a798c4a1028a0ecc2689ab26ace41c77e15f6a3be023109f6db23809
Instruction ID: f23c52809e5451fe979dd2ee3c00847fb0f18de1a471985292134aa15d5c57ae
Opcode Fuzzy Hash: d5ae3be8a798c4a1028a0ecc2689ab26ace41c77e15f6a3be023109f6db23809
Instruction Fuzzy Hash: 3D518172B0DB8381EA298B14E5422BDE3A4FF55B84F880137D69DF6695DF2CE624C700

Function 00007FF6D3A840A0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A8413D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF6D3A84147

Strings

index >= 0 && index < wes->n_events, xrefs: 00007FF6D3A8410D
C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c, xrefs: 00007FF6D3A84119

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: C:\buildbot\msbuild\openvpn-build\src\openvpn\src\openvpn\event.c$index >= 0 && index < wes->n_events
API String ID: 1294909896-2505472677
Opcode ID: 970591b22d8e40a2aeb051dc066626432922240b69d5fba4a2f187c3203d1a31
Instruction ID: 5137d4add78c96701210dddd0d81e4052cb317bb24034501812d3a41ea1e9ecb
Opcode Fuzzy Hash: 970591b22d8e40a2aeb051dc066626432922240b69d5fba4a2f187c3203d1a31
Instruction Fuzzy Hash: 56117C36B15A86C2E744CB15E4856BCB361F799B88FA44133CA4D93360EF39E1A6C700

Function 00007FF6D3AEB8A0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AEE2AC), ref: 00007FF6D3AEB8EB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AEE2AC), ref: 00007FF6D3AEB929
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6D3AEE2AC), ref: 00007FF6D3AEB949

Strings

PID packet_id_free, xrefs: 00007FF6D3AEB8D6

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: free
String ID: PID packet_id_free
API String ID: 1294909896-3852019670
Opcode ID: 4d773465c714df3a594f7c5098b4539e72969713fe1acfd2c09bfc3b91145048
Instruction ID: 65b5c37a466593635657bd9a70afed17b973202ea1f484507613495d1b1ce86a
Opcode Fuzzy Hash: 4d773465c714df3a594f7c5098b4539e72969713fe1acfd2c09bfc3b91145048
Instruction Fuzzy Hash: 67216032E2978292E744DF30D9553BCA360FBA9B48F585237DB8DAA155DF68A4F0C300

Function 00007FF8A7382900 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8A738292A

Strings

csm, xrefs: 00007FF8A738294F
csm, xrefs: 00007FF8A7382ABE

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 5a5acfdc1f2458fcc8d8587121b5ddb13079aaf68b0a97c4cb8eca635a866188
Instruction ID: 579d190e7edde490604e35c7e3d20c58abebffc8e7bea2077ac1966a863b25ba
Opcode Fuzzy Hash: 5a5acfdc1f2458fcc8d8587121b5ddb13079aaf68b0a97c4cb8eca635a866188
Instruction Fuzzy Hash: 1D71BF3290AA829AEB618F25D44477C7BA0FB64BD4F868135EE8C47B89CF3CD451D744

Function 00007FF8A7396E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A738B59C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A738B5CF

_get_daylight.LIBCMT ref: 00007FF8A7396FA8
_get_daylight.LIBCMT ref: 00007FF8A7396FB9

Strings

?, xrefs: 00007FF8A7396F39

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: a7059471f5fe81c5521674b0633f8a92d9a3cb07451f59f44377e05a39874864
Instruction ID: 43674125ed3b7a7a1a1678dc58516e186e1dc85fc30aaa1ef093d41f12e4cf31
Opcode Fuzzy Hash: a7059471f5fe81c5521674b0633f8a92d9a3cb07451f59f44377e05a39874864
Instruction Fuzzy Hash: 73410A12A1BE82A1FB648F26E43137E5760EB807E4F554235EE6D06AD5EF3CD441DB00

Function 00007FF8A7382F98 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8A7383042
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8A738306B

Strings

csm, xrefs: 00007FF8A738316B

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: d8b67776942a6ed0cebde04ba6598d6d8b238e823d66e7d2dca23b5d3a965350
Instruction ID: 3d66f33f777b405a6d4caccbd740886c784f30441a517d9a8cb70bf7dade13d7
Opcode Fuzzy Hash: d8b67776942a6ed0cebde04ba6598d6d8b238e823d66e7d2dca23b5d3a965350
Instruction Fuzzy Hash: 8A516C3661AB4196E660EF25E44026E77A8FB89BD0F920534EF8D07B56CF3CE461DB00

