Edit tour

Windows Analysis Report
AimPrivStoreAtt117.exe

Overview

General Information

Sample name:	AimPrivStoreAtt117.exe
Analysis ID:	1590900
MD5:	199e093792c0a0c91233709796553e3c
SHA1:	3046ad48ef9e69c4482b58e89f2d6573e2e75793
SHA256:	cbb3e224ed616e62f2a81dedd1d88a7b1c3dfe318372506364662cadb73353c6
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

AimPrivStoreAtt117.exe (PID: 3536 cmdline: "C:\Users\user\Desktop\AimPrivStoreAtt117.exe" MD5: 199E093792C0A0C91233709796553E3C)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4688 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1656 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 2804 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3480 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4320 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6224 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1240 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5780 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5860 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 652 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5352 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 3012 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6768 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6204 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3176 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1436 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2788 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5004 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3560 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4564 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5012 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7124 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1200 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3160 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 4616 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6536 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 1656 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6256 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 4352 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 892 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 1816 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6612 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AimPrivStoreAtt117.exe	Virustotal: Detection: 60%			Perma Link
Source: AimPrivStoreAtt117.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.5% probability

Machine Learning detection for sample

Source: AimPrivStoreAtt117.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677A87D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF7F677A87D
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F679D780 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7F679D780
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F679F870 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7F679F870
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6796410 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7F6796410
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6796D30 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7F6796D30
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677CB50 CryptHashData,	0_2_00007FF7F677CB50
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677CB60 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7F677CB60
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6779B70 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF7F6779B70
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6779C40 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7F6779C40
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677CB00 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF7F677CB00

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF7F675FA20
Source: AimPrivStoreAtt117.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7F6789440

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: AimPrivStoreAtt117.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Aim\x64\Release\EpicGames.pdb source: AimPrivStoreAtt117.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Aim\x64\Release\EpicGames.pdb source: AimPrivStoreAtt117.exe

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View

IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F6766810 malloc,recv,send,WSAGetLastError,

0_2_00007FF7F6766810

Source: global traffic

DNS traffic detected: DNS query: keyauth.win

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 74Content-Type: application/x-www-form-urlencoded

Source: AimPrivStoreAtt117.exe	String found in binary or memory: http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exe
Source: AimPrivStoreAtt117.exe	String found in binary or memory: http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exeC:
Source: AimPrivStoreAtt117.exe	String found in binary or memory: http://167.114.85.75/aimhvcionattprivatestore674.exe
Source: AimPrivStoreAtt117.exe	String found in binary or memory: http://167.114.85.75/aimhvcionattprivatestore674.exeC:
Source: AimPrivStoreAtt117.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: AimPrivStoreAtt117.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571877A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.cc/panel/bronkzware/Loader
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/emin
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/m
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmp, AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/ESSOR

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F679D780 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7F679D780

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677A87D	0_2_00007FF7F677A87D
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6768600	0_2_00007FF7F6768600
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67672C0	0_2_00007FF7F67672C0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67692C0	0_2_00007FF7F67692C0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F676FED0	0_2_00007FF7F676FED0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6751E70	0_2_00007FF7F6751E70
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6751AD0	0_2_00007FF7F6751AD0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F679F800	0_2_00007FF7F679F800
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674977B	0_2_00007FF7F674977B
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F679D780	0_2_00007FF7F679D780
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6751780	0_2_00007FF7F6751780
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674959D	0_2_00007FF7F674959D
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6778600	0_2_00007FF7F6778600
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6796410	0_2_00007FF7F6796410
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6785330	0_2_00007FF7F6785330
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674D340	0_2_00007FF7F674D340
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67731D0	0_2_00007FF7F67731D0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F676A180	0_2_00007FF7F676A180
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67592D0	0_2_00007FF7F67592D0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6741000	0_2_00007FF7F6741000
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6760F40	0_2_00007FF7F6760F40
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6775D20	0_2_00007FF7F6775D20
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6790EC0	0_2_00007FF7F6790EC0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674DED0	0_2_00007FF7F674DED0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6791EF0	0_2_00007FF7F6791EF0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677CF10	0_2_00007FF7F677CF10
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6789E60	0_2_00007FF7F6789E60
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F678DB60	0_2_00007FF7F678DB60
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674AC3D	0_2_00007FF7F674AC3D
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F674EC60	0_2_00007FF7F674EC60
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6763C70	0_2_00007FF7F6763C70
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677A93C	0_2_00007FF7F677A93C
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F677A945	0_2_00007FF7F677A945

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F6753970 appears 49 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F67696F0 appears 46 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F6760B80 appears 70 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F676AC70 appears 33 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F676ABE0 appears 37 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F6766430 appears 323 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F676AD50 appears 34 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F67662B0 appears 381 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F67697C0 appears 36 times
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: String function: 00007FF7F67A0B9C appears 47 times

Source: classification engine

Classification label: mal56.evad.winEXE@67/18@1/2

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F675279A FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF7F675279A

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03

Source: AimPrivStoreAtt117.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AimPrivStoreAtt117.exe	Virustotal: Detection: 60%
Source: AimPrivStoreAtt117.exe	ReversingLabs: Detection: 63%

Source: AimPrivStoreAtt117.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\AimPrivStoreAtt117.exe "C:\Users\user\Desktop\AimPrivStoreAtt117.exe"
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AimPrivStoreAtt117.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AimPrivStoreAtt117.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AimPrivStoreAtt117.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AimPrivStoreAtt117.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Aim\x64\Release\EpicGames.pdb source: AimPrivStoreAtt117.exe
Source:	Binary string: 2D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\BACKUP BOTS PRIVATE STORE\Loader Valorant Aim\x64\Release\EpicGames.pdb source: AimPrivStoreAtt117.exe

Source: AimPrivStoreAtt117.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AimPrivStoreAtt117.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AimPrivStoreAtt117.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AimPrivStoreAtt117.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AimPrivStoreAtt117.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F67692C0 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF7F67692C0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Window / User API: threadDelayed 3335	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Window / User API: threadDelayed 6633	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 3561	Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-48005

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe TID: 2928	Thread sleep time: -166750s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe TID: 2928	Thread sleep time: -331650s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F67A06AC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7F67A06AC

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F67A0A48 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7F67A0A48

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

0_2_00007FF7F67692C0

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67A0854 SetUnhandledExceptionFilter,	0_2_00007FF7F67A0854
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67A06AC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7F67A06AC
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67A03B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7F67A03B4

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Code function: 0_2_00007FF7F67A08C4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7F67A08C4

Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F67753A0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF7F67753A0
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6785330 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7F6785330
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F6767F70 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF7F6767F70
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F678C090 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7F678C090
Source: C:\Users\user\Desktop\AimPrivStoreAtt117.exe	Code function: 0_2_00007FF7F678BE35 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7F678BE35

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AimPrivStoreAtt117.exe	61%	Virustotal		Browse
AimPrivStoreAtt117.exe	63%	ReversingLabs	Win64.Trojan.Generic
AimPrivStoreAtt117.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/aimhvcionattprivatestore674.exe	0%	Avira URL Cloud	safe
https://keyauth.cc/panel/bronkzware/Loader	0%	Avira URL Cloud	safe
http://167.114.85.75/aimhvcionattprivatestore674.exeC:	0%	Avira URL Cloud	safe
http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://keyauth.win/api/1.1/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exe	AimPrivStoreAtt117.exe	false	Avira URL Cloud: safe	unknown
http://167.114.85.75/aimhvcionattprivatestore674.exe	AimPrivStoreAtt117.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/emin	AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://167.114.85.75/aimhvcionattprivatestore674.exeC:	AimPrivStoreAtt117.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.2/ESSOR	AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exeC:	AimPrivStoreAtt117.exe	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.1/m	AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	AimPrivStoreAtt117.exe	false		high
https://curl.haxx.se/docs/http-cookies.html#	AimPrivStoreAtt117.exe	false		high
https://keyauth.cc/panel/bronkzware/Loader	AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571877A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keyauth.win/api/1.2/	AimPrivStoreAtt117.exe, 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmp, AimPrivStoreAtt117.exe, 00000000.00000002.3331028031.000001571874C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590900
Start date and time:	2025-01-14 16:44:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AimPrivStoreAtt117.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@67/18@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 232
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:45:48	API Interceptor	200943x Sleep call for process: AimPrivStoreAtt117.exe modified
10:47:04	API Interceptor	439x Sleep call for process: conhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.0.5	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	ak3o7AZ3mH.exe	Get hash	malicious	Babadeda, Conti, Mimikatz	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Aclatis tool.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	CCuITQzvd4.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	dMFmJxq6oK.exe	Get hash	malicious	Unknown	Browse	104.26.1.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	172.65.251.78
	http://wagestream.acemlnb.com	Get hash	malicious	Unknown	Browse	104.20.0.15
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Payment_243.js	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	Payment_243.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.18.73.116
	http://yourexcellency.activehosted.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	172.67.197.240
	mWAik6b.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.150.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.0.5
	Subscription_Renewal_Receipt_2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.26.0.5
	http://vionicstore.shop	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	104.26.0.5
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	104.26.0.5
	TiOWA908TP.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://www.tiktok.com/link/v2?aid=1988&lang=en&scene=bio_url&target=https%3A%2F%2Fgoogle.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%253Dhttps%3A%2F%2Fwww.google.com%2Furl%3Fq%3D.%2F%2F%2F%2Famp%2Fs%2Fmessagupdates.courtfilepro.com%2FVTtMa	Get hash	malicious	HTMLPhisher	Browse	104.26.0.5
	TiOWA908TP.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

Process:	C:\Users\user\Desktop\AimPrivStoreAtt117.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.591458873507413
Encrypted:	false
SSDEEP:	3:rRRqmIEaGj3F/9Dqa+U4W42oJXTIFNBh2To3G3oJXTIFNBhWXqowvxOwVGt:H041lqABhHfABhwcV4
MD5:	2093ABDC1CC5C502980BCE5F4F8897A7
SHA1:	23552E512460D3CC05A91E5491BF3ADCD9AB8568
SHA-256:	6B1550C3CDBCADFC23C19F432C52168C41BF0B54784962910391352D800ECDA5
SHA-512:	6E6C2E4E350921C2F8070E2B47FF1B056AEC8102CDA839B7288B578F7C86791C50DAE291568948C6E759801018BDFF48023FD856DDF56FF1D07F7E8BD21402F3
Malicious:	false
Preview:	....##########################################################..[ Selecione uma opcao: ]..##########################################################....[1] Iniciar Valorant Aim (HVCI DESLIGADO): ..[2] Iniciar Valorant Aim (HVCI HABILITADO): ....[+] Selecione a opcao:

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.418976746883596
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AimPrivStoreAtt117.exe
File size:	510'464 bytes
MD5:	199e093792c0a0c91233709796553e3c
SHA1:	3046ad48ef9e69c4482b58e89f2d6573e2e75793
SHA256:	cbb3e224ed616e62f2a81dedd1d88a7b1c3dfe318372506364662cadb73353c6
SHA512:	f59dc0b6b5df0889db3819bb57c71bf878ccefaf0107fc1fb0e54a49a161fcb35caadd8cb3995760cc9cf871656d5aa0b6f437d53a9c6a755e74f17167f53c0a
SSDEEP:	12288:GXDur8S9+8Qu/y9x2EpL5UcY+6cm3C/pk:6urP93v/C2E19Y+7/pk
TLSH:	8FB46D96A7A913E9D1A7C07CC547C603E7B6B4991311DBDB43A0CA791F137E22E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._...B...PHe.^...PH..v...PH..\...PH..R...PH..P.......A...V...x.......?...9H..T...9H..W...9Hg.W...9H..W...RichV..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140060398
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677DDF4C [Wed Jan 8 02:13:32 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	551e5f19de2baa264d46ee5c6718793c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F024508C2C8h
dec eax
add esp, 28h
jmp 00007F024508BC17h
int3
int3
jmp 00007F024508C57Eh
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001D6Bh]
dec eax
mov ecx, ebx
call dword ptr [00001D5Ah]
call dword ptr [00001DB4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001DB0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001DA4h]
test eax, eax
je 00007F024508BDA9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00019462h]
call 00007F024508BF6Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00019549h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [000194D9h], eax
dec eax
mov eax, dword ptr [00019532h]
dec eax
mov dword ptr [000193A3h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000194A7h], eax
mov dword ptr [0001937Dh], C0000409h
mov dword ptr [00019377h], 00000001h
mov dword ptr [00000081h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x77318	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7a000	0x405c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x4ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x71080	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x70f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x62000	0x858	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x60718	0x60800	602f1089df07ef344959cfe41447af2c	False	0.5326414750647669	data	6.334775760528484	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x16ec4	0x17000	34b296da2f473d4b9bd8f08336dcff29	False	0.37954313858695654	data	5.599267697230251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x79000	0xe08	0x400	5b070ba4bf716bd9abd9429588bdb3ed	False	0.21484375	data	2.448207517753268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7a000	0x405c	0x4200	12d13dd91b54cb2b26af3136bc3f645d	False	0.4738991477272727	data	5.697151102004698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x1e8	0x200	9682c2bd23621eded0bee00be928ba8f	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x4ec	0x600	43a6897ca7133ec62c7e8be294ec97b7	False	0.5162760416666666	data	4.831811206446416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7f060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	ReadFile, PeekNamedPipe, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, WideCharToMultiByte, RtlCaptureContext, GetModuleHandleA, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FreeLibrary, GetSystemDirectoryA, QueryPerformanceFrequency, VerSetConditionMask, SleepEx, GetEnvironmentVariableA, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, DeleteCriticalSection, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileType, MultiByteToWideChar, WaitForSingleObjectEx, MoveFileExA, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, LeaveCriticalSection, GetSystemTimeAsFileTime, GetProcAddress, GetLastError, InitializeCriticalSectionEx, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, SetConsoleScreenBufferInfoEx, GetConsoleScreenBufferInfoEx, SetConsoleMode, GetConsoleMode, Sleep, RtlLookupFunctionEntry, GetStdHandle, OutputDebugStringW, InitializeSListHead
USER32.dll	MessageBoxA, MoveWindow, GetWindowRect, GetWindowLongA, SetWindowLongA
ADVAPI32.dll	CryptEncrypt, CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?_Xlength_error@std@@YAXPEBD@Z, _Thrd_detach, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?_Random_device@std@@YAIXZ, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CryptDecodeObjectEx, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertOpenStore, CertCloseStore
WS2_32.dll	ntohl, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, listen
VCRUNTIME140.dll	__std_exception_destroy, __std_exception_copy, memcpy, memcmp, _CxxThrowException, __std_terminate, __C_specific_handler, strchr, __current_exception_context, strrchr, __current_exception, memchr, memset, strstr, memmove
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_errno, __sys_nerr, _invalid_parameter_noinfo_noreturn, strerror, exit, _getpid, system, _beginthreadex, _register_thread_local_exe_atexit_callback, terminate, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _c_exit, _get_initial_narrow_environment, _initterm, _initterm_e, _exit, __p___argv, __p___argc
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, calloc, realloc, malloc, _set_new_mode, free
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, fputc, ftell, _lseeki64, _read, _write, _close, _open, __acrt_iob_func, __stdio_common_vsscanf, fgets, fputs, fopen, fflush, __stdio_common_vsprintf, fread, fclose, _set_fmode, fwrite
api-ms-win-crt-convert-l1-1-0.dll	atoi, strtoul, strtoull, strtoll, strtol, strtod
api-ms-win-crt-locale-l1-1-0.dll	localeconv, _configthreadlocale
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strpbrk, strcspn, strcmp, strncmp, strncpy, strspn, isupper, tolower, _strdup
api-ms-win-crt-utility-l1-1-0.dll	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _access, _unlink, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:45:10.843503952 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:10.843533993 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:10.843638897 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:10.855520010 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:10.855535984 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.337727070 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.337945938 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:11.341658115 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:11.341679096 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.341931105 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.345634937 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:11.391324043 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.575515032 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.575612068 CET	443	49708	104.26.0.5	192.168.2.5
Jan 14, 2025 16:45:11.575659037 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:11.584867954 CET	49708	443	192.168.2.5	104.26.0.5
Jan 14, 2025 16:45:11.584887028 CET	443	49708	104.26.0.5	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 16:45:10.825987101 CET	56144	53	192.168.2.5	1.1.1.1
Jan 14, 2025 16:45:10.838439941 CET	53	56144	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 16:45:10.825987101 CET	192.168.2.5	1.1.1.1	0x78e	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 16:45:10.838439941 CET	1.1.1.1	192.168.2.5	0x78e	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:45:10.838439941 CET	1.1.1.1	192.168.2.5	0x78e	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Jan 14, 2025 16:45:10.838439941 CET	1.1.1.1	192.168.2.5	0x78e	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

keyauth.win

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.26.0.5	443	3536	C:\Users\user\Desktop\AimPrivStoreAtt117.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 15:45:11 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 74 Content-Type: application/x-www-form-urlencoded
2025-01-14 15:45:11 UTC	74	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 32 2e 36 26 6e 61 6d 65 3d 4c 6f 61 64 65 72 20 50 72 69 6e 63 69 70 61 6c 20 7c 20 50 72 69 76 61 74 65 20 53 74 6f 72 65 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=2.6&name=Loader Principal \| Private Store&ownerid=9WIvTVJa9m
2025-01-14 15:45:11 UTC	1322	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 15:45:11 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 475 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdyJEPoB6gy4XcXiJczH5t3IeGokf1XObk0eWdPzJsLjUJqQPHIBeU2KapvJq1Vh8XA%2FeTGunRCwAdf2WFGZC58zzQFiuD56jJULUZqB07eiq%2B1sc%2BAGFdpOXwtY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 901ec06e4b615e82-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1632&rtt_var=615&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2346&recv_bytes=862&delivery_rate=1773997&cwnd=216&unsent_bytes=0&cid=1bda6a38da404f4a&ts=250&x=0"
2025-01-14 15:45:11 UTC	47	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 63 6f 64 65 22 3a 36 38 2c 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 69 74 69 61 6c 69 7a 65 Data Ascii: {"success":true,"code":68,"message":"Initialize
2025-01-14 15:45:11 UTC	428	IN	Data Raw: 64 22 2c 22 73 65 73 73 69 6f 6e 69 64 22 3a 22 61 35 35 61 30 63 63 38 22 2c 22 61 70 70 69 6e 66 6f 22 3a 7b 22 6e 75 6d 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4f 6e 6c 69 6e 65 55 73 65 72 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 6e 75 6d 4b 65 79 73 22 3a 22 4e 2f 41 20 2d 20 55 73 65 20 66 65 74 63 68 53 74 61 74 73 28 29 20 66 75 6e 63 74 69 6f 6e 20 69 6e 20 6c 61 74 65 73 74 20 65 78 61 6d 70 6c 65 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 36 22 2c 22 63 75 73 74 6f 6d 65 Data Ascii: d","sessionid":"a55a0cc8","appinfo":{"numUsers":"N/A - Use fetchStats() function in latest example","numOnlineUsers":"N/A - Use fetchStats() function in latest example","numKeys":"N/A - Use fetchStats() function in latest example","version":"2.6","custome

Target ID:	0
Start time:	10:45:07
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\AimPrivStoreAtt117.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\AimPrivStoreAtt117.exe"
Imagebase:	0x7ff7f6740000
File size:	510'464 bytes
MD5 hash:	199E093792C0A0C91233709796553E3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:45:07
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:45:07
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:45:07
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 3012, Parent PID: 5352

General

Target ID:	15
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6204, Parent PID: 6768

General

Target ID:	17
Start time:	10:45:08
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:45:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1436, Parent PID: 3176

General

Target ID:	19
Start time:	10:45:09
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:45:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5004, Parent PID: 2788

General

Target ID:	21
Start time:	10:45:09
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:45:09
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 4564, Parent PID: 3560

General

Target ID:	23
Start time:	10:45:10
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:45:10
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6d64d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7124, Parent PID: 3536

General

Target ID:	25
Start time:	10:45:10
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 1200, Parent PID: 7124

General

Target ID:	26
Start time:	10:45:10
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 4616, Parent PID: 3160

General

Target ID:	28
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff74efb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff7b1040000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:45:11
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff61d7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	93

Executed Functions

Function 00007FF7F676FED0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676FFA8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676FFB5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770088
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677010C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67701B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677024A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770315
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677034D
strchr.VCRUNTIME140 ref: 00007FF7F67704C7
strchr.VCRUNTIME140 ref: 00007FF7F67704DA
strchr.VCRUNTIME140 ref: 00007FF7F67704EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67705F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770663
memcpy.VCRUNTIME140 ref: 00007FF7F677068A
strchr.VCRUNTIME140 ref: 00007FF7F677069E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67706B2
strstr.VCRUNTIME140 ref: 00007FF7F67708E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770A21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770B99

Part of subcall function 00007FF7F67696F0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6769763

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770C4C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770CD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770F2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770F40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6770F4F

Part of subcall function 00007FF7F67722A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67722FA

strchr.VCRUNTIME140 ref: 00007FF7F6771507
strchr.VCRUNTIME140 ref: 00007FF7F677151A
strchr.VCRUNTIME140 ref: 00007FF7F677152C

Part of subcall function 00007FF7F67722A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677231A
Part of subcall function 00007FF7F67722A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6772323

strchr.VCRUNTIME140 ref: 00007FF7F677177F
strchr.VCRUNTIME140 ref: 00007FF7F6771792
strchr.VCRUNTIME140 ref: 00007FF7F67717A4

Part of subcall function 00007FF7F67748D0: strchr.VCRUNTIME140 ref: 00007FF7F67749B6
Part of subcall function 00007FF7F67748D0: strchr.VCRUNTIME140 ref: 00007FF7F67749C9
Part of subcall function 00007FF7F67748D0: strchr.VCRUNTIME140 ref: 00007FF7F67749DB

Strings

If-Modified-Since, xrefs: 00007FF7F677119D
%s, xrefs: 00007FF7F6771483
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7F6770F0B
Accept-Encoding: %s, xrefs: 00007FF7F6770322
chunked, xrefs: 00007FF7F6770506
Referer, xrefs: 00007FF7F6770263
GET, xrefs: 00007FF7F6770062
Content-Length: %I64d, xrefs: 00007FF7F67712FB, 00007FF7F6771450, 00007FF7F67716D5
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7F6771701
1.0, xrefs: 00007FF7F6770C30
http, xrefs: 00007FF7F677084B
User-Agent, xrefs: 00007FF7F677006D
Failed sending HTTP POST request, xrefs: 00007FF7F67719AB
Failed sending HTTP request, xrefs: 00007FF7F6771676
Transfer-Encoding, xrefs: 00007FF7F677045D
1.1, xrefs: 00007FF7F6770C3E
Host, xrefs: 00007FF7F67705F9
OPTIONS, xrefs: 00007FF7F677003B
Failed sending POST request, xrefs: 00007FF7F67713D9, 00007FF7F677161D
PUT, xrefs: 00007FF7F6770048
%s%s, xrefs: 00007FF7F67710E0
%x, xrefs: 00007FF7F67718A5
Expect:, xrefs: 00007FF7F67714C5, 00007FF7F677173A
%s , xrefs: 00007FF7F6770C63
Content-Length: 0, xrefs: 00007FF7F67713A0
Range: bytes=%s, xrefs: 00007FF7F6770A2E
Host: %s%s%s, xrefs: 00007FF7F677076D
Could not seek stream, xrefs: 00007FF7F6770A98
ftp://%s:%s@%s, xrefs: 00007FF7F6770CFB
Expect, xrefs: 00007FF7F67714A4, 00007FF7F6771719
Transfer-Encoding:, xrefs: 00007FF7F677047E
Host:%s, xrefs: 00007FF7F67706F6
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7F6771224
Last-Modified, xrefs: 00007FF7F677118B
multipart/form-data, xrefs: 00007FF7F67703FA
Accept, xrefs: 00007FF7F67709A3
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7F6770BB4
If-Unmodified-Since, xrefs: 00007FF7F6771194
Transfer-Encoding: chunked, xrefs: 00007FF7F67705BF
Invalid TIMEVALUE, xrefs: 00007FF7F6771153
Cookie, xrefs: 00007FF7F67702D2
Content-Length, xrefs: 00007FF7F67712E4, 00007FF7F6771439, 00007FF7F67716BE
Range, xrefs: 00007FF7F6770A02
Host: %s%s%s:%d, xrefs: 00007FF7F67707B2
Referer: %s, xrefs: 00007FF7F677027E
HEAD, xrefs: 00007FF7F6770011
;type=%c, xrefs: 00007FF7F6770951
0, xrefs: 00007FF7F67718F6, 00007FF7F67719F5
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7F6771AAE
Host:, xrefs: 00007FF7F67706C1
;type=, xrefs: 00007FF7F67708DE
Failed sending PUT request, xrefs: 00007FF7F6771379
%s%s=%s, xrefs: 00007FF7F6771059
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF7F67705CC
Content-Range, xrefs: 00007FF7F6770B7E
100-continue, xrefs: 00007FF7F6771546, 00007FF7F67717C6
?%s, xrefs: 00007FF7F6770D3B
Accept-Encoding, xrefs: 00007FF7F67702F1
File already completely uploaded, xrefs: 00007FF7F6770B39
Proxy-Connection: Keep-Alive, xrefs: 00007FF7F6770DCF, 00007FF7F6770DE4
POST, xrefs: 00007FF7F6770055
%s?%s, xrefs: 00007FF7F67700A5
ftp, xrefs: 00007FF7F67708B9
Proxy-Connection, xrefs: 00007FF7F6770DA3
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7F6770BD8
Cookie: , xrefs: 00007FF7F677103E, 00007FF7F67710B4
Accept: */*, xrefs: 00007FF7F67709B5
Could only read %I64d bytes from the input, xrefs: 00007FF7F6770B55
Content-Range: bytes %s/%I64d, xrefs: 00007FF7F6770BE6
Content-Type, xrefs: 00007FF7F67703B7, 00007FF7F67716ED

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: df388712e8186f415a9c3d512b14d34def9028130db4415460419967b26806f6
Instruction ID: 6015c82488ed26e0c02c9ecd598b83bfc06efffe64fa18365ff6845e785d6315
Opcode Fuzzy Hash: df388712e8186f415a9c3d512b14d34def9028130db4415460419967b26806f6
Instruction Fuzzy Hash: 9603A161A2868285FB54EB259C603BBA7A8AF49B88F844035CE3D576D5DF3CF541C3B0

Function 00007FF7F6751E70 Relevance: 124.5, APIs: 58, Strings: 13, Instructions: 288
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6751ED4
_Thrd_detach.MSVCP140 ref: 00007FF7F6751F03
GetStdHandle.KERNEL32 ref: 00007FF7F6751F1E
GetConsoleMode.KERNELBASE ref: 00007FF7F6751F2F
SetConsoleMode.KERNELBASE ref: 00007FF7F6751F42
GetStdHandle.KERNEL32 ref: 00007FF7F6751F4D
GetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF7F6751F64
SetConsoleScreenBufferInfoEx.KERNELBASE ref: 00007FF7F6751F89
GetConsoleMode.KERNELBASE ref: 00007FF7F6751F97
SetConsoleMode.KERNELBASE ref: 00007FF7F6751FAB
GetConsoleWindow.KERNELBASE ref: 00007FF7F6751FB1
GetWindowLongA.USER32 ref: 00007FF7F6751FC2
SetWindowLongA.USER32 ref: 00007FF7F6751FD8
GetConsoleWindow.KERNELBASE ref: 00007FF7F6751FDE
GetWindowRect.USER32 ref: 00007FF7F6751FEF
MoveWindow.USER32 ref: 00007FF7F6752017
GetStdHandle.KERNEL32 ref: 00007FF7F6752022
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7F6752030
GetStdHandle.KERNEL32 ref: 00007FF7F6752047
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7F6752055
GetStdHandle.KERNEL32 ref: 00007FF7F6752078
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7F6752086
GetStdHandle.KERNEL32 ref: 00007FF7F675209D
SetConsoleTextAttribute.KERNELBASE ref: 00007FF7F67520AB

Part of subcall function 00007FF7F67523B0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F67523D4
Part of subcall function 00007FF7F67523B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F67523F5

GetStdHandle.KERNEL32 ref: 00007FF7F67520C2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F67520D0
GetStdHandle.KERNEL32 ref: 00007FF7F67520E7
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F67520F5
GetStdHandle.KERNEL32 ref: 00007FF7F675210C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F675211A
GetStdHandle.KERNEL32 ref: 00007FF7F6752131
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F675213F
GetStdHandle.KERNEL32 ref: 00007FF7F6752162
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F6752170
GetStdHandle.KERNEL32 ref: 00007FF7F6752187
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F6752195
GetStdHandle.KERNEL32 ref: 00007FF7F67521AC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F67521BA
GetStdHandle.KERNEL32 ref: 00007FF7F67521DD
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F67521EB
GetStdHandle.KERNEL32 ref: 00007FF7F6752202
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F6752210
GetStdHandle.KERNEL32 ref: 00007FF7F6752227
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7F6752235
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF7F6752253
URLDownloadToFileA.URLMON ref: 00007FF7F67522AA
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67522B6
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67522C3
Sleep.KERNEL32 ref: 00007FF7F67522CE
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67522D6
URLDownloadToFileA.URLMON ref: 00007FF7F675232A
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752336
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752343
Sleep.KERNEL32 ref: 00007FF7F675234E
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752356
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752364
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7F6752393
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140 ref: 00007FF7F67523A2

Strings

Iniciar Valorant Aim (HVCI DESLIGADO): , xrefs: 00007FF7F6752145
C:\Windows\System32\config\SerceubetisHostDialog.exe, xrefs: 00007FF7F6752273
start C:\Windows\System32\config\SerceubetisHostDialog.exe, xrefs: 00007FF7F67522BC
##########################################################, xrefs: 00007FF7F67520B1
start C:\Windows\System32\config\SeiebingsHosDialog.exe, xrefs: 00007FF7F675233C
Iniciar Valorant Aim (HVCI HABILITADO): , xrefs: 00007FF7F67521C0
##########################################################, xrefs: 00007FF7F6752067
[ Selecione uma opcao: ], xrefs: 00007FF7F675208C
http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exe, xrefs: 00007FF7F6752262
http://167.114.85.75/aimhvcionattprivatestore674.exe, xrefs: 00007FF7F67522E2
C:\Windows\System32\config\SeiebingsHosDialog.exe, xrefs: 00007FF7F67522F4
cd C:\, xrefs: 00007FF7F67522AF, 00007FF7F675232F
Selecione a opcao: , xrefs: 00007FF7F675223B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Console$Handle$AttributeText$Window$Modesystem$BufferCpp_error@std@@DownloadFileInfoLongScreenSleepThrow_exit$??5?$basic_istream@D@std@@@std@@MoveRectThrd_detachU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintf_beginthreadexmallocterminate
String ID: Iniciar Valorant Aim (HVCI DESLIGADO): $ Iniciar Valorant Aim (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$C:\Windows\System32\config\SeiebingsHosDialog.exe$C:\Windows\System32\config\SerceubetisHostDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://167.114.85.75/aimhvcioffbronkzatualizadoh97.exe$http://167.114.85.75/aimhvcionattprivatestore674.exe$start C:\Windows\System32\config\SeiebingsHosDialog.exe$start C:\Windows\System32\config\SerceubetisHostDialog.exe
API String ID: 3379756739-3340239426
Opcode ID: c0970c032c7a6ab2f92a157549982e831c8b625684b59effcca0a25a6cd551d2
Instruction ID: 3b78bf92c258974f8c3eb4a0ead45af4db64e8354ed2d6e731dd5ee2acf620be
Opcode Fuzzy Hash: c0970c032c7a6ab2f92a157549982e831c8b625684b59effcca0a25a6cd551d2
Instruction Fuzzy Hash: 6FD12C21A18A4282EB04FF70ED241BAB369EF89751F840235D53E46AF5DE3CE94597B0

Function 00007FF7F677A87D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F677A9D8
strchr.VCRUNTIME140 ref: 00007FF7F677AA04
strchr.VCRUNTIME140 ref: 00007FF7F677AA3E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677AA62
strchr.VCRUNTIME140 ref: 00007FF7F677AB72
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677AB8A

Strings

Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF7F677AA77
CurrentService, xrefs: 00007FF7F677AAB5
LocalMachineEnterprise, xrefs: 00007FF7F677AB4B
Users, xrefs: 00007FF7F677AAF6
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF7F677AFF5
Services, xrefs: 00007FF7F677AAD7
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7F677B073
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF7F677A90B
schannel: unable to allocate memory, xrefs: 00007FF7F677AEFC, 00007FF7F677B187
Microsoft Unified Security Protocol Provider, xrefs: 00007FF7F677AF7F
http/1.1, xrefs: 00007FF7F677B093
schannel: Failed to read cert file %s, xrefs: 00007FF7F677AF39
http/1.1, xrefs: 00007FF7F677B0A7
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF7F677AE44
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF7F677AF62
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7F677AE19
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF7F677ABF0
LocalMachineGroupPolicy, xrefs: 00007FF7F677AB2C
LocalMachine, xrefs: 00007FF7F677AA93
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF7F677AE8F
CurrentUser, xrefs: 00007FF7F677AA52
schannel: ALPN, offering %s, xrefs: 00007FF7F677B0B5
CurrentUserGroupPolicy, xrefs: 00007FF7F677AB0D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 3b907009211ff7cb2198ef5d328b79b85d72c5b5477c74e40b21cd7e234a9625
Instruction ID: 20b0068a33dad69317b8ea210cb65430f17fb6ecc4390ce3fdbf861d8138668c
Opcode Fuzzy Hash: 3b907009211ff7cb2198ef5d328b79b85d72c5b5477c74e40b21cd7e234a9625
Instruction Fuzzy Hash: 28428F21A18A4285FB14AF25DC606BBA3A8FB4DB84F844135DA6D477E4EF3CE544C7B0

Function 00007FF7F67692C0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7F67692E8
WSACleanup.WS2_32 ref: 00007FF7F6769303
GetModuleHandleA.KERNEL32 ref: 00007FF7F6769354
GetProcAddress.KERNEL32 ref: 00007FF7F6769380
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676939A
LoadLibraryA.KERNEL32 ref: 00007FF7F67693BD
GetProcAddress.KERNEL32 ref: 00007FF7F67693DA
LoadLibraryExA.KERNELBASE ref: 00007FF7F67693F0
GetSystemDirectoryA.KERNEL32 ref: 00007FF7F6769406
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676941E
GetSystemDirectoryA.KERNEL32 ref: 00007FF7F6769432
LoadLibraryA.KERNEL32 ref: 00007FF7F67694A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67694AC
GetProcAddress.KERNEL32 ref: 00007FF7F67694D8
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769561
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769574
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769583
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769592
VerSetConditionMask.KERNEL32 ref: 00007FF7F67695A2
VerifyVersionInfoA.KERNEL32 ref: 00007FF7F67695B3
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7F67695CF

Strings

if_nametoindex, xrefs: 00007FF7F67694CE
AddDllDirectory, xrefs: 00007FF7F67693D0
LoadLibraryExA, xrefs: 00007FF7F676936E
iphlpapi.dll, xrefs: 00007FF7F6769386
kernel32, xrefs: 00007FF7F676933B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: eeb22dd33ee6f1824ceccbff02a487c861c0f39535903402c4be651aa8da3d3c
Instruction ID: b85e64196979b83f8973434de6eacc602046c95e839cce5b4a7d61a0421fe0c9
Opcode Fuzzy Hash: eeb22dd33ee6f1824ceccbff02a487c861c0f39535903402c4be651aa8da3d3c
Instruction Fuzzy Hash: B8919521A0878281E760AB21ED643BBB395FF8DB44F884135D97D067E5EF2DE44587B0

Function 00007FF7F6768600 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F676869C
socket.WS2_32 ref: 00007FF7F67686E5
htons.WS2_32 ref: 00007FF7F6768771
setsockopt.WS2_32 ref: 00007FF7F67687D3
WSAGetLastError.WS2_32 ref: 00007FF7F67687DD
getsockopt.WS2_32 ref: 00007FF7F676887F
setsockopt.WS2_32 ref: 00007FF7F67688AE
setsockopt.WS2_32 ref: 00007FF7F67688ED
WSAIoctl.WS2_32 ref: 00007FF7F676897A
WSAGetLastError.WS2_32 ref: 00007FF7F6768984

Part of subcall function 00007FF7F67755D0: ioctlsocket.WS2_32 ref: 00007FF7F67755E9

Part of subcall function 00007FF7F676E0F0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7F675616F), ref: 00007FF7F676E107

connect.WS2_32 ref: 00007FF7F6768AAB
WSAGetLastError.WS2_32 ref: 00007FF7F6768AC8

Part of subcall function 00007FF7F6752E40: GetLastError.KERNEL32 ref: 00007FF7F6752E62
Part of subcall function 00007FF7F6752E40: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752E6A

Part of subcall function 00007FF7F6766430: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766555
Part of subcall function 00007FF7F6766430: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766570

Part of subcall function 00007FF7F6766F10: closesocket.WS2_32 ref: 00007FF7F6766F53

Strings

Could not set TCP_NODELAY: %s, xrefs: 00007FF7F67687FA
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF7F676898D
Trying %s:%ld..., xrefs: 00007FF7F676877F
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7F67688FA
Immediate connect fail for %s: %s, xrefs: 00007FF7F6768AF8
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF7F6768B6E
@, xrefs: 00007FF7F6768817

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 4225695b9fea57ff8dac61cf89d2bc8e46375c83ee33fe930edfb22793d2201d
Instruction ID: 487712eb0fb39a9a62625eeeb151a62d648c357644aacbf1369f72fc84b7ae16
Opcode Fuzzy Hash: 4225695b9fea57ff8dac61cf89d2bc8e46375c83ee33fe930edfb22793d2201d
Instruction Fuzzy Hash: 9AF1B271A08242C6E750AB25D8642BBE3A8FB48788F804135DA6D47BD4DF7DE945CBB0

Function 00007FF7F67753A0 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7F67753E1
htonl.WS2_32 ref: 00007FF7F677540E
setsockopt.WS2_32 ref: 00007FF7F6775445
bind.WS2_32 ref: 00007FF7F6775460
getsockname.WS2_32 ref: 00007FF7F677547C
listen.WS2_32 ref: 00007FF7F6775491
socket.WS2_32 ref: 00007FF7F67754A8
connect.WS2_32 ref: 00007FF7F67754C7
accept.WS2_32 ref: 00007FF7F67754DE
send.WS2_32 ref: 00007FF7F677552C
recv.WS2_32 ref: 00007FF7F677554A
memcmp.VCRUNTIME140 ref: 00007FF7F6775565
closesocket.WS2_32 ref: 00007FF7F6775571

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 18acca75b82256b36fd27439601572a11a61d7d3643b22be5c7afa3228a250b6
Instruction ID: 3163610f5ade35b0d3879e4b42529b4a72c43631e31c46539fef0d8a2966574e
Opcode Fuzzy Hash: 18acca75b82256b36fd27439601572a11a61d7d3643b22be5c7afa3228a250b6
Instruction Fuzzy Hash: 2951A531618A4181E714AF25E96416AB366FB487B4F944730EA7E43AF4DF3CD885C760

Function 00007FF7F67672C0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

connect to %s port %ld failed: %s, xrefs: 00007FF7F676753D
Connection failed, xrefs: 00007FF7F67676A6
Failed to connect to %s port %ld: %s, xrefs: 00007FF7F67677EE
Connection time-out, xrefs: 00007FF7F67673A9
After %I64dms connect time, move on!, xrefs: 00007FF7F6767485

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: c46a26357da5376d3779cb4f8916858d5a4d6c7b13c8843079734bc1f7a32b76
Instruction ID: b8d8fd01a3e0b68a67735fa91f85c6fa61495a60cb3dbb3752acb0f793d18796
Opcode Fuzzy Hash: c46a26357da5376d3779cb4f8916858d5a4d6c7b13c8843079734bc1f7a32b76
Instruction Fuzzy Hash: 0CE1F121A086C2C2EB24AB25D9642BFA7A9FB4C794F840235DA6D077D5DF3DE441C7B0

Function 00007FF7F6751AD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6750920: memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7F67411FC), ref: 00007FF7F6750958

SleepEx.KERNELBASE ref: 00007FF7F6751C8F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6751D03
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6751D44
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6751D7C

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789, xrefs: 00007FF7F6751B29
PRIVATE STORE - , xrefs: 00007FF7F6751CAB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleepmemcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$PRIVATE STORE -
API String ID: 18138616-2486835083
Opcode ID: f62d194c9a5506e1bc40a120267c7f5705a5248675cb0b804e02d88154972be3
Instruction ID: 12971431c7ec086708b9f4a8e13013a0a716bf60e85b4cf389d7117a014ffc1c
Opcode Fuzzy Hash: f62d194c9a5506e1bc40a120267c7f5705a5248675cb0b804e02d88154972be3
Instruction Fuzzy Hash: B481D932B1868186EB10EB24E8602AEA359FB8D794F905331EA7D07ADDDF7CD441C760

Function 00007FF7F6766810 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67668D6
recv.WS2_32 ref: 00007FF7F6766900
send.WS2_32 ref: 00007FF7F6766923
WSAGetLastError.WS2_32 ref: 00007FF7F6766935

Strings

Send failure: %s, xrefs: 00007FF7F6766965

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: ca5470411c4258048ad1888871490ee961161da3555aa0fa121fecf83c034f7d
Instruction ID: 24585736e107b5302c636d93d139083c33b4c81e375778658966726a742238a1
Opcode Fuzzy Hash: ca5470411c4258048ad1888871490ee961161da3555aa0fa121fecf83c034f7d
Instruction Fuzzy Hash: 9241B172705B8185EB61AB25E82077BA298BB0CBA8F940139CE7C473D4DE3DE440C7A0

Function 00007FF7F6742AE0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67428E7
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742957
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67429B7
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A07
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A57

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742C88

Part of subcall function 00007FF7F6744900: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67449C0

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742CD8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742D17
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742D65
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742DA4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742E58
memcpy.VCRUNTIME140 ref: 00007FF7F6742E7D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742F53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742F9A
ShellExecuteA.SHELL32 ref: 00007FF7F6743092
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674309A
MessageBoxA.USER32 ref: 00007FF7F67430D0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67430E1
Sleep.KERNEL32 ref: 00007FF7F6743149
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6743151
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F6743158

Part of subcall function 00007FF7F67431A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67432AF
Part of subcall function 00007FF7F67431A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67432F0

Part of subcall function 00007FF7F6743C70: memcpy.VCRUNTIME140 ref: 00007FF7F6743CC3

Part of subcall function 00007FF7F6743310: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67433F0

Part of subcall function 00007FF7F6743410: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67434F0

Strings

sessionid, xrefs: 00007FF7F6742EDE
success, xrefs: 00007FF7F6742EB6
message, xrefs: 00007FF7F6742FE3, 00007FF7F67430A1
download, xrefs: 00007FF7F6743055
open, xrefs: 00007FF7F6743089
invalidver, xrefs: 00007FF7F6743019
Failure, xrefs: 00007FF7F67430C7

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: 4321e6376f8cf166e1d68dd626c12fd4ce9c40b345431646f079e2283c4281c8
Instruction ID: e17b80e672a77287ab6ace3a1653487938e137b09c0b93daaf213a4efa265a1e
Opcode Fuzzy Hash: 4321e6376f8cf166e1d68dd626c12fd4ce9c40b345431646f079e2283c4281c8
Instruction Fuzzy Hash: 4A02E962A0C782C1EB00EB34D9583AEA765EF497A4F905235DA7D07AD9DF7DD084C3A0

Function 00007FF7F677BF00 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F677C541
memcpy.VCRUNTIME140 ref: 00007FF7F677C55D

Strings

schannel: failed to read data from server: %s, xrefs: 00007FF7F677C492
schannel: enough decrypted data is already available, xrefs: 00007FF7F677BF85
schannel: remote party requests renegotiation, xrefs: 00007FF7F677C322
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF7F677C4EE
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF7F677C358
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF7F677C0CD
schannel: can't renogotiate, an error is pending, xrefs: 00007FF7F677C4C2
schannel: renegotiation failed, xrefs: 00007FF7F677C4CE
schannel: server indicated shutdown in a prior call, xrefs: 00007FF7F677BFC8
schannel: Curl_read_plain returned error %d, xrefs: 00007FF7F677C2A1
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF7F677C39F
schannel: failed to decrypt data, need more data, xrefs: 00007FF7F677C46A
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF7F677C4E2
schannel: unable to re-allocate memory, xrefs: 00007FF7F677C03D, 00007FF7F677C4A6
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF7F677BFA5
schannel: server closed the connection, xrefs: 00007FF7F677C3D4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: 7b61faefabedc63db52135566a2b887fadd191366a05a4e082bc5cfa9fef71ad
Instruction ID: af4acba5657d9261103e2b18915d997c21fad3a83214f888b4000563bf3d97e3
Opcode Fuzzy Hash: 7b61faefabedc63db52135566a2b887fadd191366a05a4e082bc5cfa9fef71ad
Instruction Fuzzy Hash: 0D020472A28B4589EB50EB15DC6437BA7A8FB4CB94FA00135DA6D873E0DF79D440C7A0

Function 00007FF7F677B390 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677B480
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677B4D1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677B514
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677B5F7
memcpy.VCRUNTIME140 ref: 00007FF7F677B699
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677B702
memcpy.VCRUNTIME140 ref: 00007FF7F677B7DA
memset.VCRUNTIME140 ref: 00007FF7F677B9A7
CertFreeCertificateContext.CRYPT32 ref: 00007FF7F677BA0A

Strings

schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF7F677B806
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF7F677B8B4
SSL: public key does not match pinned public key!, xrefs: 00007FF7F677B9EC, 00007FF7F677BA14
SSL: failed retrieving public key from server certificate, xrefs: 00007FF7F677BA2A
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF7F677B89E, 00007FF7F677BAB2
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7F677BA4A
schannel: unable to re-allocate memory, xrefs: 00007FF7F677B522
schannel: unable to allocate memory, xrefs: 00007FF7F677BAFF
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7F677B86B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: 33083d5a4ab3fab8abe531587ed7af61f0cfc09a19abb5bdc5bef848adb27145
Instruction ID: f881caa1cee9111426febe2a1cb6720069148e01ae7beb55a6a9bd9aeda7825e
Opcode Fuzzy Hash: 33083d5a4ab3fab8abe531587ed7af61f0cfc09a19abb5bdc5bef848adb27145
Instruction Fuzzy Hash: F2127332A18B8185E760EF29DC643ABA7A8FB49B84F900136DA6D477D4DF38D445C7A0

Function 00007FF7F677A5B0 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7F677A681
GetProcAddress.KERNEL32 ref: 00007FF7F677A691

Strings

ntdll, xrefs: 00007FF7F677A67A
wine_get_version, xrefs: 00007FF7F677A68A
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF7F677A662
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7F677B073
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF7F677B24C, 00007FF7F677B293
schannel: unable to allocate memory, xrefs: 00007FF7F677B187
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF7F677B02F
http/1.1, xrefs: 00007FF7F677B093
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF7F677B329
http/1.1, xrefs: 00007FF7F677B0A7
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7F677A722
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7F677B26D
schannel: ALPN, offering %s, xrefs: 00007FF7F677B0B5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: 600a2d6ef8a24b98ff0e21a09ed65c441c72a1fdbf57e51a75a25158795c13ca
Instruction ID: 213d34c834def7dd56b4ec206c0b7b86d27020993bca822d2a90ba92eff958bb
Opcode Fuzzy Hash: 600a2d6ef8a24b98ff0e21a09ed65c441c72a1fdbf57e51a75a25158795c13ca
Instruction Fuzzy Hash: BF02B232A18B818AE710AF25D8602EFB7A8FB49B88F804135DA6D477D5DF3CD545C7A0

Function 00007FF7F675BBF0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BC22
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BCBD
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF7F675BCD6

Part of subcall function 00007FF7F67753A0: socket.WS2_32 ref: 00007FF7F67753E1

DeleteCriticalSection.KERNEL32 ref: 00007FF7F675BD10
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BD1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BD24
closesocket.WS2_32 ref: 00007FF7F675BD42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BD78
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F675BD7E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675BDAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BDC7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675BDD0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F675BE05
EnterCriticalSection.KERNEL32 ref: 00007FF7F675BE26
LeaveCriticalSection.KERNEL32 ref: 00007FF7F675BE3A
CloseHandle.KERNEL32 ref: 00007FF7F675BE47
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BE72
closesocket.WS2_32 ref: 00007FF7F675BE8B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BE9F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 9946771ebfa93f8112a25e13f28b7c82d86f9117cef022ce9e19fa975779aa41
Instruction ID: 472e5b42fdbb052e3b291c48892ee4aa3c6ab940fd21272c77174bbcd7df61c3
Opcode Fuzzy Hash: 9946771ebfa93f8112a25e13f28b7c82d86f9117cef022ce9e19fa975779aa41
Instruction Fuzzy Hash: C1817122D15B8182E724EF11E96027AB364FB99B54F445235DBAE037A6DF38E4D4C360

Function 00007FF7F6763260 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

ftp@example.com, xrefs: 00007FF7F676341F
No connections available., xrefs: 00007FF7F6763A01
anonymous, xrefs: 00007FF7F6763418
host, xrefs: 00007FF7F6763930
No more connections allowed to host %s: %zu, xrefs: 00007FF7F67639F2
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7F6763AE0
No connections available in cache, xrefs: 00007FF7F6763C5B
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF7F6763943
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7F6763AB2
proxy, xrefs: 00007FF7F6763922

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 5cb594704e5a14a3a99ff94c5cd79eddc6f9554907c6ec994f531ed743c6ce03
Instruction ID: a81e61e9c9ffe5eaadc44652aa4af2e4d55db5e9926bbce6425d2343bf1bd3bf
Opcode Fuzzy Hash: 5cb594704e5a14a3a99ff94c5cd79eddc6f9554907c6ec994f531ed743c6ce03
Instruction Fuzzy Hash: A942DA21A08BC2D1EB58AB2199603BAE798FB49B94F841135DE6D473C5DF3DE460C3B0

Function 00007FF7F67621F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67524A1,?,?,?,?,00007FF7F67435D1), ref: 00007FF7F6762208
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6762251

Strings

<, xrefs: 00007FF7F6762498
v, xrefs: 00007FF7F67624FF
<, xrefs: 00007FF7F676248E
<, xrefs: 00007FF7F6762367
`, xrefs: 00007FF7F67624EA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: 96fc72d4107bc01bf252997c18d8b870d50ec99ce162ed03cf5650f0768a792d
Instruction ID: 13ea348ba39edd2586e5f49c36f855918e7d980da0889f91477e65798b283e0d
Opcode Fuzzy Hash: 96fc72d4107bc01bf252997c18d8b870d50ec99ce162ed03cf5650f0768a792d
Instruction Fuzzy Hash: 6E915B32908BC185E3109F24D9143E977A4FB59B5CF485238DFA80A3DADFBA9195C760

Function 00007FF7F6768FA0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF7F6792DFA,?,?,?,?,00007FF7F676932B), ref: 00007FF7F6768FB4
GetProcAddress.KERNEL32(?,?,00007FF7F6792DFA,?,?,?,?,00007FF7F676932B), ref: 00007FF7F6768FD9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF7F6792DFA,?,?,?,?,00007FF7F676932B), ref: 00007FF7F6768FEC

Strings

AddDllDirectory, xrefs: 00007FF7F6769033
LoadLibraryExA, xrefs: 00007FF7F6768FCA
kernel32, xrefs: 00007FF7F6768FAD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: ed8c58319feda3e2ef0bf4467202deb353ecfa3ac03bdd26cde5824d9b1eb468
Instruction ID: e78f195efdb2dd7c0300290c5608e70c97b671c29900575d3dad146db70a6209
Opcode Fuzzy Hash: ed8c58319feda3e2ef0bf4467202deb353ecfa3ac03bdd26cde5824d9b1eb468
Instruction Fuzzy Hash: 06419452B0964385EB15AF16AD2017AA795AF4AF91F8C4130CE7D037E1EE3ED486C770

Function 00007FF7F6767C40 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF7F6767CAC
WSAGetLastError.WS2_32 ref: 00007FF7F6767CB6

Part of subcall function 00007FF7F6752E40: GetLastError.KERNEL32 ref: 00007FF7F6752E62
Part of subcall function 00007FF7F6752E40: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752E6A

getsockname.WS2_32 ref: 00007FF7F6767D36
WSAGetLastError.WS2_32 ref: 00007FF7F6767D40

Strings

getsockname() failed with errno %d: %s, xrefs: 00007FF7F6767D60
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF7F6767E5C
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7F6767DC6
getpeername() failed with errno %d: %s, xrefs: 00007FF7F6767CD6

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 1d68d23901f2bc99712f764ecee20f1df52790d8a263a8a7c26a230ac7d5d946
Instruction ID: 8f4f630cf10661a5f685bf698b340bcbba21966d3d7d27d4768465c25ae53617
Opcode Fuzzy Hash: 1d68d23901f2bc99712f764ecee20f1df52790d8a263a8a7c26a230ac7d5d946
Instruction Fuzzy Hash: 9591A332A18BC182D710DF25D9642EA73A4FB8CB88F885235DF5C47669DF39D185CB60

Function 00007FF7F6779010 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF7F6779032
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677909E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790D8
memcpy.VCRUNTIME140(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790F1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790FF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677913A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F6779143
freeaddrinfo.WS2_32(?,?,?,00007FF7F675BB35), ref: 00007FF7F6779171
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F6779185
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677918F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677919C
WSASetLastError.WS2_32(?,?,?,00007FF7F675BB35), ref: 00007FF7F67791BD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 1fb9b7d07c9e8a83ca4e6813051c7f37d9c67e9dd09fc361b0a1b938884a6115
Instruction ID: 68bdc13c299837ac1090660d521807330a8f84fdef09b44f3675354f4a570d56
Opcode Fuzzy Hash: 1fb9b7d07c9e8a83ca4e6813051c7f37d9c67e9dd09fc361b0a1b938884a6115
Instruction Fuzzy Hash: 80513D35A1A74282EB64AF11AD2413AA7A8FB59B90F444035DEAE03795DF3CE854C7B0

Function 00007FF7F6776920 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF7F677697D
Sleep.KERNEL32 ref: 00007FF7F677698E
WSASetLastError.WS2_32 ref: 00007FF7F6776AF8
Sleep.KERNEL32 ref: 00007FF7F6776B09
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776BBC
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776BD3
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776BEE
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776C02
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776C1D
__WSAFDIsSet.WS2_32 ref: 00007FF7F6776C31

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 7e3a5c8391cbd2fe5a66151918e3f45155f736d235638181fdd996934fd2847e
Instruction ID: 82648dcd39d278b9e14c8fca6b09318306f2751303bd9a923a672e61b237e249
Opcode Fuzzy Hash: 7e3a5c8391cbd2fe5a66151918e3f45155f736d235638181fdd996934fd2847e
Instruction Fuzzy Hash: 4A911C21B2C68286EF646E159C602BBE299FB4D354F944134E93E86BCCDE3CF9049670

Function 00007FF7F6765830 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676587F

Strings

Couldn't resolve host '%s', xrefs: 00007FF7F67659B1
Unix socket path too long: '%s', xrefs: 00007FF7F67658D6
Couldn't resolve proxy '%s', xrefs: 00007FF7F6765A5C

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: eff8b956742bb68419ca025f1cdfc5da50cfc823b85c2868b4250ee5da627a45
Instruction ID: 55ed381e3f84dbea154a0e9b377db486a298a9624fbd242f057d6ee90ff90c73
Opcode Fuzzy Hash: eff8b956742bb68419ca025f1cdfc5da50cfc823b85c2868b4250ee5da627a45
Instruction Fuzzy Hash: 3751D721A0CB82C6F719AB25D8A037AA798EB48794F940031DFAD437D5DF3EE45197B0

Function 00007FF7F6742880 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67428E7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742957
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67429B7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A07
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A57
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742AC8

Strings

h%49, xrefs: 00007FF7F6742A9E
.8, xrefs: 00007FF7F6742AA5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 23d25a257ec8e6a06825ac2238ab2d79f1aaa4dbc3fa61955fb06a3204d1439f
Instruction ID: 5171ce72734fbcf15097e085791a77fd9bca270f98e6d681416ac13f3f4895d1
Opcode Fuzzy Hash: 23d25a257ec8e6a06825ac2238ab2d79f1aaa4dbc3fa61955fb06a3204d1439f
Instruction Fuzzy Hash: 38618C22E187D688F301DB7CEC151BCB774BB9D708F845328CE9925E59EBA86148C3A4

Function 00007FF7F67A021C Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7F67A0245
__scrt_release_startup_lock.LIBCMT ref: 00007FF7F67A02B3
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A0301
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A0306
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A030E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A0316
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A0338
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67A0392

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: 53dfa699f0e776e93b8434ed3c0ad4270c14bc29c46198c7798260165ce92bd4
Instruction ID: 53ae35764e2a41b93819ce2f428673e5f236888ba4a523cc4555930315a2e434
Opcode Fuzzy Hash: 53dfa699f0e776e93b8434ed3c0ad4270c14bc29c46198c7798260165ce92bd4
Instruction Fuzzy Hash: 8B31FA21A0824382FB14BB659D712BB9299AF4D788FC44839E56D476F7DE2CF84482F1

Function 00007FF7F675BAE0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6779010: getaddrinfo.WS2_32 ref: 00007FF7F6779032
Part of subcall function 00007FF7F6779010: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677909E
Part of subcall function 00007FF7F6779010: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790D8
Part of subcall function 00007FF7F6779010: memcpy.VCRUNTIME140(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790F1
Part of subcall function 00007FF7F6779010: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F67790FF
Part of subcall function 00007FF7F6779010: freeaddrinfo.WS2_32(?,?,?,00007FF7F675BB35), ref: 00007FF7F6779171
Part of subcall function 00007FF7F6779010: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F6779185
Part of subcall function 00007FF7F6779010: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677918F
Part of subcall function 00007FF7F6779010: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F675BB35), ref: 00007FF7F677919C

WSAGetLastError.WS2_32 ref: 00007FF7F675BB3B
WSAGetLastError.WS2_32 ref: 00007FF7F675BB45
EnterCriticalSection.KERNEL32 ref: 00007FF7F675BB60
LeaveCriticalSection.KERNEL32 ref: 00007FF7F675BB6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675BB80
send.WS2_32 ref: 00007FF7F675BBA3
WSAGetLastError.WS2_32 ref: 00007FF7F675BBAD
LeaveCriticalSection.KERNEL32 ref: 00007FF7F675BBC0

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 2cc453d08f745c6a3c59f832767adf90c4defb3494f8eef72683afc19a1c4f9f
Instruction ID: d37d86a4ee3e709a5470fc5e196c5b27f0a7801e3bf1eb9f1c59565a5f8a001e
Opcode Fuzzy Hash: 2cc453d08f745c6a3c59f832767adf90c4defb3494f8eef72683afc19a1c4f9f
Instruction Fuzzy Hash: 3D311021608642C6EB50AF25D8B026AA3A4FB49F94F840171D56E836E8DF7CD885C7B1

Function 00007FF7F6776580 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7F67765E6
WSASetLastError.WS2_32 ref: 00007FF7F67767A6
Sleep.KERNEL32 ref: 00007FF7F67767B6
__WSAFDIsSet.WS2_32 ref: 00007FF7F67768CA
__WSAFDIsSet.WS2_32 ref: 00007FF7F67768E2
Sleep.KERNEL32 ref: 00007FF7F677690D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 8a5b4f1b789db9ccb89845b8f97dcc9209c77af34dde97e523798634a5c91cdc
Instruction ID: 8590717b3589c31b823157e24dd08009b305e6c1c4f21f8035a3c5748074b9be
Opcode Fuzzy Hash: 8a5b4f1b789db9ccb89845b8f97dcc9209c77af34dde97e523798634a5c91cdc
Instruction Fuzzy Hash: CCA10B21A3865286EF696E15DC2027BA29DFF49B94F944234DA3E467CCDF3DD90093B0

Function 00007FF7F67797F0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6779A1A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6779A5F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6779A87
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6779AC9

Strings

schannel: ApplyControlToken failure: %s, xrefs: 00007FF7F67798F8
schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF7F677986E
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7F67799E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: c3b4f57cf65ba70a8d264e738fe77378482dafe256b561fec5b44b1c6e9d6791
Instruction ID: 3739d16f2cf79574bf23aa2b8456c4147578db69c19ecf1fe661eef58d5858da
Opcode Fuzzy Hash: c3b4f57cf65ba70a8d264e738fe77378482dafe256b561fec5b44b1c6e9d6791
Instruction Fuzzy Hash: EC917C32615F8185EB109F2AD8606AEB7B8F789B84F840135CE6D477A9DF38D445CB60

Function 00007FF7F677C5D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677C66E
memcpy.VCRUNTIME140 ref: 00007FF7F677C706
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677C83C

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF7F677C804
select/poll on SSL socket, errno: %d, xrefs: 00007FF7F677C7E4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: 027ddc12495d3bc9130bb9d065d1a08c5876b868ffb2f9c7ad1546824842d674
Instruction ID: 8b45e7be0ff8a3383401ad3800da2791670098f15aae12db9a3bdc82d5b26b80
Opcode Fuzzy Hash: 027ddc12495d3bc9130bb9d065d1a08c5876b868ffb2f9c7ad1546824842d674
Instruction Fuzzy Hash: 13715E72B14B418AE710DB65D8606AE73B9BB4CBA8F404235DE3D477D4EE38E505C7A0

Function 00007FF7F6757640 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675768E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67576A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67577D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67577FE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF7F67578BB
%s, xrefs: 00007FF7F6757907

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 7bbbfc9fc39b892fe47f4d760995b619898a2bed64aad6e52c5ec38839e87b67
Instruction ID: f1ef3fc961d42e42d93953a75afc3f87ab310c47531c0c5b5d4287697a5d2b7b
Opcode Fuzzy Hash: 7bbbfc9fc39b892fe47f4d760995b619898a2bed64aad6e52c5ec38839e87b67
Instruction Fuzzy Hash: 45918731B0868182E758BB259D643BBA399FB49B84F844471DE6D076D9CF39E860C7F0

Function 00007FF7F6761AD0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6761AFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6761B11

Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676192D
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676194A
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676195E
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676197A
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761997
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619BA
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619CE
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619E2
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A08
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A1C
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A30
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A7F
Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A8C

Part of subcall function 00007FF7F67618B0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761AB5

memset.VCRUNTIME140 ref: 00007FF7F6761B45

Strings

User-Agent: %s, xrefs: 00007FF7F6761BDF
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7F6761D21

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 0b5af3561c7f0beabbbfc97a2aecd37f8a35a6766f80842a6e57c91dfd642cc5
Instruction ID: 6cb7b8abca0ac30633a0b1184c192a5c37d48fbfe05f54d9c8a52209683d76b5
Opcode Fuzzy Hash: 0b5af3561c7f0beabbbfc97a2aecd37f8a35a6766f80842a6e57c91dfd642cc5
Instruction Fuzzy Hash: 2371836290CBC2C1E751EF3998243BEA754EB59B94F984231DE6D0B2D5DF3AE45083B0

Function 00007FF7F6772050 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67720E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67720F1
memcpy.VCRUNTIME140 ref: 00007FF7F677210C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677226C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6772275

Strings

1.1, xrefs: 00007FF7F677205F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: 9c93a6a937aa17bde0d74d21f4712d5c5711554ab9829be0d6950b6c6c408ace
Instruction ID: df1e74874cd4801c716792de2f3614d1c3af61947026f7bd4705546db676a966
Opcode Fuzzy Hash: 9c93a6a937aa17bde0d74d21f4712d5c5711554ab9829be0d6950b6c6c408ace
Instruction Fuzzy Hash: 99516E72618A81C6D7649B26E9603AAA3A4FB49B84F844031DFBD47795DF3CE051C3A0

Function 00007FF7F6758738 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6758888
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67588CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67588FA

Part of subcall function 00007FF7F6757640: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675768E
Part of subcall function 00007FF7F6757640: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67576A5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675892F

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7F6757C76

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: 09adf2ee5de9c113138e5bdaa025590f3709708e40e62865b75a7a1d270c404f
Instruction ID: 68143d991b40f8b7e20b395544aaa9eac727100f7c6af52750e46b3d960a93c6
Opcode Fuzzy Hash: 09adf2ee5de9c113138e5bdaa025590f3709708e40e62865b75a7a1d270c404f
Instruction Fuzzy Hash: DED1B861A0865686FB14AF2598603BAE3A9FF49B88F845571CD2D072DDDF39E840C3F0

Function 00007FF7F6743590 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67428E7
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742957
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67429B7
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A07
Part of subcall function 00007FF7F6742880: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742A57

MessageBoxA.USER32 ref: 00007FF7F6743767

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67437CA

Strings

null, xrefs: 00007FF7F67435F2
keyauth.win, xrefs: 00007FF7F67436F3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: ce61b5d2d3cd7e7a6b303e8ebb867933d344e954f3b112cff01f36256831fc2a
Instruction ID: 64bc3725c9692b984026e4a5037ca0e945e749751a081a758bf7b921d332f777
Opcode Fuzzy Hash: ce61b5d2d3cd7e7a6b303e8ebb867933d344e954f3b112cff01f36256831fc2a
Instruction Fuzzy Hash: 5C51F922B1879185FB04EB75D8643AE6329EB48B94F804135DE6C17BDADF3C9551C3A0

Function 00007FF7F6792DC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6768FA0: GetModuleHandleA.KERNEL32(?,?,?,00007FF7F6792DFA,?,?,?,?,00007FF7F676932B), ref: 00007FF7F6768FB4

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF7F676932B), ref: 00007FF7F6792E10

Strings

secur32.dll, xrefs: 00007FF7F6792DE3
security.dll, xrefs: 00007FF7F6792DEA
InitSecurityInterfaceA, xrefs: 00007FF7F6792E06

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 5e3a6711635448fff0480283db2dd73f071ee0026d5417c64c4451555ff8fb5c
Instruction ID: aa3554c9b1adb64b94ce4aede6e8f1bd73193e132824891b1cf98558ef4fc585
Opcode Fuzzy Hash: 5e3a6711635448fff0480283db2dd73f071ee0026d5417c64c4451555ff8fb5c
Instruction Fuzzy Hash: CCF0FB64E1960381FF49BB25ADA57B293D8AF6D744FC41134C43C466E1FE6CE14582B0

Function 00007FF7F675826B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7F6757C76

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 7163487e0e08904306f2315dbf6caa09e5d06ad51b43a8eb750352c4f908bad4
Instruction ID: 27ba919f2b968e8b838df2ddbbdc09e87e1d53a57b5e51ccc940f916366810a3
Opcode Fuzzy Hash: 7163487e0e08904306f2315dbf6caa09e5d06ad51b43a8eb750352c4f908bad4
Instruction Fuzzy Hash: 07B19461A08652C6FB64BE25987437EE2A9EF49B48F941571C92E072D9DF39EC40C3F0

Function 00007FF7F6771C10 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6771D10

Part of subcall function 00007FF7F67722A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67722FA

Part of subcall function 00007FF7F6772050: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67720E8
Part of subcall function 00007FF7F6772050: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67720F1

Strings

TCP6, xrefs: 00007FF7F6771C97
PROXY %s %s %s %li %li, xrefs: 00007FF7F6771CE4
TCP4, xrefs: 00007FF7F6771CAA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 12a3b756e3a1d393b36be2a69d81cf88d7aceeae8688892eb10545e4adfc044c
Instruction ID: 3d6b6c82e84dfdb372523524f576ba5c5a80a468ecbf37bbc0f0623f15de9da7
Opcode Fuzzy Hash: 12a3b756e3a1d393b36be2a69d81cf88d7aceeae8688892eb10545e4adfc044c
Instruction Fuzzy Hash: CA41BC31A1C68245E750EF25AC203BBA7A9EB49784F984031DA6D476D5EE3DD444CBB0

Function 00007FF7F6756500 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF7F6752536,?,?,?,?,00000000,?,00007FF7F674374E), ref: 00007FF7F675651D
closesocket.WS2_32 ref: 00007FF7F6756629
closesocket.WS2_32 ref: 00007FF7F6756636

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: e28c916339dedfe44fd95df593345c4999c6d8e87ebf0f6fd9375ee375a5f3fe
Instruction ID: 3d73a4ab6315ed20fe701045f272070f8cf50c8f855235b0c539d95b5ff71ed4
Opcode Fuzzy Hash: e28c916339dedfe44fd95df593345c4999c6d8e87ebf0f6fd9375ee375a5f3fe
Instruction Fuzzy Hash: 7B413F31608B4281E750FF35D8602EAA369EB9C724FC84635DE6D462DAEF39D54583B0

Function 00007FF7F6750920 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7F67411FC), ref: 00007FF7F6750958
memcpy.VCRUNTIME140(?,0000006E00000006,?,FFFFFFFF,00007FF7F67411FC), ref: 00007FF7F67509F9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F6750A17

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task
String ID:
API String ID: 326894585-0
Opcode ID: b53f007d235b3f06568d166cbfc5e17c10bef2aa46fa8e4ff4674de9681ddfa7
Instruction ID: 650c8ed7399b3cf87901d24c93fa6fa9430257936307e68588e6733313fae95d
Opcode Fuzzy Hash: b53f007d235b3f06568d166cbfc5e17c10bef2aa46fa8e4ff4674de9681ddfa7
Instruction Fuzzy Hash: 3B31DD52B0964681FB157B61AD2437E92589F0CBA4F940670DE7D07BC9DF3CB89283B0

Function 00007FF7F677A3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF7F677A503
SSL/TLS connection timeout, xrefs: 00007FF7F677A51C

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 74baeda4dae7d99788308fae891779589567f69d9637ea5b15e34d4b19c0cf18
Instruction ID: 18a2c2572349a878746417cb32473a24e00b41e695dfa201c67c4fae45b2ea28
Opcode Fuzzy Hash: 74baeda4dae7d99788308fae891779589567f69d9637ea5b15e34d4b19c0cf18
Instruction Fuzzy Hash: 5D51D821A1868285FB54AB25996427BA398EB4C7A8F944231DE3D473D5DE3DE081C7B0

Function 00007FF7F6756700 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7F6756AF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6756B17

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: 9fb7283d3b3fe2a32a5a4308ef32750d50e53da8e2d5037518f41ed1d519b0cc
Instruction ID: 877ed3323a386dcd58bccb6e94ce7cc268568026ced541ab89117e33fb9d1db6
Opcode Fuzzy Hash: 9fb7283d3b3fe2a32a5a4308ef32750d50e53da8e2d5037518f41ed1d519b0cc
Instruction Fuzzy Hash: 08C1093260868285EB25AB2598603BBA3A4FB487A4F944275DE7D437D8DF3CEC41D760

Function 00007FF7F67627D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6762835

Strings

User-Agent: %s, xrefs: 00007FF7F6762846
Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7F6762974

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: f606bcd2038c5ef08dcce9581c18184adf0bd88fa452844af4fc4b9c61b2a22f
Instruction ID: f9b7bfa1b84bbdb08f7518fd31b77a8fc8a0f3452cec8c25a1c6a322248a4ab3
Opcode Fuzzy Hash: f606bcd2038c5ef08dcce9581c18184adf0bd88fa452844af4fc4b9c61b2a22f
Instruction Fuzzy Hash: A351A262A0C7C1C1E7819F24D9603AAA754E788B98F8C4131DEAC1B3DADF79D490C370

Function 00007FF7F6751DC0 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6751AD0: SleepEx.KERNELBASE ref: 00007FF7F6751C8F

SetConsoleTitleA.KERNEL32 ref: 00007FF7F6751E08
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6751E62

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ConsoleSleepTitle_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4275364305-0
Opcode ID: d93b49df8ad4e5ec2ae08ef71ace1e26886ffdca7d49e109a83afd150722af17
Instruction ID: 7ecfe8d7b9bde9637377561787d920a988d715e1cc2f80c14d05ce7771b00449
Opcode Fuzzy Hash: d93b49df8ad4e5ec2ae08ef71ace1e26886ffdca7d49e109a83afd150722af17
Instruction Fuzzy Hash: 26117361E1858681EB10FB24EC7436AA364FB8E795FC04235E5BD06AEDDE2CE440C770

Function 00007FF7F6771E30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6771E4F

Strings

HTTP/3 requested for non-HTTPS URL, xrefs: 00007FF7F6771EB8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc
String ID: HTTP/3 requested for non-HTTPS URL
API String ID: 2635317215-2596823961
Opcode ID: c5c85e1a956d13f6fd0069bca0f306340e2efd00978a76907ad6a57b28f2a682
Instruction ID: a034b486bab0a90b9386b73d3d2ca5aaa34a33d5b49048b3ab96fccc38d8f4f5
Opcode Fuzzy Hash: c5c85e1a956d13f6fd0069bca0f306340e2efd00978a76907ad6a57b28f2a682
Instruction Fuzzy Hash: 9A119E22B18A8082EB55DB16E4503AEA364E78CB84F885135EF5D07B99DF38D5918B60

Function 00007FF7F6766630 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7F676663C
WSAGetLastError.WS2_32 ref: 00007FF7F676664B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: cd326ec70821d1c6bd3ccd5998ab6033c7b5e388acd7fa64615cf810a5de8fbd
Instruction ID: 728656ef0f767c015c2e80a65beb2ae9760b4d998ceb0688406f2d1f04a4e8db
Opcode Fuzzy Hash: cd326ec70821d1c6bd3ccd5998ab6033c7b5e388acd7fa64615cf810a5de8fbd
Instruction Fuzzy Hash: 15E0DF21F0460982FF286771B87433A1298AB48731F884774CA3A867D0EA2C84D65761

Function 00007FF7F67523B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F67523D4
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F67523F5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID:
API String ID: 2168557111-0
Opcode ID: 0899256543c42a584bb2c1203292e23dbc0e11d5bfc7daf5769558ae29ecc1bd
Instruction ID: 6abaa1875163955079aaea99ce80c8b1638edd268ed4a1ca23b7de188f677ecc
Opcode Fuzzy Hash: 0899256543c42a584bb2c1203292e23dbc0e11d5bfc7daf5769558ae29ecc1bd
Instruction Fuzzy Hash: 4DE03932A08B8182D700AB50FD1446AF3A8FB987C4F844135EB9C47A68CF7CC1A5CB90

Function 00007FF7F6766F10 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF7F6766F53

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 28d1a3e97e11a378cd7bab388fd231acb8ccc8f46742947f7eb31e0aaede86b5
Instruction ID: cf47ba8011f61a908288edd589cb0cb11a4f3d8db2da313fbf53d325a0ac1eb9
Opcode Fuzzy Hash: 28d1a3e97e11a378cd7bab388fd231acb8ccc8f46742947f7eb31e0aaede86b5
Instruction Fuzzy Hash: 3501BE11B05541C1EB44EB2AD5683BFA350EF4CB84F984071D72D472D9CF2DD49587A1

Function 00007FF7F676EA30 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7F676EA59

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 9e121afd51efe3525e7e93993d230028a9956c294c58347a9c52cac5dba89217
Instruction ID: 25588e9752d274729a49d5e0d7e5a0ccd01913cfa0ca6d8bf9480b3328168bfd
Opcode Fuzzy Hash: 9e121afd51efe3525e7e93993d230028a9956c294c58347a9c52cac5dba89217
Instruction Fuzzy Hash: 97E02B35E06101C1CF08772188611B623607B44734FC44370C53C033D0CE2DD2569B70

Function 00007FF7F6779690 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67796AB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: a2f10a116a4385fa7276dd3863204c228892657fe7e053c5a7e9772d6e2cbb02
Instruction ID: 5ea0db11d0e67f8e96495117c346bab8e976d2c5b0ec5c7f553d7666b71fcf6f
Opcode Fuzzy Hash: a2f10a116a4385fa7276dd3863204c228892657fe7e053c5a7e9772d6e2cbb02
Instruction Fuzzy Hash: D9D0C263718A00829B109F61A850029E251B788770B884738AE7D82BE0EB38D1414600

Function 00007FF7F67755D0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7F67755E9

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 590ac8b3d2ea95d7b222035a517254eae77e8f4ea7ddc23fbb583e43bf786d7b
Instruction ID: 5552a6664fe284972b6fe86d77f45ac192745fea20609b4a1a82ae498344e579
Opcode Fuzzy Hash: 590ac8b3d2ea95d7b222035a517254eae77e8f4ea7ddc23fbb583e43bf786d7b
Instruction Fuzzy Hash: 9DC08056F15581C2C3446F615885087A771BBC4304FD56435D10742534DD3CC6E59B50

Non-executed Functions

Function 00007FF7F67731D0 Relevance: 127.2, APIs: 25, Strings: 47, Instructions: 1229stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6774393

Part of subcall function 00007FF7F6766430: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766555
Part of subcall function 00007FF7F6766430: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766570

memchr.VCRUNTIME140 ref: 00007FF7F6774486
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677459E
strchr.VCRUNTIME140 ref: 00007FF7F67745B2
strchr.VCRUNTIME140 ref: 00007FF7F67745DA
strchr.VCRUNTIME140 ref: 00007FF7F67745F0

Strings

close, xrefs: 00007FF7F6773963, 00007FF7F6773AE3
Content-Type:, xrefs: 00007FF7F6773786
Retry-After:, xrefs: 00007FF7F6773C13
no chunk, no close, no size. Assume close to signal end, xrefs: 00007FF7F6774186
HTTP error before end of send, stop sending, xrefs: 00007FF7F67743DD
HTTP/%1[23] %d, xrefs: 00007FF7F6773394
The requested URL returned error: %s, xrefs: 00007FF7F6774607
false, xrefs: 00007FF7F6773F40
HTTP 1.0, assume close after body, xrefs: 00007FF7F6773637
Keep sending data to get tossed away!, xrefs: 00007FF7F677442C
Location:, xrefs: 00007FF7F6773F9E
Content-Range:, xrefs: 00007FF7F6773C9E
RTSP/, xrefs: 00007FF7F67732C4
WWW-Authenticate:, xrefs: 00007FF7F6773E66
Set-Cookie:, xrefs: 00007FF7F6773D63
HTTP/, xrefs: 00007FF7F67734D9
Mark bundle as not supporting multiuse, xrefs: 00007FF7F677340F
HTTP, xrefs: 00007FF7F677458E
RTSP/%1d.%1d%c%3d, xrefs: 00007FF7F677355D
Received HTTP/0.9 when not allowed, xrefs: 00007FF7F67744FB
keep-alive, xrefs: 00007FF7F6773896, 00007FF7F6773A26
Last-Modified:, xrefs: 00007FF7F6773E07
HTTP error before end of send, keep sending, xrefs: 00007FF7F67743B9
Connection closure while negotiating auth (HTTP 1.0?), xrefs: 00007FF7F67741DC, 00007FF7F6774228
Connection:, xrefs: 00007FF7F677399B, 00007FF7F6773A50
Content-Length:, xrefs: 00007FF7F67736DF
Proxy-authenticate:, xrefs: 00007FF7F6773E91
Persistent-Auth, xrefs: 00007FF7F6773F02
Invalid Content-Length: value, xrefs: 00007FF7F6774648
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FF7F6773F5C
, xrefs: 00007FF7F67733BC
HTTP/1.0 connection set to keep alive!, xrefs: 00007FF7F6773B9B
Content-Encoding:, xrefs: 00007FF7F6773BD1
HTTP %3d, xrefs: 00007FF7F6773438
, xrefs: 00007FF7F6773572
Got 417 while waiting for a 100, xrefs: 00007FF7F6774373
Received 101, xrefs: 00007FF7F677466B
Proxy-Connection:, xrefs: 00007FF7F6773803, 00007FF7F67738DC
Lying server, not serving HTTP/2, xrefs: 00007FF7F67733EC
The requested URL returned error: %d, xrefs: 00007FF7F6774763
HTTP/1.0 proxy connection set to keep alive!, xrefs: 00007FF7F6773B5C
HTTP/%1d.%1d%c%3d, xrefs: 00007FF7F6773369
Unsupported HTTP version in response, xrefs: 00007FF7F6774571
Maximum file size exceeded, xrefs: 00007FF7F677462F
Transfer-Encoding:, xrefs: 00007FF7F6773B1A
Overflow Content-Length: value!, xrefs: 00007FF7F677376B
HTTP/1.1 proxy connection set close!, xrefs: 00007FF7F6773B7D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$fwrite$_strdupmemchrstrncmp
String ID: $ $ HTTP %3d$ HTTP/%1[23] %d$ HTTP/%1d.%1d%c%3d$ RTSP/%1d.%1d%c%3d$Connection closure while negotiating auth (HTTP 1.0?)$Connection:$Content-Encoding:$Content-Length:$Content-Range:$Content-Type:$Got 417 while waiting for a 100$HTTP$HTTP 1.0, assume close after body$HTTP error before end of send, keep sending$HTTP error before end of send, stop sending$HTTP/$HTTP/1.0 connection set to keep alive!$HTTP/1.0 proxy connection set to keep alive!$HTTP/1.1 proxy connection set close!$Invalid Content-Length: value$Keep sending data to get tossed away!$Last-Modified:$Location:$Lying server, not serving HTTP/2$Mark bundle as not supporting multiuse$Maximum file size exceeded$Negotiate: noauthpersist -> %d, header part: %s$Overflow Content-Length: value!$Persistent-Auth$Proxy-Connection:$Proxy-authenticate:$RTSP/$Received 101$Received HTTP/0.9 when not allowed$Retry-After:$Set-Cookie:$The requested URL returned error: %d$The requested URL returned error: %s$Transfer-Encoding:$Unsupported HTTP version in response$WWW-Authenticate:$close$false$keep-alive$no chunk, no close, no size. Assume close to signal end
API String ID: 3939785054-690044944
Opcode ID: 02b158a5d06cb4d669ca7a5a0a1d934c2b7e1cd1307387fd3b949a54989a76ae
Instruction ID: faca259194a4946294458c6af45f9ae32d256b99359e6ad95479431e66072183
Opcode Fuzzy Hash: 02b158a5d06cb4d669ca7a5a0a1d934c2b7e1cd1307387fd3b949a54989a76ae
Instruction Fuzzy Hash: BFC2B771A1868285FB50AB259C243FBA799EF49B98F884135CE2D473D9DE3DE440C7B0

Function 00007FF7F67592D0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 745stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF7F675AB27), ref: 00007FF7F6759340
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675935B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6759394
strchr.VCRUNTIME140 ref: 00007FF7F67593A7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6759527
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6759548
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675956B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6759578
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6759611
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675961A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6759632
strchr.VCRUNTIME140 ref: 00007FF7F675981F
strchr.VCRUNTIME140 ref: 00007FF7F6759839
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675992C
strchr.VCRUNTIME140 ref: 00007FF7F6759958
strrchr.VCRUNTIME140 ref: 00007FF7F675996A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675998B
memcpy.VCRUNTIME140 ref: 00007FF7F67599A4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6759A18
strchr.VCRUNTIME140 ref: 00007FF7F6759A3B
strchr.VCRUNTIME140 ref: 00007FF7F6759A50

Strings

secure, xrefs: 00007FF7F675959E
__Host-, xrefs: 00007FF7F6759541
#HttpOnly_, xrefs: 00007FF7F6759A0E
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF7F67598AF
TRUE, xrefs: 00007FF7F6759A87
path, xrefs: 00007FF7F67595FD
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF7F675973E
expires, xrefs: 00007FF7F67597B5
domain, xrefs: 00007FF7F6759651
Replaced, xrefs: 00007FF7F6759F41
localhost, xrefs: 00007FF7F675967F
Added, xrefs: 00007FF7F6759F4D
__Secure-, xrefs: 00007FF7F6759520
httponly, xrefs: 00007FF7F67595D6
version, xrefs: 00007FF7F675975B
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7F6759F57
max-age, xrefs: 00007FF7F6759788
%4095[^;=] =%4095[^;], xrefs: 00007FF7F67593E6
FALSE, xrefs: 00007FF7F6759A8E, 00007FF7F6759C8B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: e3f99c3e3755d2d6c1980cd8f88d78ae643bc3364991d747844ef04f6e2ddb54
Instruction ID: 05bc62b5d3bff11c43f1cd623d3ebd37dfeb96d60766c32a0bb5062bd79cc82a
Opcode Fuzzy Hash: e3f99c3e3755d2d6c1980cd8f88d78ae643bc3364991d747844ef04f6e2ddb54
Instruction Fuzzy Hash: D8728521A087C685FB61AB25DC6037BA7A8EF5D744F844171DA7D026DADF2CE844C3B0

Function 00007FF7F674959D Relevance: 78.0, APIs: 39, Strings: 5, Instructions: 975COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7F6749F9D
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7F6749FA4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A084
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A0B2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A0C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A0FB

Strings

object key, xrefs: 00007FF7F6749E2F, 00007FF7F674A669
object, xrefs: 00007FF7F674A349
object separator, xrefs: 00007FF7F6749CA3, 00007FF7F674A4DA
number overflow parsing ', xrefs: 00007FF7F6749FC0
array, xrefs: 00007FF7F674A1BA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Xbad_function_call@std@@__std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 1664669839-85532522
Opcode ID: 6bad89433c570a47db82fdfe098d3b7112479f4ef1bdb9ba293033d34251bd8a
Instruction ID: cbd337bdf619787d72d29c6ccbef919b573d0c85f5fb2e4605029f9654c1ed12
Opcode Fuzzy Hash: 6bad89433c570a47db82fdfe098d3b7112479f4ef1bdb9ba293033d34251bd8a
Instruction Fuzzy Hash: E8A2E762A1CB86C5EB00EB78D8543AEA365FB49794F900235DA7D03AD9DF7CD085D3A0

Function 00007FF7F6796410 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF7F679657F
GetLastError.KERNEL32 ref: 00007FF7F6796592
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF7F6796644
GetLastError.KERNEL32 ref: 00007FF7F679664E
CertGetCertificateChain.CRYPT32 ref: 00007FF7F67966DB
GetLastError.KERNEL32 ref: 00007FF7F67966E5
CertGetNameStringA.CRYPT32 ref: 00007FF7F6796853
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF7F6796CCB
CertCloseStore.CRYPT32 ref: 00007FF7F6796CE0
CertFreeCertificateChain.CRYPT32 ref: 00007FF7F6796CF0
CertFreeCertificateContext.CRYPT32 ref: 00007FF7F6796D00

Strings

schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF7F67967A9
schannel: CertFindExtension() returned no extension., xrefs: 00007FF7F67968CB, 00007FF7F6796A67
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF7F679677C
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF7F6796C56
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF7F6796792
schannel: Empty DNS name., xrefs: 00007FF7F679695A, 00007FF7F6796B08
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF7F67967BA
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF7F679691E, 00007FF7F6796AC5
schannel: Null certificate info., xrefs: 00007FF7F67968A3, 00007FF7F6796A34
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF7F6796668
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF7F6796B93
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF7F679699D
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF7F6796C09
schannel: server certificate name verification failed, xrefs: 00007FF7F6796C3E
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF7F67966FF
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF7F6796BF9
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7F6796C7D
schannel: Null certificate context., xrefs: 00007FF7F6796868, 00007FF7F6796A17
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF7F679674D
2.5.29.17, xrefs: 00007FF7F67968B3, 00007FF7F67968E4, 00007FF7F6796A4F, 00007FF7F6796A8B
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF7F6796765
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7F6796551
schannel: Not enough memory to list all host names., xrefs: 00007FF7F6796B7C
schannel: failed to create certificate store: %s, xrefs: 00007FF7F67965AC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: 8fe9d2f109287e050480a03d61a4f1592479ca31c33be7afb087222c66a7d160
Instruction ID: ea034ed646a29695ff2e402cd190b69aff4aaf570bf224b5d2c1f3ac5f6c6c9b
Opcode Fuzzy Hash: 8fe9d2f109287e050480a03d61a4f1592479ca31c33be7afb087222c66a7d160
Instruction Fuzzy Hash: 2342A431A08B4285FB10AB25D8602BBA3A9FB4DB94F944235D96D077D4EF3CE544E7B0

Function 00007FF7F6785330 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6785411
getsockname.WS2_32 ref: 00007FF7F678560A
WSAGetLastError.WS2_32 ref: 00007FF7F6785614
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6785B4B

Strings

,%d,%d, xrefs: 00007FF7F6785A29
bind(port=%hu) failed: %s, xrefs: 00007FF7F6785875
socket failure: %s, xrefs: 00007FF7F678570F, 00007FF7F6785916
Failure sending PORT command: %s, xrefs: 00007FF7F6785A7C
EPRT, xrefs: 00007FF7F6785AC2
%s %s, xrefs: 00007FF7F6785A59
PORT, xrefs: 00007FF7F6785A52
getsockname() failed: %s, xrefs: 00007FF7F678562E, 00007FF7F678583E
Failure sending EPRT command: %s, xrefs: 00007FF7F6785AFF
failed to resolve the address provided to PORT: %s, xrefs: 00007FF7F6785B39
bind() failed, we ran out of ports!, xrefs: 00007FF7F6785806
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF7F67857A4
%s |%d|%s|%hu|, xrefs: 00007FF7F6785AD9

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: 27752254a2b98af5a327733a83d12af13c9a39782593a03f8ff59690da20c5f1
Instruction ID: 107491ebb09795e2e63f0da8df6b10e8af81a77e53d0827c7204770bfbd5aac7
Opcode Fuzzy Hash: 27752254a2b98af5a327733a83d12af13c9a39782593a03f8ff59690da20c5f1
Instruction Fuzzy Hash: 2022C861A0878281FB90AB31DC602BBA799FB4DB84FD44031EA6D476D5DE3CE944C7B0

Function 00007FF7F6796D30 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F6796D76

Part of subcall function 00007FF7F6752F80: GetLastError.KERNEL32 ref: 00007FF7F6752F9C
Part of subcall function 00007FF7F6752F80: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752FA4

CreateFileA.KERNEL32 ref: 00007FF7F6796DD0
GetLastError.KERNEL32 ref: 00007FF7F6796DE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679711D

Strings

schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7F6796E42
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7F6796D90
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7F6797020
-----END CERTIFICATE-----, xrefs: 00007FF7F6796F49
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7F67970F3
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7F6796DFB
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7F6797056
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7F67970A5
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7F67970E2
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7F6796F1E
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7F6796E79
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7F67970C1
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7F6797075

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: b60ae0a3e11252f255f745c7d8c5013fc966c3bf32b0f57156b27088207e8443
Instruction ID: 7c37a2926c604743365579f73ca3d9784a0c57305fe822e8315a7fc5fa90ee3e
Opcode Fuzzy Hash: b60ae0a3e11252f255f745c7d8c5013fc966c3bf32b0f57156b27088207e8443
Instruction Fuzzy Hash: A7B19321B1874282F711AB25EC206ABA6A9BB4D784FD00135DE6D477D4EE3DE504DBF0

Function 00007FF7F6791EF0 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 425COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6791FA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792061
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679206F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792081

Strings

digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FF7F679229B
realm, xrefs: 00007FF7F6792207
WDigest, xrefs: 00007FF7F6791F31, 00007FF7F6792365

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm
API String ID: 2190258309-2223379150
Opcode ID: 00054798b3ee31d4ec5c4e2b6474e5fe0190e5e25ecd9c171ea297b6566ac7c2
Instruction ID: 48d00b2c80331fa3c3ba388d736c039641cbcf6ea488433122155bc7445efcfb
Opcode Fuzzy Hash: 00054798b3ee31d4ec5c4e2b6474e5fe0190e5e25ecd9c171ea297b6566ac7c2
Instruction Fuzzy Hash: CE127F32A18B4685E710EF25E9642AAB7E8FB49B84F900135DE6D43B94EF38D505C7B0

Function 00007FF7F6767F70 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 317stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F6768042
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676805D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676809C

Strings

getsockname() failed with errno %d: %s, xrefs: 00007FF7F67683EC
Couldn't bind to interface '%s', xrefs: 00007FF7F67681E0
bind failed with errno %d: %s, xrefs: 00007FF7F6768428
Local Interface %s is ip %s using address family %i, xrefs: 00007FF7F6768157
Local port: %hu, xrefs: 00007FF7F6768445
Couldn't bind to '%s', xrefs: 00007FF7F6768132
Name '%s' family %i resolved to '%s' family %i, xrefs: 00007FF7F6768268
Bind to local port %hu failed, trying next, xrefs: 00007FF7F6768350

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strncmp$memset
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 3268688168-2769131373
Opcode ID: 542789331aea4744b241b9653c3e388fd6f0a648ef1bcf93e0f4917bb3758312
Instruction ID: c5abb9cb9e798367fe939cea1310b18a6d22f381314939fa2c051b8ce096b9a0
Opcode Fuzzy Hash: 542789331aea4744b241b9653c3e388fd6f0a648ef1bcf93e0f4917bb3758312
Instruction Fuzzy Hash: 17E1D222A1868285E710EB21DC202BBE768FB9DB88F805135DE6E437D5DF7DD58487B0

Function 00007FF7F674977B Relevance: 37.3, APIs: 18, Strings: 3, Instructions: 509COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7F6749FA4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A084
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A0B2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A0C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A0FB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A13A

Strings

object, xrefs: 00007FF7F674A349
number overflow parsing ', xrefs: 00007FF7F6749FC0
array, xrefs: 00007FF7F674A1BA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$Xbad_function_call@std@@
String ID: array$number overflow parsing '$object
API String ID: 958247072-579821726
Opcode ID: cc42e23da44563c21996daa89caf7799f9ff30c9e3c015dcccd6dd62b989381a
Instruction ID: 976883b22ad274d2f5bec39ea06a4fcb818b78371423bbfbe6f40bc2156f8fa4
Opcode Fuzzy Hash: cc42e23da44563c21996daa89caf7799f9ff30c9e3c015dcccd6dd62b989381a
Instruction Fuzzy Hash: 9D32D462A18B86C5EB10DB78D8583EEA325FB49794F904235DA6D07AD9DF7CD080D3A0

Function 00007FF7F6790EC0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 252fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000468,00000470,00000000,?), ref: 00007FF7F6790F53
fgets.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6790F7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6791042
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679104E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67910B2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67910BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67911C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67911CF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F67911DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679122F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679124E

Strings

password, xrefs: 00007FF7F67910F9
machine, xrefs: 00007FF7F6791111, 00007FF7F6791152
, xrefs: 00007FF7F6790F91, 00007FF7F6791192
login, xrefs: 00007FF7F67910DE
default, xrefs: 00007FF7F679116D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup$fclosefgetsfopen
String ID: $default$login$machine$password
API String ID: 431015889-155862542
Opcode ID: 3b9ab05d245bb638eb372d7337051c70e5ccafd0718b603233c0295b21409033
Instruction ID: ac96f0563f23f4ca43e6825d52fa1ce6f02feaefa648439c51a2a9cd000abc23
Opcode Fuzzy Hash: 3b9ab05d245bb638eb372d7337051c70e5ccafd0718b603233c0295b21409033
Instruction Fuzzy Hash: C8A1C422A1D68295FB61AB359D3037BE6E8AF5D784F884031DE6D026D4FE3DE45086B0

Function 00007FF7F6778600 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F677887E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6778886
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F677889C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67788A5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67788AD
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67788B7

Strings

GMT, xrefs: 00007FF7F6778777
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF7F67786BE
%02d:%02d%n, xrefs: 00007FF7F677885D
%02d:%02d:%02d%n, xrefs: 00007FF7F6778829

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 630c3f7c29af7cc51b7054100824388b0dc4b27b1364d234017239c35fcdbd3b
Instruction ID: fe74a8b5736532029c9c12bf9f04048b36cb5435c289c36b49505cf09712eff2
Opcode Fuzzy Hash: 630c3f7c29af7cc51b7054100824388b0dc4b27b1364d234017239c35fcdbd3b
Instruction Fuzzy Hash: B4F1FA72F245118AEB24AB64C8201BEFBA9BB58758F904235DE3E577D4DE38E40587F0

Function 00007FF7F675279A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF7F675279A
%s - %s, xrefs: 00007FF7F6752BD9
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 829df8a539cfc324d627f26e87fab25fce76e1812c0feca66b179d4148e9b6fe
Instruction ID: fd9ecdbabb28db53791cf10216125e6106d6589a00287bf0e8cc6e3ff928646a
Opcode Fuzzy Hash: 829df8a539cfc324d627f26e87fab25fce76e1812c0feca66b179d4148e9b6fe
Instruction Fuzzy Hash: 2031432260D6C185E761BF20AD243ABB3A8FB88744F840575DABD02AD9DF3CD544CBB0

Function 00007FF7F6760F40 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF7F6761181
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF7F676180A
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7F67611A6
Server doesn't support multiplex yet, wait, xrefs: 00007FF7F676108B
can multiplex, xrefs: 00007FF7F6761042
serially, xrefs: 00007FF7F676104E
Can not multiplex, even if we wanted to!, xrefs: 00007FF7F67610FA
Multiplexed connection found!, xrefs: 00007FF7F67617B1
Could multiplex, but not asked to!, xrefs: 00007FF7F67610DC
Server doesn't support multiplex (yet), xrefs: 00007FF7F67610AF
Found bundle for host %s: %p [%s], xrefs: 00007FF7F6761059

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: 463185ac01c37561fe25943f588e72614978ff5e74e0f5d87f8adfd4293e2094
Instruction ID: 678f73f62596f11851353d8dc3a2433fe6a11447e4e1cde615b7ae8f825097a2
Opcode Fuzzy Hash: 463185ac01c37561fe25943f588e72614978ff5e74e0f5d87f8adfd4293e2094
Instruction Fuzzy Hash: CB42F825A0C2C2C5EB95AA39C9343FBB7D8EB49785F884035CA6D476C5DF2EA450C7B0

Function 00007FF7F679F870 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7F679F8B6
CryptCreateHash.ADVAPI32 ref: 00007FF7F679F8DA
CryptHashData.ADVAPI32 ref: 00007FF7F679F8F6
CryptGetHashParam.ADVAPI32 ref: 00007FF7F679F915
CryptGetHashParam.ADVAPI32 ref: 00007FF7F679F938
CryptDestroyHash.ADVAPI32 ref: 00007FF7F679F948
CryptReleaseContext.ADVAPI32 ref: 00007FF7F679F95A

Strings

@, xrefs: 00007FF7F679F88D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 2faf0608d56b9c58672882d9ff8660f1ea1e60fa0df29c845616acc5bcf4b34a
Instruction ID: 0c4b56bbe0087471dd79d91f8dd28f772f8ba3ae2b9295fefa505ce9708568b6
Opcode Fuzzy Hash: 2faf0608d56b9c58672882d9ff8660f1ea1e60fa0df29c845616acc5bcf4b34a
Instruction Fuzzy Hash: F021823262868186E760AF21E86466BF365FBCDB84F845135EB9E43E58DF3CD405CB60

Function 00007FF7F67A06AC Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7F67A06C8
memset.VCRUNTIME140 ref: 00007FF7F67A06EC
RtlCaptureContext.KERNEL32 ref: 00007FF7F67A06F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7F67A070F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7F67A0750
memset.VCRUNTIME140 ref: 00007FF7F67A0783
IsDebuggerPresent.KERNEL32 ref: 00007FF7F67A07A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F67A07C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7F67A07CC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 1a54c212ee74d5254ce934133b79b156ec1c6a6db0b5f5b7bb79e8dd12b40982
Instruction ID: 07415d3c51f290dd1b47abf57683c0dfd78af54d90079443204759b14fc5c1af
Opcode Fuzzy Hash: 1a54c212ee74d5254ce934133b79b156ec1c6a6db0b5f5b7bb79e8dd12b40982
Instruction Fuzzy Hash: 1B312172609B8286EB60AF60EC503EE7364FB88748F844439DB5D47BA4EF38D548C760

Function 00007FF7F679D780 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7F679D7C7
CryptImportKey.ADVAPI32 ref: 00007FF7F679D899
CryptReleaseContext.ADVAPI32 ref: 00007FF7F679D8B1
CryptEncrypt.ADVAPI32 ref: 00007FF7F679D8E2
CryptDestroyKey.ADVAPI32 ref: 00007FF7F679D8EC
CryptReleaseContext.ADVAPI32 ref: 00007FF7F679D8F8

Strings

@, xrefs: 00007FF7F679D7AD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: 6c2ab8d22f959655aa670125644ca85f2505b009f973729a6368826819c2f17d
Instruction ID: e371ee3615575fd6bbe926152601fc8654068fb8633962ae042a64183365ca6a
Opcode Fuzzy Hash: 6c2ab8d22f959655aa670125644ca85f2505b009f973729a6368826819c2f17d
Instruction Fuzzy Hash: 1141B222B086908EF7109B75D8607EE7BB5F74A348F444025DEAD17A9ACB3CD11AD760

Function 00007FF7F678C090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678C0DF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678C13C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678C160
bind.WS2_32 ref: 00007FF7F678C1DB
WSAGetLastError.WS2_32 ref: 00007FF7F678C1E5

Strings

bind() failed; %s, xrefs: 00007FF7F678C200

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 517eae6072fed6fd1dfaa199e013888d39c7c5739371c6c61649afd4258ac5ae
Instruction ID: 808849b3ff2a55d6202f5f57197c9dec2bf90f03252040d6f70bcc2d68ebcd30
Opcode Fuzzy Hash: 517eae6072fed6fd1dfaa199e013888d39c7c5739371c6c61649afd4258ac5ae
Instruction Fuzzy Hash: 74519C71A0878282EB15AB35C9603BAB2A8FB4CF84F944035CA6D477D5DF3CE85187B0

Function 00007FF7F6775D20 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dG, xrefs: 00007FF7F6775E14
%4I64dT, xrefs: 00007FF7F6775E30
%5I64d, xrefs: 00007FF7F6775D35
%4I64dM, xrefs: 00007FF7F6775DBC
%2I64d.%0I64dG, xrefs: 00007FF7F6775DDA
%4I64dP, xrefs: 00007FF7F6775E3D
%4I64dk, xrefs: 00007FF7F6775D4E
%2I64d.%0I64dM, xrefs: 00007FF7F6775D69

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 68db513a4d4b7ba3db95311676e70f7e987f09789aa417ec7d3a490e4e8e7615
Instruction ID: 90e76d2a75ec7cdc45e6a70db30cf9ba91f9422e9e2f01c82721073827158248
Opcode Fuzzy Hash: 68db513a4d4b7ba3db95311676e70f7e987f09789aa417ec7d3a490e4e8e7615
Instruction Fuzzy Hash: 5A217755E2D94A47FF14EB95AC307F683195B4C780FD00432E92E0A7E19FACA542C2F0

Function 00007FF7F676A180 Relevance: 8.2, Strings: 6, Instructions: 693COMMON

Download Yara Rule

Strings

.%ld, xrefs: 00007FF7F676A4E9
(nil), xrefs: 00007FF7F676A9E6
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF7F676A1C3, 00007FF7F676A694, 00007FF7F676A6FB
(nil), xrefs: 00007FF7F676A964
%ld, xrefs: 00007FF7F676A490
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF7F676A69B, 00007FF7F676A706

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: %ld$(nil)$(nil)$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 0-1379995092
Opcode ID: 0c1808b9c04dba6c0537016bc3371ffc92631462d09866dd86f1be3741a9d0a2
Instruction ID: 41ccf5e5a0dc0e672c56c57e9a146b23dc34fd3a62bca9e8a7a1b16f18dcec3f
Opcode Fuzzy Hash: 0c1808b9c04dba6c0537016bc3371ffc92631462d09866dd86f1be3741a9d0a2
Instruction Fuzzy Hash: D4424A3290CA83C5E721AA189D2437BE795FF48798FD44231DA7E476D4DE3EE84186B0

Function 00007FF7F6741000 Relevance: 6.7, Strings: 5, Instructions: 452COMMON

Download Yara Rule

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7F6741037
9WIvTVJa9m, xrefs: 00007FF7F674155C
3ee9e40d39e383d059f410c5d176cbefa3865cab68dfcd7cde49bcebd7424293, xrefs: 00007FF7F6741314
Loader Principal | Private Store, xrefs: 00007FF7F674157A
2.6, xrefs: 00007FF7F6741205

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: 2.6$3ee9e40d39e383d059f410c5d176cbefa3865cab68dfcd7cde49bcebd7424293$9WIvTVJa9m$Loader Principal | Private Store$https://keyauth.win/api/1.2/
API String ID: 0-1941432435
Opcode ID: 8fa17baa35698e9081550046c7c0ccd4169360e85c10b5ede3bbec3f9531fe95
Instruction ID: baa219910a44eb65de207f0102fb2c354550064325f597cea64ff43cb0fd000a
Opcode Fuzzy Hash: 8fa17baa35698e9081550046c7c0ccd4169360e85c10b5ede3bbec3f9531fe95
Instruction Fuzzy Hash: DC124A22D2D7824AF703A739DC111A5E75C9FA7781F90D336ED6431CA7EF29A282C254

Function 00007FF7F67A08C4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F67A08F0
GetCurrentThreadId.KERNEL32 ref: 00007FF7F67A08FE
GetCurrentProcessId.KERNEL32 ref: 00007FF7F67A090A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7F67A091A

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2d4f7db5757917a2a277bb3a7b4c4408b8485e3dabffe06df6407e9d8fc6ad37
Instruction ID: 6b2eb62fbeb3a1ba9b6665788eefb4d6d3fdef8ea2fe9ca22d1a7c3e8dca39dd
Opcode Fuzzy Hash: 2d4f7db5757917a2a277bb3a7b4c4408b8485e3dabffe06df6407e9d8fc6ad37
Instruction Fuzzy Hash: 2A111C26B14B0289EB00DF64EC642B973B8F75D758F840E31DA7D86BA8DF78D15483A0

Function 00007FF7F6789440 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7F678947B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67894AF

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 09a5b7d0a19d5a5080428c22b692b7231929b54e28db978406f224c4a795607f
Instruction ID: 4d1467cc50c3f111559ade2c02d468b9460c135d0ce886a7e12143fe82886090
Opcode Fuzzy Hash: 09a5b7d0a19d5a5080428c22b692b7231929b54e28db978406f224c4a795607f
Instruction Fuzzy Hash: C2117C22A247D0CAD304CF35E5001AE77B0FB5CB84B44962AFB9987B58EB78C6D0C744

Function 00007FF7F674DED0 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7F674DFD4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 0999894a38dc5b9fcd466583d64232a7d4a04029503bfc054329bfa97a126675
Instruction ID: 816b78e9aad528d093b6eaf90d3d9856f85fb45c6dbd8ef402ff2cee32b91cf8
Opcode Fuzzy Hash: 0999894a38dc5b9fcd466583d64232a7d4a04029503bfc054329bfa97a126675
Instruction Fuzzy Hash: 3B81CF22B19B99C8EB00DB69D8A83AD77B4E719B48F944026DFAD47795DF39D040C3A0

Function 00007FF7F674D340 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction ID: c2921cb7022b75fc0b23bd77ffe6542abd1b8da74d08888210de5d2dcf1742aa
Opcode Fuzzy Hash: 23195db887e80f4d2cea8d575e2b125909b75d07273f377a0876d07e28769e32
Instruction Fuzzy Hash: 2F61F372B0DB4482DB10DB29E85827AA2A5E7597D4F518335DEAD47BC8EF3CE181C360

Function 00007FF7F6751780 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction ID: 3f8e9ccb06875a50519bc27fb295e2f912d5206b2477ff6e8efb59e580553656
Opcode Fuzzy Hash: c7ce16abf6dabfd6c05904dcfc4add426f37854a28f683b97e97ab74344d31e2
Instruction Fuzzy Hash: BA418233B1155487E78CCE2AC8256AE73E6F39D304F85C239EA1A87389DA399905CB40

Function 00007FF7F679F800 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: b1be0640d988e434ace12c8ad06931d41b5d71802ec6a1437ca12effe976ac23
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 90F08C25325B67BEFE84853B4A24FBD5E809BC0700FA369748C80020CB96AE5493D724

Function 00007FF7F67A0854 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8db9603258850444462101a3ae1cdcc35cbb873210dfaf0ec72ac43398cd4d
Instruction ID: 4555b75df71d6793e67c09cd34a9f4c7027910979c7e76b4d8bfa61864ac9d93
Opcode Fuzzy Hash: 9c8db9603258850444462101a3ae1cdcc35cbb873210dfaf0ec72ac43398cd4d
Instruction Fuzzy Hash: 3EA0012591C90690E748AB01EE60036A2A9AB58708F8A1431C12D414B0AE3DE50092B5

Function 00007FF7F6779D70 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7F6779DA3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779DF3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E2A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E84
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779E9C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6779EB4

Strings

CALG_SEAL, xrefs: 00007FF7F6779FF7
CALG_AES, xrefs: 00007FF7F677A2A9
CALG_HMAC, xrefs: 00007FF7F677A1F5
CALG_MD4, xrefs: 00007FF7F6779E41
CALG_SSL3_MASTER, xrefs: 00007FF7F677A105
CALG_3DES_112, xrefs: 00007FF7F6779F61
CALG_SHA_512, xrefs: 00007FF7F677A303
CALG_3DES, xrefs: 00007FF7F6779F7F
CALG_HUGHES_MD5, xrefs: 00007FF7F677A06F
CALG_SSL3_SHAMD5, xrefs: 00007FF7F677A0E7
CALG_RSA_SIGN, xrefs: 00007FF7F6779ECB
CALG_RSA_KEYX, xrefs: 00007FF7F6779F25
CALG_MD5, xrefs: 00007FF7F6779E5F
CALG_TEK, xrefs: 00007FF7F677A0AB
CALG_DESX, xrefs: 00007FF7F6779F9D
CALG_HASH_REPLACE_OWF, xrefs: 00007FF7F677A231
CALG_SHA, xrefs: 00007FF7F6779E7D
CALG_MD2, xrefs: 00007FF7F6779E23
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF7F677A141
CALG_TLS1PRF, xrefs: 00007FF7F677A213
CALG_AGREEDKEY_ANY, xrefs: 00007FF7F677A051
CALG_AES_192, xrefs: 00007FF7F677A26D
CALG_ECMQV, xrefs: 00007FF7F677A339
CALG_SSL2_MASTER, xrefs: 00007FF7F677A19B
CALG_SHA_384, xrefs: 00007FF7F677A2E5
CALG_ECDH, xrefs: 00007FF7F677A31E
CALG_DH_EPHEM, xrefs: 00007FF7F677A033
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF7F677A15F
CALG_DH_SF, xrefs: 00007FF7F677A015
CALG_SHA_256, xrefs: 00007FF7F677A2C7
CALG_RC5, xrefs: 00007FF7F677A1D7
CALG_DES, xrefs: 00007FF7F6779F43
CALG_RC4, xrefs: 00007FF7F6779FD9
CALG_MAC, xrefs: 00007FF7F6779EAD
CALG_TLS1_MASTER, xrefs: 00007FF7F677A1B9
CALG_DSS_SIGN, xrefs: 00007FF7F6779EE9
CALG_NO_SIGN, xrefs: 00007FF7F6779F07
CALG_PCT1_MASTER, xrefs: 00007FF7F677A17D
CALG_AES_256, xrefs: 00007FF7F677A28B
CALG_ECDH_EPHEM, xrefs: 00007FF7F677A36F
CALG_RC2, xrefs: 00007FF7F6779FBB
CALG_CYLINK_MEK, xrefs: 00007FF7F677A0C9
CALG_AES_128, xrefs: 00007FF7F677A24F
CALG_SHA1, xrefs: 00007FF7F6779E95
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF7F677A123
CALG_SKIPJACK, xrefs: 00007FF7F677A08D
CALG_ECDSA, xrefs: 00007FF7F677A354

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: 1476ea0ef0adb97c11199459e1c21d3f1b1baaf42e53f88caec01919b2fcf727
Instruction ID: a4caf216c530d6032fe5e127dc49bb60325cfb8ed49797c183223e546c74c1e1
Opcode Fuzzy Hash: 1476ea0ef0adb97c11199459e1c21d3f1b1baaf42e53f88caec01919b2fcf727
Instruction Fuzzy Hash: B202F811B3C91391FB50FB24DD605BB926DAF5938CFC04532E92E8A5EAEE1CE51583B0

Function 00007FF7F6765390 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F676E0F0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7F675616F), ref: 00007FF7F676E107

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676551D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765531
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765545
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765559
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676556D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765581
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765595
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67655A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67655BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67655D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67655E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67655F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676560D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765621
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765635
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765649

Part of subcall function 00007FF7F676F820: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676F85E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676565D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765671
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765685
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765699
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67656AD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67656C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67656D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67656E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67656FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765711
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765725
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765739
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676574D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765761

Part of subcall function 00007FF7F67631E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763168), ref: 00007FF7F67631FB
Part of subcall function 00007FF7F67631E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763168), ref: 00007FF7F6763229

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676578B

Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9A1
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9B1
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9BF
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9CD
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9DB
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9E9
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675F9F7
Part of subcall function 00007FF7F675F990: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6763196), ref: 00007FF7F675FA05

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67657B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67657CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67657DB

Strings

Closing connection %ld, xrefs: 00007FF7F6765489

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: de2c1edf53598d592dc1581178fbfc545894e5021b0248a3bd883db2142b5919
Instruction ID: acccf0e6fe742c3d58e6b87623e2d3cb06a7123787c71242912911262acca48a
Opcode Fuzzy Hash: de2c1edf53598d592dc1581178fbfc545894e5021b0248a3bd883db2142b5919
Instruction Fuzzy Hash: 84C15275508B92C2E750AF25D8612AE7368FB8AF98F480131EEBD07799DF389155C370

Function 00007FF7F67877D0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67878CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67879CE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6787A41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6787ABB

Strings

Transport, xrefs: 00007FF7F678787E
Session ID cannot be set as a custom header., xrefs: 00007FF7F6787B2D
Accept, xrefs: 00007FF7F6787928
Content-Type: application/sdp, xrefs: 00007FF7F6787D9D
Accept-Encoding: %s, xrefs: 00007FF7F6787979
Range: %s, xrefs: 00007FF7F6787AC3
Referer, xrefs: 00007FF7F6787A57
Content-Length: %I64d, xrefs: 00007FF7F6787D27
%s%s%s%s%s%s%s%s, xrefs: 00007FF7F6787C26
Content-Length, xrefs: 00007FF7F6787D0C
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF7F6787B67
Transport: %s, xrefs: 00007FF7F67878DA
Range, xrefs: 00007FF7F6787A97
Referer: %s, xrefs: 00007FF7F6787A72
User-Agent, xrefs: 00007FF7F67879AE, 00007FF7F67879DD
Failed sending RTSP request, xrefs: 00007FF7F6787E31
Session, xrefs: 00007FF7F6787B19
Content-Type: text/parameters, xrefs: 00007FF7F6787D67
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF7F6787905
CSeq, xrefs: 00007FF7F6787AEC
OPTIONS, xrefs: 00007FF7F67877D0
CSeq cannot be set as a custom header., xrefs: 00007FF7F6787B00
Accept-Encoding, xrefs: 00007FF7F6787944
Session: %s, xrefs: 00007FF7F6787B9D
Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF7F6787853
Accept: application/sdp, xrefs: 00007FF7F678793A
Content-Type, xrefs: 00007FF7F6787D53, 00007FF7F6787D89

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 8e4fe92576e85a1649832a746bfe2ac2763d99e700bc8479731e5c23ff789ab4
Instruction ID: 487db180b3f39b23d8828bbb2a43180e3ccf47e23c4b4b66d8f81355c3e6f427
Opcode Fuzzy Hash: 8e4fe92576e85a1649832a746bfe2ac2763d99e700bc8479731e5c23ff789ab4
Instruction Fuzzy Hash: 1E02542160978285EB50EB259C603BBA399FF48B84FD40035CE6E467D5EF3CE94587B0

Function 00007FF7F6781270 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67812CE
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6781302
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6781381
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678139B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67813AA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67813F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6781408

Strings

<%s@%s>, xrefs: 00007FF7F6781366, 00007FF7F67814AA
SIZE=, xrefs: 00007FF7F6781671
Mime-Version: 1.0, xrefs: 00007FF7F6781564
AUTH=, xrefs: 00007FF7F6781665
<%s>, xrefs: 00007FF7F6781389, 00007FF7F67814CD
Mime-Version, xrefs: 00007FF7F6781549
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF7F678169C
%I64d, xrefs: 00007FF7F67815BE
SMTPUTF8, xrefs: 00007FF7F678165A

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: b3c887b8b654f7e6ab9bd426e25545138578bed1ec83a85998221e109ef5ae0e
Instruction ID: 4da0ac67c8fb23e98ebf73ea639723268c1d3e2a7fef0fb8b968f1eca67cc982
Opcode Fuzzy Hash: b3c887b8b654f7e6ab9bd426e25545138578bed1ec83a85998221e109ef5ae0e
Instruction Fuzzy Hash: 4DD18E21B09B5381FB51EB259C206BAA3A8BF4AB84F944531DD6D077D5EF2CE845C3B0

Function 00007FF7F679E750 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E836
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E8DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E932
htonl.WS2_32 ref: 00007FF7F679E95F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E971
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E9A0
htonl.WS2_32 ref: 00007FF7F679E9B5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E9E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EA69
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EA72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EA7B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EAA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EAB2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EABB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EAC4
memcpy.VCRUNTIME140 ref: 00007FF7F679EADF
memcpy.VCRUNTIME140 ref: 00007FF7F679EAF3
memcpy.VCRUNTIME140 ref: 00007FF7F679EB09
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EB30
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EB39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EB42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679EB4B

Strings

GSSAPI handshake failure (empty security message), xrefs: 00007FF7F679E8B7, 00007FF7F679EB58
GSSAPI handshake failure (invalid security data), xrefs: 00007FF7F679E8C7
GSSAPI handshake failure (invalid security layer), xrefs: 00007FF7F679E946

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: b5ce5a9e2a0b33df0e939376c1fe06cecc69fbaa3637c0c0980714c72d35468e
Instruction ID: 8b268ff0803993b2bdeec43b61660bcdbe00cd1c4edca5dfd78df660bc99bc3d
Opcode Fuzzy Hash: b5ce5a9e2a0b33df0e939376c1fe06cecc69fbaa3637c0c0980714c72d35468e
Instruction Fuzzy Hash: A3C15E31A18B5286E710AF65E8606AEB7B8FF49B84F804135EE6D43B99DF3CD444C760

Function 00007FF7F67934F0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F67935D9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6793620
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6793876
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679388D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67938A8
htons.WS2_32 ref: 00007FF7F6793907

Strings

CNAME: %s, xrefs: 00007FF7F6793803
%s, xrefs: 00007FF7F67937C3
bad error code, xrefs: 00007FF7F6793638
DOH AAAA: , xrefs: 00007FF7F6793722
%s%02x%02x, xrefs: 00007FF7F679376E
DOH: %s type %s for %s, xrefs: 00007FF7F6793654
DOH Host name: %s, xrefs: 00007FF7F67936A1
TTL: %u seconds, xrefs: 00007FF7F67936B5
AAAA, xrefs: 00007FF7F6793646
DOH A: %u.%u.%u.%u, xrefs: 00007FF7F67936EE
Could not DOH-resolve: %s, xrefs: 00007FF7F6793546

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: b7ea18d54f0fbc825fb5669daafabcae6a8462ca2209896e4bea7f4fb4aa7d12
Instruction ID: 6cfb362103492bec01140bca3936833ff4ac9e6f250dd1cd2388b76daf1333d6
Opcode Fuzzy Hash: b7ea18d54f0fbc825fb5669daafabcae6a8462ca2209896e4bea7f4fb4aa7d12
Instruction Fuzzy Hash: 7CE1A532A0868286E760AF25D8603AFB7A8FB4DB58F844131DA6D47795EF3CD544C7B0

Function 00007FF7F678E450 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E4D6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E4FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E50D
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E57B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E5AC
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E5CC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E5DE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E640
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E6B1
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E6C8
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E783
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E7F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7F678DC0F), ref: 00007FF7F678E800

Strings

onetree, xrefs: 00007FF7F678E6F6
sub, xrefs: 00007FF7F678E734
base, xrefs: 00007FF7F678E709
subtree, xrefs: 00007FF7F678E747
LDAP, xrefs: 00007FF7F678E496
one, xrefs: 00007FF7F678E6E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: b72b3b6b8f8b35fc2830f8e4368748d3916e01b9f25a2d53a481e4d0df09ac53
Instruction ID: c59d415b78c27bf7dce41bc492369dda90998ed0a7afc00b608b8db05d214660
Opcode Fuzzy Hash: b72b3b6b8f8b35fc2830f8e4368748d3916e01b9f25a2d53a481e4d0df09ac53
Instruction Fuzzy Hash: 82B18D26A0974282EB51AB259C2027AA3A8FF4DB84F944531DE6D077D5EF3CE845C7B0

Function 00007FF7F678C620 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF7F678C681
memchr.VCRUNTIME140 ref: 00007FF7F678C6B7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F678C73B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F678C7CB

Strings

invalid blocksize value in OACK packet, xrefs: 00007FF7F678C88E
blksize parsed from OACK, xrefs: 00007FF7F678C773
blksize is larger than max supported, xrefs: 00007FF7F678C871
tsize, xrefs: 00007FF7F678C7AF
blksize, xrefs: 00007FF7F678C71F
%s (%ld), xrefs: 00007FF7F678C7DB
%s (%ld), xrefs: 00007FF7F678C832
tsize parsed from OACK, xrefs: 00007FF7F678C7D4
server requested blksize larger than allocated, xrefs: 00007FF7F678C828
Malformed ACK packet, rejecting, xrefs: 00007FF7F678C8BA
%s (%d) %s (%d), xrefs: 00007FF7F678C78D
%s (%d), xrefs: 00007FF7F678C855, 00007FF7F678C878
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF7F678C8A7
requested, xrefs: 00007FF7F678C77A
got option=(%s) value=(%s), xrefs: 00007FF7F678C6FC
blksize is smaller than min supported, xrefs: 00007FF7F678C84E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: 79dfef3ee0d82b343d4b81e40e272c507a7aa2e2bd38e7d364f08c563dddb735
Instruction ID: 6a90ce688935734cab70ba2153e3c5d90d12b766ff94eca6cb047e2a138bedec
Opcode Fuzzy Hash: 79dfef3ee0d82b343d4b81e40e272c507a7aa2e2bd38e7d364f08c563dddb735
Instruction Fuzzy Hash: 80619061A0C64295FB14AB21AC242BBA268BF48BD4FE44631D93D477E5DF3CE50687B0

Function 00007FF7F675C740 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F6756097
Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F67560A3

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C9D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C9DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675CA03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675CA0C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675CA90
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675CA99

Strings

multipart/form-data, xrefs: 00007FF7F675CB97
Content-Type: %s%s%s, xrefs: 00007FF7F675CABD
8bit, xrefs: 00007FF7F675CC1A
; boundary=, xrefs: 00007FF7F675CAB3
Content-Transfer-Encoding, xrefs: 00007FF7F675CB01
attachment, xrefs: 00007FF7F675C98B, 00007FF7F675C992
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF7F675CA59
multipart/, xrefs: 00007FF7F675C977
application/octet-stream, xrefs: 00007FF7F675C866
form-data, xrefs: 00007FF7F675CC46
Content-Disposition, xrefs: 00007FF7F675C901
; filename=", xrefs: 00007FF7F675CA21
multipart/mixed, xrefs: 00007FF7F675C835
Content-Transfer-Encoding: %s, xrefs: 00007FF7F675CC21
; name=", xrefs: 00007FF7F675CA2F
text/plain, xrefs: 00007FF7F675C8AC
Content-Type, xrefs: 00007FF7F675C7C8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: 6bdb922d749ab1fe29328e538f3ef6b7cd3e7e9cfbaf12b4b060728a50306d1a
Instruction ID: 3a1d07d072921e01c0281db1c7eea83da6c4f2396b0f7c6480e27d58f3326d4f
Opcode Fuzzy Hash: 6bdb922d749ab1fe29328e538f3ef6b7cd3e7e9cfbaf12b4b060728a50306d1a
Instruction Fuzzy Hash: C3E19522A0864291FB65AB119860377A7A8FF09B84FC84479CE6D476D9DF3CEC55C3B0

Function 00007FF7F6774DC0 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6774F37

Strings

Digest, xrefs: 00007FF7F6774E3E
Proxy, xrefs: 00007FF7F67750E4
CONNECT, xrefs: 00007FF7F6774DCE
Bearer, xrefs: 00007FF7F6774F30
Server, xrefs: 00007FF7F67750CC
Authorization, xrefs: 00007FF7F6774F7A
Basic, xrefs: 00007FF7F6775097
NTLM, xrefs: 00007FF7F6774E1C
Proxy-authorization, xrefs: 00007FF7F6774EA3
Authorization:, xrefs: 00007FF7F6774F11
%s:%s, xrefs: 00007FF7F6774FC9
%sAuthorization: Basic %s, xrefs: 00007FF7F6775050
%s auth using %s with user '%s', xrefs: 00007FF7F67750D6
Negotiate, xrefs: 00007FF7F6774DFA
Authorization: Bearer %s, xrefs: 00007FF7F6774F40
Proxy-, xrefs: 00007FF7F6775046

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: a6e5da47ed2030cb93ff6b52389dbce91e2e2196ec7e72e72ac32cbea4cf717e
Instruction ID: b1156bb19ec76634be0a80325bbe42ac8ba86c47861404b420ef48f31140daec
Opcode Fuzzy Hash: a6e5da47ed2030cb93ff6b52389dbce91e2e2196ec7e72e72ac32cbea4cf717e
Instruction Fuzzy Hash: B6918121A1C69781FB20AB269C203BBA79CEB49794F944136DA6C077D5EF2DE411C3F0

Function 00007FF7F6746350 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

memcpy.VCRUNTIME140 ref: 00007FF7F67464C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7F6746558
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7F6746599
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67466E3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6746722
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6746770
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67467B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674680E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67468C8

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6746909
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67469D6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6746A17
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F6746A3A

Strings

; expected , xrefs: 00007FF7F6746960
unexpected , xrefs: 00007FF7F6746853
; last read: ', xrefs: 00007FF7F674661C
rsing , xrefs: 00007FF7F67464A8
syntax error , xrefs: 00007FF7F674639D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 5ddee20f24811701f88de3ed6b3b9c5beeb918b66c6a729a8a008020f288624f
Instruction ID: 7a37a210d6e04add4131a1a7c00d6d45b17c4ff734b52940eea2736ce5224b65
Opcode Fuzzy Hash: 5ddee20f24811701f88de3ed6b3b9c5beeb918b66c6a729a8a008020f288624f
Instruction Fuzzy Hash: 8F12D662B0CA8181FB10EB64E82436FA365EB497A8F904235DA7D137D9DF7CD084D3A0

Function 00007FF7F675A360 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F675B2B0: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF7F675AD2E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67619F9), ref: 00007FF7F675B2D3
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B329
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B333
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B33D
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B347
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B351
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B35B
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B365
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B36F
Part of subcall function 00007FF7F675B2B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B378

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A457
strchr.VCRUNTIME140 ref: 00007FF7F675A471
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A49B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A4A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A4D2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A4E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A4F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A50C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A51A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A528
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A543
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A55F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A57B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A597
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A5B3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A5CF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A5EB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A603
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A69B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7F675A6D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A713

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: 38ea0279ecf3060a7191ead8b4a3581ef11fd8d8a316d763dfd1daf95e724c62
Instruction ID: e384bb426fc236cea5759b1182636725b51b587a7a3d91ce2267b5150e4ac257
Opcode Fuzzy Hash: 38ea0279ecf3060a7191ead8b4a3581ef11fd8d8a316d763dfd1daf95e724c62
Instruction Fuzzy Hash: 2BB16211A0A74245EB55AB29997027AA7E8EF4DB94F880575CE7D037C9EF2CE850C3B0

Function 00007FF7F67842F0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678433D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678442F
strchr.VCRUNTIME140 ref: 00007FF7F6784371

Part of subcall function 00007FF7F675B460: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675B4A4

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6784597
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6784761
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6784783

Part of subcall function 00007FF7F676F820: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676F85E

Strings

Can't resolve new host %s:%hu, xrefs: 00007FF7F67846AE
Connecting to %s (%s) port %d, xrefs: 00007FF7F678473A
Bad PASV/EPSV response: %03d, xrefs: 00007FF7F67847AE
Can't resolve proxy host %s:%hu, xrefs: 00007FF7F6784643
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF7F678456B
Weirdly formatted EPSV reply, xrefs: 00007FF7F678444F
Couldn't interpret the 227-response, xrefs: 00007FF7F67844DE
%u.%u.%u.%u, xrefs: 00007FF7F67845A3
Illegal port number in EPSV reply, xrefs: 00007FF7F67843EF
%u,%u,%u,%u,%u,%u, xrefs: 00007FF7F67844BB
%c%c%c%u%c, xrefs: 00007FF7F67843AB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: b4f9b2d5e7cbae1782e3f6f8a12a44ccccba11d09565d8c439cd8e380772ba0a
Instruction ID: ceb47842dc8bd77477868aec39b3177be138d1764867546e72768cb32ce9cf33
Opcode Fuzzy Hash: b4f9b2d5e7cbae1782e3f6f8a12a44ccccba11d09565d8c439cd8e380772ba0a
Instruction Fuzzy Hash: E6D19A22B0878291EB54AB35D9602BBE7A8FB49B44F940031DB6D03AD9DF7CE550C7B1

Function 00007FF7F67837A0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F677C9C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7F6763D4F), ref: 00007FF7F677C9EE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6783876
strchr.VCRUNTIME140 ref: 00007FF7F6783894
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67838C4
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67838DF
strchr.VCRUNTIME140 ref: 00007FF7F6783909
strrchr.VCRUNTIME140 ref: 00007FF7F6783925
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678394F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678396A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678398E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67839A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67839E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6783A20
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6783ABC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6783AE1

Strings

Request has same path as previous transfer, xrefs: 00007FF7F6783AC6
Uploading to a URL without a file name!, xrefs: 00007FF7F6783A0C

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: 9bb391558646337b25e735532d6e92d88ebe20401bd44c15c974a5a0c0c4ffcd
Instruction ID: f4770f94d419268a156a2446117d32c76031688bb1f14d8983f774e02ad39de9
Opcode Fuzzy Hash: 9bb391558646337b25e735532d6e92d88ebe20401bd44c15c974a5a0c0c4ffcd
Instruction Fuzzy Hash: 3091D721B0C78286EB54AB79DC6427BA3A8FB49B94FA80035DA6D037D5DF3CD8508771

Function 00007FF7F6752650 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F6752678
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752680

Strings

%s - %s, xrefs: 00007FF7F6752BD9
Unknown error, xrefs: 00007FF7F6752B70
CRYPT_E_REVOKED, xrefs: 00007FF7F6752AB2
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF7F6752ADC
No error, xrefs: 00007FF7F6752AD0
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF7F6752B89
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 08efb8bee4486beec1541706793736939f3f5dfdb77aa2eae10172abc41618e9
Instruction ID: 228ca5e109b57d818df7e469898897dd3de5d6adbd95757dc3f032efea6df869
Opcode Fuzzy Hash: 08efb8bee4486beec1541706793736939f3f5dfdb77aa2eae10172abc41618e9
Instruction Fuzzy Hash: 44518321A0C68285E761BB10AD643BBB258FB4C744FC44575DA7D02AE9DF3CE904C7B0

Function 00007FF7F6776D80 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

SOCKS4%s request granted., xrefs: 00007FF7F6777346
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7F67771DA
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF7F6777324
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF7F677706B
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF7F6776E46
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7F6776EEB
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF7F6777221
[, xrefs: 00007FF7F6777314
SOCKS4: too long host name, xrefs: 00007FF7F6777146
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7F67772B3
SOCKS4 communication to %s:%d, xrefs: 00007FF7F6776E5F
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7F6776FEA
Failed to send SOCKS4 connect request., xrefs: 00007FF7F677712D
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7F67772ED
Too long SOCKS proxy name, can't use!, xrefs: 00007FF7F6776F47
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF7F6777286
SOCKS4 connection to %s not supported, xrefs: 00007FF7F677704C

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: d992ab33b5ba2acc2fb80a774860a40dec9b1310fa009cfa0d7faafbb69255df
Instruction ID: acecdfa872007b866286ee5e1825ad525b476c53589e440f208c41425d3e5cd0
Opcode Fuzzy Hash: d992ab33b5ba2acc2fb80a774860a40dec9b1310fa009cfa0d7faafbb69255df
Instruction Fuzzy Hash: 13E1EF62A186C189EB54AF25D86037BA7A4FB49B88F848136DE6D477D5CF3DE040C7B0

Function 00007FF7F67454B0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674560E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674563C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674564A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6745684
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67456D5
memset.VCRUNTIME140 ref: 00007FF7F6745503

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

Part of subcall function 00007FF7F6746350: memcpy.VCRUNTIME140 ref: 00007FF7F67464C6

Part of subcall function 00007FF7F6741FF0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742161

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6745842
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674586E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674587C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67458B7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674590A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67459F1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7F6745A09
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7F6745A16

Strings

value, xrefs: 00007FF7F6745576, 00007FF7F67457AE

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 0681b0cbd6cc313949f343e8ef1c8002e7ee2f51d413c373bf9241906f22b9b9
Instruction ID: 9865abd854ff944ebc0fe836a20092944b578e8f85dfaaf28c90e64e459c8078
Opcode Fuzzy Hash: 0681b0cbd6cc313949f343e8ef1c8002e7ee2f51d413c373bf9241906f22b9b9
Instruction Fuzzy Hash: 3CF1F922A1C781C5FB10EB74D8543AEA764EB897A4F544231EABD03AE9DF3CD085D760

Function 00007FF7F6772340 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7F67723F8
strchr.VCRUNTIME140 ref: 00007FF7F677240F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677245B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6772627
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6772676
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677267F

Strings

1.1, xrefs: 00007FF7F677235B
Content-Type:, xrefs: 00007FF7F67724FF, 00007FF7F6772525
Host:, xrefs: 00007FF7F67724D9
Authorization:, xrefs: 00007FF7F67725B1
%s, xrefs: 00007FF7F677260C
Cookie:, xrefs: 00007FF7F67725CB
Transfer-Encoding:, xrefs: 00007FF7F6772598
Connection:, xrefs: 00007FF7F6772571
Content-Length:, xrefs: 00007FF7F677254B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 618ecbf9edcba6c5a583dceb0031c8d968e55155e3ae0f44d7de65b39f56fd4a
Instruction ID: abb3bfba7cafb1e053dc3d0611e9f65b12baabb85416d283d4c34c4fb4fc9acd
Opcode Fuzzy Hash: 618ecbf9edcba6c5a583dceb0031c8d968e55155e3ae0f44d7de65b39f56fd4a
Instruction Fuzzy Hash: 4B919821A1964285FB61EB119E2037BA798AF49BC4FC44032CE7D87AD5FE2DE54187B0

Function 00007FF7F675FE10 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675FE74
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675FEA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675FEB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675FF8F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675FF9C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675FFD7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675FFE1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676005F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6760080
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67600A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67600C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760159
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760162

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: df8c272462819afb120329c5d55349d2ebdef6b687dea4e3c70b77ee26e3604d
Instruction ID: 0b366a53d98f9362e456f7b8bc2bd0ac281d8c3dc688de0799bc977ae716ef2e
Opcode Fuzzy Hash: df8c272462819afb120329c5d55349d2ebdef6b687dea4e3c70b77ee26e3604d
Instruction Fuzzy Hash: 59B16D32A09B82C6EB159F15E96036AB3A8FB49B44F840135CBAD43B94DF3CF464C760

Function 00007FF7F6798541 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6798572
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798BEA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798C28

Strings

Cert, xrefs: 00007FF7F6798BFE
%s, xrefs: 00007FF7F6798C16
Signature: %s, xrefs: 00007FF7F6798A27
TRUE, xrefs: 00007FF7F6798564
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7F6798ACC
Signature, xrefs: 00007FF7F6798A0F
-----END CERTIFICATE-----, xrefs: 00007FF7F6798B77
FALSE, xrefs: 00007FF7F679855D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: ead7ad64410cf63012cd3b6e98572aabadeff694823e11d38ff1ffd43fa03750
Instruction ID: 5edf582220c7f06341e98c064919829126ae1c0ba3d3c5223b39dda1a310f023
Opcode Fuzzy Hash: ead7ad64410cf63012cd3b6e98572aabadeff694823e11d38ff1ffd43fa03750
Instruction Fuzzy Hash: A271CA9290D6C295E711AB3598242BBFBE8EB4A788FDC4532C66D033D1EE2DD445C371

Function 00007FF7F67925B0 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792672
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67926AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67926BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67926F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67926FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67927B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67927BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67927C6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67928B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67928BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67928C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679293B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792944
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679294F

Part of subcall function 00007FF7F6792D40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6794C2A,?,?,00000000,00007FF7F6791665), ref: 00007FF7F6792D50
Part of subcall function 00007FF7F6792D40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6794C2A,?,?,00000000,00007FF7F6791665), ref: 00007FF7F6792D61
Part of subcall function 00007FF7F6792D40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6794C2A,?,?,00000000,00007FF7F6791665), ref: 00007FF7F6792D73

Strings

DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF7F679295C
WDigest, xrefs: 00007FF7F679265C, 00007FF7F6792774

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: d6ceaab0806046a6fad15daabaa3b331c93cb5b9507ece998b51a21d75b291da
Instruction ID: ed75612c64fc7fccd32a8ca55288882b4ebd9f21bcb332ee0fec0734bad50879
Opcode Fuzzy Hash: d6ceaab0806046a6fad15daabaa3b331c93cb5b9507ece998b51a21d75b291da
Instruction Fuzzy Hash: 3AB16371A18B4685E710AF25ED602AEB7A8FB4D784F800035DE6D57B98EF3CD544C7A0

Function 00007FF7F6799300 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 179COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6799413

Strings

dh(g), xrefs: 00007FF7F67995A0
dsa(q), xrefs: 00007FF7F67994DC
dsa(p), xrefs: 00007FF7F67994AD
rsa(e), xrefs: 00007FF7F679944B
rsa(n), xrefs: 00007FF7F6799420
dsa(g), xrefs: 00007FF7F679950C
rsaEncryption, xrefs: 00007FF7F6799345
%lu, xrefs: 00007FF7F67993E8
dhpublicnumber, xrefs: 00007FF7F6799536
dsa(pub_key), xrefs: 00007FF7F6799522
dh(pub_key), xrefs: 00007FF7F67995B6
RSA Public Key (%lu bits), xrefs: 00007FF7F67993CE
dh(p), xrefs: 00007FF7F679956F
RSA Public Key, xrefs: 00007FF7F67993FF
dsa, xrefs: 00007FF7F6799475

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: f0158090d86be3429eb3269982509cc72675253f20fd575ca3fe3ae1e362a893
Instruction ID: 756e04244f82c7e0c3fe7ad4c38765baa5b9d9466a75edf1a6cc84b704275532
Opcode Fuzzy Hash: f0158090d86be3429eb3269982509cc72675253f20fd575ca3fe3ae1e362a893
Instruction Fuzzy Hash: D0714061A0978691EB11AB71A8601FBA399EB4DB84F884032DE6D037D6FE3CD501C7F1

Function 00007FF7F678F6DC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F948
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F9A0
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F9AD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FAA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FAAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FAFE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FB16

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: cc941b5b1586ca65034f02fda84f81cd4fb17835c43a73507d46e3afe6f7d722
Instruction ID: 423e80376f73ad509661f2478f111ca519ffd87582c4e30e1e02ce41b0fd39b9
Opcode Fuzzy Hash: cc941b5b1586ca65034f02fda84f81cd4fb17835c43a73507d46e3afe6f7d722
Instruction Fuzzy Hash: 98A1972190C2D245EB616B35983037BABD8BF5AFD4FA84471DAAD472C5DE2CE844C371

Function 00007FF7F67791F0 Relevance: 22.7, APIs: 15, Instructions: 160COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000000,?,00007FF7F67794A6), ref: 00007FF7F677920B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677922B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677924C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6779255

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: 621cbfd0ee36ffef54caf14af25ee3b9e37cafa5b82458fd53113b4841491521
Instruction ID: ed52d2c88623045f284f313fa9974dc602c71e6afc3f3458fd4884eac8c801f9
Opcode Fuzzy Hash: 621cbfd0ee36ffef54caf14af25ee3b9e37cafa5b82458fd53113b4841491521
Instruction Fuzzy Hash: 5461BF72A19B42C2EB25EF15E86412AB3A8FB5DB80B854035DF6D43795EF3CE484C360

Function 00007FF7F6782310 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6782430

Strings

control connection looks dead, xrefs: 00007FF7F6782622
Remembering we are in dir "%s", xrefs: 00007FF7F67824C8
No data was received!, xrefs: 00007FF7F678276C
server did not report OK, got %d, xrefs: 00007FF7F678269E
Received only partial file: %I64d bytes, xrefs: 00007FF7F678273E
ABOR, xrefs: 00007FF7F678252B
Failure sending ABOR command: %s, xrefs: 00007FF7F6782551
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF7F6782706
partial download completed, closing connection, xrefs: 00007FF7F6782663

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 45a34611d84476b2e080b72f6ced0c4b1cfdcdd26aaf3e4243e8fd60c329ad54
Instruction ID: 6f848c35350776b85f6cb6d4b0b3ec5cedd9396f93d9b89032c9ce2716855bb8
Opcode Fuzzy Hash: 45a34611d84476b2e080b72f6ced0c4b1cfdcdd26aaf3e4243e8fd60c329ad54
Instruction Fuzzy Hash: 44D1B661A0C78285EB64BB359A603BBA298FB49B55FD40231DB7D036D1DF6CE84483F1

Function 00007FF7F674A7E2 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

Part of subcall function 00007FF7F6746350: memcpy.VCRUNTIME140 ref: 00007FF7F67464C6

Part of subcall function 00007FF7F6741FF0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742161

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A891
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A8BF
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674A8CD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A907
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674A964
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AA1D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674AA4B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674AA59
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AA93
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AAE4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AB2E

Strings

value, xrefs: 00007FF7F674A800, 00007FF7F674A989

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: 6b5334c8dc40afd695f9f5f7814dc70773cd0d43c74a1f3ab58cc3c0daa169ad
Instruction ID: 8590f7f493fb895b2861006440ba40a10566dfd3ba4223ce722be43550bb9cf4
Opcode Fuzzy Hash: 6b5334c8dc40afd695f9f5f7814dc70773cd0d43c74a1f3ab58cc3c0daa169ad
Instruction Fuzzy Hash: 5EA1A662A18A8585EB00EB74E8543AE6365EF497A4F900335DA7D03AE9DF7CD085D360

Function 00007FF7F674C071 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

Part of subcall function 00007FF7F6746350: memcpy.VCRUNTIME140 ref: 00007FF7F67464C6

Part of subcall function 00007FF7F6741FF0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742161

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C120
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674C14E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674C15C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C196
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C1F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C2AC
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674C2DA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674C2E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C322
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C373
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C3BD

Strings

value, xrefs: 00007FF7F674C08F, 00007FF7F674C218

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: e1a5b043ecd058536a3f072a734b4312760a1a7b5b6e1a9a95c02f418abc0208
Instruction ID: 1d0675c10f8d3a05d0be48baf78b5fae0dac556fbabda5c9301c91e2db24e6bb
Opcode Fuzzy Hash: e1a5b043ecd058536a3f072a734b4312760a1a7b5b6e1a9a95c02f418abc0208
Instruction Fuzzy Hash: D3A19862A1868181EB00EB74E8543AF6365EB497A4F901336DA7D03AE9DF7CD085D760

Function 00007FF7F6795270 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67952E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6795306
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6795321
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679532F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67953B6
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6795405
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6795466
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67955EC

Strings

HTTP, xrefs: 00007FF7F6795270
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF7F67954B6
InitializeSecurityContext failed: %s, xrefs: 00007FF7F679560A
CompleteAuthToken failed: %s, xrefs: 00007FF7F6795647
Negotiate, xrefs: 00007FF7F6795274, 00007FF7F679537C, 00007FF7F6795423

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: abcaebdcec3108e36cd59e43220c0eb99015a202a648407847131c0655e3d7ce
Instruction ID: 638b8210df4c9679bff6e9d2233fe52a5c2812cdf73715e994181d786fa5e741
Opcode Fuzzy Hash: abcaebdcec3108e36cd59e43220c0eb99015a202a648407847131c0655e3d7ce
Instruction Fuzzy Hash: E5C14072A04B5186FB10EF75E8602AEB7A8FB49B88F500036DE5D47798EF38D445C7A0

Function 00007FF7F6797150 Relevance: 19.7, APIs: 5, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797203
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797269
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679728C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67972EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679735C

Strings

%lx, xrefs: 00007FF7F679732C
%2d Subject: %s, xrefs: 00007FF7F6797254
Subject, xrefs: 00007FF7F679723A
TRUE, xrefs: 00007FF7F67973C1
Issuer, xrefs: 00007FF7F67972C0
Version, xrefs: 00007FF7F6797347
Version: %lu (0x%lx), xrefs: 00007FF7F679736E
Issuer: %s, xrefs: 00007FF7F67972DA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Issuer: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$Issuer$Subject$TRUE$Version
API String ID: 2190258309-1457932261
Opcode ID: ffcff0d822d8f7f5c7eb8353cc099688e07f61669229ae3a7ba24ad747551c18
Instruction ID: 02b2b31e0061c30551b22fc241d9c5131b02f9f2c0f5b25f8f73f1329d814fbc
Opcode Fuzzy Hash: ffcff0d822d8f7f5c7eb8353cc099688e07f61669229ae3a7ba24ad747551c18
Instruction Fuzzy Hash: 4361A021A0D78291EB15AB25AC243FBA3A9BB49794F844936CD6D077D5EF3CE144C3B0

Function 00007FF7F678A660 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F678A6CB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678A7F5

Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F6756097
Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F67560A3

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678A7AF

Part of subcall function 00007FF7F6755FD0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6755FE0

Strings

NEW_ENV, xrefs: 00007FF7F678A811
Unknown telnet option %s, xrefs: 00007FF7F678A8ED
XDISPLOC, xrefs: 00007FF7F678A7CB
USER,%s, xrefs: 00007FF7F678A6F0
%127[^= ]%*[ =]%255s, xrefs: 00007FF7F678A770
BINARY, xrefs: 00007FF7F678A89E
%hu%*[xX]%hu, xrefs: 00007FF7F678A879
Syntax error in telnet option: %s, xrefs: 00007FF7F678A906
TTYPE, xrefs: 00007FF7F678A785

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 59a0c5fa885d2920454bd0d086efa8d0fdb8e179524ebb4e6a53ff4d96d24a27
Instruction ID: 1719702437a6e5be5777b1ae87b9f20cf42b110077cc21ead91ac3b19cc88d48
Opcode Fuzzy Hash: 59a0c5fa885d2920454bd0d086efa8d0fdb8e179524ebb4e6a53ff4d96d24a27
Instruction Fuzzy Hash: 95717131A0D6C694FB21AF20D8616EAA368FB48B84FD40132DA5C47298EF3DD945C7B0

Function 00007FF7F678CEE3 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678CFE3

Strings

TFTP file name too long, xrefs: 00007FF7F678CFCF
timeout, xrefs: 00007FF7F678D2A5
%s%c%s%c, xrefs: 00007FF7F678CFFA
tsize, xrefs: 00007FF7F678D0F2
%I64d, xrefs: 00007FF7F678D076
TFTP buffer too small for options, xrefs: 00007FF7F678D0DF, 00007FF7F678D228
blksize, xrefs: 00007FF7F678D1B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-3837278924
Opcode ID: bdcbd8baab8f02340eb2e0130b2b437af5bdfe96411d1b8ad3a950f51c653a80
Instruction ID: 3603845594a0c8bf1d269c27e12549291cd350ecfa334d93be2d3082b9f4cf02
Opcode Fuzzy Hash: bdcbd8baab8f02340eb2e0130b2b437af5bdfe96411d1b8ad3a950f51c653a80
Instruction Fuzzy Hash: 0FD1AD62A0CA8285EB11DF24D8603BAA765FB49B88FD48132CA5D477C5DF3DD909C3B0

Function 00007FF7F678D760 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7F678D8D3
sendto.WS2_32 ref: 00007FF7F678D98C
WSAGetLastError.WS2_32 ref: 00007FF7F678D99A

Strings

Received ACK for block %d, expecting %d, xrefs: 00007FF7F678D925
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF7F678D944
tftp_tx: internal error, event: %i, xrefs: 00007FF7F678D7B8
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7F678D7CD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 85231d28fff2e654bee0dea8e08f6af6eeea1f587eb2a535d9c6f41173a7fb84
Instruction ID: 5d2bcfacd3f819c66e25d3b906d7ebad6af1463fb90c39ff086206bf08e969c7
Opcode Fuzzy Hash: 85231d28fff2e654bee0dea8e08f6af6eeea1f587eb2a535d9c6f41173a7fb84
Instruction Fuzzy Hash: F6B1A032608682C6D7259F39D8606AA77A4FB4CF88F944132CE5D4B798DF38D805C7B0

Function 00007FF7F678B190 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 180networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7F678B38C
WSAGetLastError.WS2_32 ref: 00007FF7F678B39E
send.WS2_32 ref: 00007FF7F678B496
WSAGetLastError.WS2_32 ref: 00007FF7F678B4A0

Strings

%c%c%c%c, xrefs: 00007FF7F678B26D
Sending data failed (%d), xrefs: 00007FF7F678B3A4, 00007FF7F678B4A6
%127[^,],%127s, xrefs: 00007FF7F678B2F8
%c%c, xrefs: 00007FF7F678B368
%c%s%c%s, xrefs: 00007FF7F678B330
#, xrefs: 00007FF7F678B40E
%c%c%c%c%s%c%c, xrefs: 00007FF7F678B46F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastsend
String ID: #$%127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-931584821
Opcode ID: c0ccde3566b09747bdcd1574ce02ccefcf66fd362645a6cd761a98cee10aabe0
Instruction ID: a7dcae0862b8ff1c8bd76cd17e7a0fdc94b9bf94373a86626ebf3b227d1eda83
Opcode Fuzzy Hash: c0ccde3566b09747bdcd1574ce02ccefcf66fd362645a6cd761a98cee10aabe0
Instruction Fuzzy Hash: A291F422608AC195F721AF24E8557EBA3A4FB49B68F840231EE6C07BD5DF3DD145C7A0

Function 00007FF7F6764730 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676476D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67647EF
strchr.VCRUNTIME140 ref: 00007FF7F676486E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F676489C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67648BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67648CF

Strings

Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF7F67647F9
Invalid IPv6 address format, xrefs: 00007FF7F6764857
%25, xrefs: 00007FF7F67647E5
No valid port number in connect to host string (%s), xrefs: 00007FF7F67648FB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: d0dbf708304496b083f23b7e812b48d865a99afd1e2578677d33c2e86739b3fa
Instruction ID: 2ad75bee7bfb10e6b9c34116dbeb521362fd1b1152c6c1a2ab2db16c35396bd5
Opcode Fuzzy Hash: d0dbf708304496b083f23b7e812b48d865a99afd1e2578677d33c2e86739b3fa
Instruction Fuzzy Hash: CE51D611A086C785FB51AB169C30377A7D9AF0AB94FC88031DA6D062D9EE2DE545C7F0

Function 00007FF7F675A740 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A77E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675A79E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675A7D0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675A7ED
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A80B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A81C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675A83C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F6754990), ref: 00007FF7F675A8EF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F6754990), ref: 00007FF7F675A905

Strings

none, xrefs: 00007FF7F675A793
Set-Cookie:, xrefs: 00007FF7F675A876

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: 9f5bed46c0964185472ff9964054de0d46ab92f24e80c46b5d6bfa1eefba3946
Instruction ID: 07ef8d3af0c442d7e4aa5bfd74d853a2fc68c827d85a8ba0042ea28d7fff086a
Opcode Fuzzy Hash: 9f5bed46c0964185472ff9964054de0d46ab92f24e80c46b5d6bfa1eefba3946
Instruction Fuzzy Hash: FA51C62190C78241FB55A7216D3027BA698AF5D780F884474DEBE067D9DF3DE84283B1

Function 00007FF7F676C310 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F676C6A6

Strings

Successfully compiled trailers., xrefs: 00007FF7F676C3EA
Unable to allocate trailing headers buffer !, xrefs: 00007FF7F676C383
operation aborted by callback, xrefs: 00007FF7F676C47D
Read callback asked for PAUSE when not supported!, xrefs: 00007FF7F676C509
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF7F676C63A
Moving trailers state machine from initialized to sending., xrefs: 00007FF7F676C351
read function returned funny value, xrefs: 00007FF7F676C54B
operation aborted by trailing headers callback, xrefs: 00007FF7F676C49D
%zx%s, xrefs: 00007FF7F676C5C7
Signaling end of chunked upload after trailers., xrefs: 00007FF7F676C6F0

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 0a5120772036d3f2536d4dc9d905eb8926beb600ab6b3706c495f539b64e461b
Instruction ID: 4bb5f432dd1ec233c004dee5d750da6535d72a33632cb48aef13a7fdea9c5125
Opcode Fuzzy Hash: 0a5120772036d3f2536d4dc9d905eb8926beb600ab6b3706c495f539b64e461b
Instruction Fuzzy Hash: 89A19F21A18A82C1E750EF21DC603BBB769EB48B98FD45131DE2D4A2D5EE7DE44483B1

Function 00007FF7F677E320 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E450
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E466
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E4C9

Strings

SELECT %s, xrefs: 00007FF7F677E4B5
Cannot APPEND without a mailbox., xrefs: 00007FF7F677E4F4
Mime-Version: 1.0, xrefs: 00007FF7F677E571
Cannot APPEND with unknown input file size, xrefs: 00007FF7F677E5C7
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7F677E338
Mime-Version, xrefs: 00007FF7F677E556
Cannot SELECT without a mailbox., xrefs: 00007FF7F677E47F
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF7F677E5FD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: c6d6408244153583df09f91122f28af32bbeb0fa9cc065ef9557b59c520eb09d
Instruction ID: 7efe399aa4b2df082be6d93413dd33a81b0dfcce4a4140d1bb52e56a83ce53ee
Opcode Fuzzy Hash: c6d6408244153583df09f91122f28af32bbeb0fa9cc065ef9557b59c520eb09d
Instruction Fuzzy Hash: B6916E21B1CB4285FB64AB219CA037BA298EF4DB84F844435DB6D476C5EF2CE54183F1

Function 00007FF7F6764ED0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EC4
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EDA
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EEE
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F02
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F16
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F2A
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F3E
Part of subcall function 00007FF7F6765EB0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F52

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764F52

Part of subcall function 00007FF7F678EE80: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EE95
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EEAF
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EECA
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EEE6
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF02
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF1A
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF32
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF4A
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF62
Part of subcall function 00007FF7F678EE80: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF7A
Part of subcall function 00007FF7F678EE80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6764EF5,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F678EF94

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6765156
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6765199
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F67652DE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676535B

Strings

file, xrefs: 00007FF7F6765243, 00007FF7F67652BC
Protocol "%s" not supported or disabled in libcurl, xrefs: 00007FF7F676509F
%s://%s, xrefs: 00007FF7F6764F5F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdup$free$callocstrtoul
String ID: %s://%s$Protocol "%s" not supported or disabled in libcurl$file
API String ID: 954404409-4150109901
Opcode ID: 0ac8339ab56343dfb0608ee691da3d5eeb1b2d07e07abf4930b7335b89ee0e18
Instruction ID: 70e1640f00ddcfdc209312bb8cbdc14cd40874eb07fb9a53ba590fe9b0ba5671
Opcode Fuzzy Hash: 0ac8339ab56343dfb0608ee691da3d5eeb1b2d07e07abf4930b7335b89ee0e18
Instruction Fuzzy Hash: 80C1A231B08682C6FB69AA35DD603FAA398FB49744F884431CB2D476C5DF3AE55093B0

Function 00007FF7F6741FF0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F67423B0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67424A9
Part of subcall function 00007FF7F67423B0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67424E8

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

Part of subcall function 00007FF7F6743BF0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7F6741DCB), ref: 00007FF7F6743C36

Part of subcall function 00007FF7F6745E10: memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745EA1

Part of subcall function 00007FF7F6743C70: memcpy.VCRUNTIME140 ref: 00007FF7F6743CC3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742161
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67421B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742202
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742242
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742294
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67422D3
__std_exception_copy.VCRUNTIME140 ref: 00007FF7F6742326
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742377

Strings

parse error, xrefs: 00007FF7F674207B
parse_error, xrefs: 00007FF7F6742051

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 919d596e004d04ec6581c94e81083fc727d7f244b40b8ebbd95ffc42edea20ab
Instruction ID: 1ba34504073f056e13b5c17e8212040cbaddf810b341968f8431248a360e9591
Opcode Fuzzy Hash: 919d596e004d04ec6581c94e81083fc727d7f244b40b8ebbd95ffc42edea20ab
Instruction Fuzzy Hash: EFB19462A18B81C5FB00DB64E9543AE7775EB897A4F904621DA7D03AE9DF7CE0C0C360

Function 00007FF7F676C710 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676C78A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676C7A5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676C822
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676C8AC

Strings

Issue another request to this URL: '%s', xrefs: 00007FF7F676C8B7
Switch to %s, xrefs: 00007FF7F676C937
Maximum (%ld) redirects followed, xrefs: 00007FF7F676C877
Switch from POST to GET, xrefs: 00007FF7F676C976
HEAD, xrefs: 00007FF7F676C917
GET, xrefs: 00007FF7F676C91E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: 31c77a37b0c0b8fbe5e53ac8bd18da749b3546c27af0e0e94c4b5068321a577e
Instruction ID: 4bdb103542c90570ebaae393d8124e269ee100a037309d7a733551fcf1d6c826
Opcode Fuzzy Hash: 31c77a37b0c0b8fbe5e53ac8bd18da749b3546c27af0e0e94c4b5068321a577e
Instruction Fuzzy Hash: B071C961908783C0E760AB3498603BFB7A9EB49B98F980531DE6D476E5CF3ED44187B1

Function 00007FF7F67618B0 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676192D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676194A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676195E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F676197A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761997
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619BA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619CE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F67619E2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A08
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A1C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A30
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A7F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6761AB5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9dafe04a3beda65af2da05c8c2c950cb73e504e5584e316465673385af97ca7b
Instruction ID: 335ea840bd26e2c8fa30c78b0de36f5bb5998b61ebe3970cd25ac766373e1645
Opcode Fuzzy Hash: 9dafe04a3beda65af2da05c8c2c950cb73e504e5584e316465673385af97ca7b
Instruction Fuzzy Hash: 27510031519682C1EB14EF25DC612FE6368FF99F84F884431DE6E4B69ACE39944583B0

Function 00007FF7F679BFC0 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679C48B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679C4E3

Strings

DIGEST-MD5, xrefs: 00007FF7F679C1F3
EXTERNAL, xrefs: 00007FF7F679C0DB
PLAIN, xrefs: 00007FF7F679C39A
GSSAPI, xrefs: 00007FF7F679C156
XOAUTH2, xrefs: 00007FF7F679C345
NTLM, xrefs: 00007FF7F679C249
LOGIN, xrefs: 00007FF7F679C403
OAUTHBEARER, xrefs: 00007FF7F679C2D2
CRAM-MD5, xrefs: 00007FF7F679C212

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: CRAM-MD5$DIGEST-MD5$EXTERNAL$GSSAPI$LOGIN$NTLM$OAUTHBEARER$PLAIN$XOAUTH2
API String ID: 1294909896-1896214517
Opcode ID: 6f629dc6e99d2c2fd32bc3e9a67ca7cbba0816a4f61251375445570cdc9e1aea
Instruction ID: 9627830cd409157f18dbffa83cab44f3f3c698a1b85f5bca84f6f1c6b6ffdcc5
Opcode Fuzzy Hash: 6f629dc6e99d2c2fd32bc3e9a67ca7cbba0816a4f61251375445570cdc9e1aea
Instruction Fuzzy Hash: 02D15D6260968285EB60DF24E8503AAA7F8FB49754F840136DE6C077E8EF3CD445CB75

Function 00007FF7F677DFF0 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F677C9C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7F6763D4F), ref: 00007FF7F677C9EE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E28E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E298
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E2F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E2FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677E30A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7F677DFF8
UIDVALIDITY, xrefs: 00007FF7F677E145
PARTIAL, xrefs: 00007FF7F677E246
UID, xrefs: 00007FF7F677E186
MAILINDEX, xrefs: 00007FF7F677E1C7
SECTION, xrefs: 00007FF7F677E208

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 2190258309-1670639106
Opcode ID: 846e8b8c6c6f9739c4a2866379d1f83382772be3885393c130899fe3e4b18a15
Instruction ID: 796e8ae8955eade335cb983668baa2ee50b7e3fff9ff134f1d2aebfbba1dcc03
Opcode Fuzzy Hash: 846e8b8c6c6f9739c4a2866379d1f83382772be3885393c130899fe3e4b18a15
Instruction Fuzzy Hash: A7A19822929A8685EB51EF21DC643BAA7A4FB49784F840031EB6E476D5DF3CD491C3B0

Function 00007FF7F675D270 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7F675D2B7
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7F675D2C7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675D2DE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675D35A
strrchr.VCRUNTIME140 ref: 00007FF7F675D377
strrchr.VCRUNTIME140 ref: 00007FF7F675D387
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675D3B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675D3C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675D3D2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675D3E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675D3F9

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: a425e0188cbebe21396c5b31fd7196939b60543e69e3bf0485de30aa4f04b208
Instruction ID: 3c362139220b2a848cea5025415c4d95ccf43c3e1dee48cb06978f3f1c587853
Opcode Fuzzy Hash: a425e0188cbebe21396c5b31fd7196939b60543e69e3bf0485de30aa4f04b208
Instruction Fuzzy Hash: F641732170DB0285FB10BB11A86027AA2A8FF4DB80F844134DE6D477D8EF3CE855C2B4

Function 00007FF7F67625A0 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7F67625D8
strchr.VCRUNTIME140 ref: 00007FF7F67625FF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67626B4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67626DA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67626FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676270C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6762715
memcpy.VCRUNTIME140 ref: 00007FF7F6762733
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6762747
memcpy.VCRUNTIME140 ref: 00007FF7F6762764
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6762779
memcpy.VCRUNTIME140 ref: 00007FF7F6762791
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67627A6

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: 4a31933ddea44201a5d47b42c714698563d84d1637834a4103e73a14b779df92
Instruction ID: 5146ea283c3e70e273bed21e5d19b5afd03db4606ab36c69dfaab76462a07810
Opcode Fuzzy Hash: 4a31933ddea44201a5d47b42c714698563d84d1637834a4103e73a14b779df92
Instruction Fuzzy Hash: 9F518321709682C1DBA5AF15AA2427AE299BF5DBC4F884530DEBD07B94EF3DE4058370

Function 00007FF7F67644C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764504
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676453C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6764549
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764572
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676457F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67645B0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67645BD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF7F6764649

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 4dcf73271c8b8bacb8cfe7207693d9b5d91f111473b558ca7ff9bc1d3b6bb3d1
Instruction ID: 1be8f82cba27a1a6d54aa2c28efb44631e0393647d9a00dd665c6db5bf83acd2
Opcode Fuzzy Hash: 4dcf73271c8b8bacb8cfe7207693d9b5d91f111473b558ca7ff9bc1d3b6bb3d1
Instruction Fuzzy Hash: 8671D521A08B82C2EB65AB26DC6436BA7A8FB49744F444031DB6D477D5EF3EE450C7B0

Function 00007FF7F6764468 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764504
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764518
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676453C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6764549
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6764572
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676457F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67645B0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67645BD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF7F6764649

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: f2588b72eae4d2d83d4234019271e759b3b16d48f596f5c2917e1ce51cc32042
Instruction ID: 191cf6ec159c07fa488a5ec4dbc1c444f8f8798349b8b62e280070d5c64a9542
Opcode Fuzzy Hash: f2588b72eae4d2d83d4234019271e759b3b16d48f596f5c2917e1ce51cc32042
Instruction Fuzzy Hash: 9B51C562908B82C6E715AB26D86436FA7A4FB49B44F898031CB6D473D5EF3DE450C770

Function 00007FF7F6784ED0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

Got a %03d response code instead of the assumed 200, xrefs: 00007FF7F6784F10
LIST, xrefs: 00007FF7F6784FD2
%s%s%s, xrefs: 00007FF7F6784FF5
NLST, xrefs: 00007FF7F6784FCB
Couldn't set desired mode, xrefs: 00007FF7F6784EEE

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: %s%s%s$Couldn't set desired mode$Got a %03d response code instead of the assumed 200$LIST$NLST
API String ID: 0-1262176364
Opcode ID: a8525d8e46d4123448b7e5117b4cd6fc8f1f50e17aea422bfd7cf4a9209a6dfd
Instruction ID: 623a782073d121af80370e6e5aa7ef64c16fdd1fceb62c4599a70e069c61f018
Opcode Fuzzy Hash: a8525d8e46d4123448b7e5117b4cd6fc8f1f50e17aea422bfd7cf4a9209a6dfd
Instruction Fuzzy Hash: D841A422B1825286FB60AB35EC601BBE368BB49F84FD44035DA6D076D5DF6