Function 00007FF6D3AE5420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF6D3AE545D

Strings

NOTE: setsockopt TCP_NODELAY=%d failed, xrefs: 00007FF6D3AE547A
Socket flags: TCP_NODELAY=%d succeeded, xrefs: 00007FF6D3AE54BB

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: setsockopt
String ID: NOTE: setsockopt TCP_NODELAY=%d failed$Socket flags: TCP_NODELAY=%d succeeded
API String ID: 3981526788-1966526966
Opcode ID: f2d51c3faeb0ef994622ecf9fd5b1b6e99529f6841e7687d903d6ff432f72fc3
Instruction ID: acdcb88b1430ba525a3aeb43fcf53783520e4006dd2e08e390fc5ab95adfbe07
Opcode Fuzzy Hash: f2d51c3faeb0ef994622ecf9fd5b1b6e99529f6841e7687d903d6ff432f72fc3
Instruction Fuzzy Hash: 9E119466B1824246FA449B11A4536BDA352EBA6784F842437E64EF7392DE2DE425CB00

Function 00007FF8A7380670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8A73806C0
RaiseException.KERNEL32 ref: 00007FF8A7380701

Strings

csm, xrefs: 00007FF8A73806EE

Memory Dump Source

Source File: 00000008.00000002.2529699125.00007FF8A7301000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8A7300000, based on PE: true

Associated: 00000008.00000002.2529659676.00007FF8A7300000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529960784.00007FF8A73A8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2529988137.00007FF8A73A9000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530132227.00007FF8A7424000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2530154211.00007FF8A742A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8a7300000_openvpn.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: cb1b75fcce9529a37f6bad2a16c5f88922ee68bbe9dab7510ed5bae898636c6b
Instruction ID: 38351bf15585cd1acf3912370c4c8c9e21d3ffc9ea34ed911f45cff98902884b
Opcode Fuzzy Hash: cb1b75fcce9529a37f6bad2a16c5f88922ee68bbe9dab7510ed5bae898636c6b
Instruction Fuzzy Hash: 7511463261AB8192EB208F15E40026EB7E4FB88B94F594230EECC17B58DF3CD5519B00

Function 00007FF6D3A90100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

pkcs11h_certificate_signAny_ex.LIBPKCS11-HELPER-1 ref: 00007FF6D3A9012C

Strings

PKCS#11: pkcs11_terminate - return, xrefs: 00007FF6D3A90149
PKCS#11: pkcs11_terminate - entered, xrefs: 00007FF6D3A9011B

Memory Dump Source

Source File: 00000008.00000002.2522497881.00007FF6D3A71000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D3A70000, based on PE: true

Associated: 00000008.00000002.2519841788.00007FF6D3A70000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529295862.00007FF6D3B1E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529526310.00007FF6D3B65000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.2529570660.00007FF6D3B6F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff6d3a70000_openvpn.jbxd

Similarity

API ID: Any_expkcs11h_certificate_sign
String ID: PKCS#11: pkcs11_terminate - entered$PKCS#11: pkcs11_terminate - return
API String ID: 269981986-519299666
Opcode ID: a37c4929f3130f56d5c23432b3e0c90acba2e17d26f8d785d593eee860b1a68e
Instruction ID: 4054cd6c1fe1b0d7eafb6ebb2059b369d6d55b454315f5da516e544a2186e709
Opcode Fuzzy Hash: a37c4929f3130f56d5c23432b3e0c90acba2e17d26f8d785d593eee860b1a68e
Instruction Fuzzy Hash: ECF01268F0E10399F81CEF50685B07C92523F5A39CF9C4077C58EB92D2DE5D64749355

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cwqqRXEhZb.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3c4fc4.rbs

C:\ProgramData\vlc.lnk

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggx2bdnv.ln1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzbnbjeg.whw.ps1

C:\Users\user\AppData\Local\Temp\msi9A57.txt

C:\Users\user\AppData\Local\Temp\pss9A6A.ps1

C:\Users\user\AppData\Local\Temp\scr9A58.ps1

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\SecureProp.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\UnRar.exe

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\VCRUNTIME140.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-processthreads-l1-1-1.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-profile-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-rtlsupport-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-string-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-synch-l1-2-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-sysinfo-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-timezone-l1-1-0.dll

C:\Users\user\AppData\Roaming\Grovi Tend\Ifid Apps\api-ms-win-core-util-l1-1-0.dll

Windows Analysis Report
cwqqRXEhZb.msi

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre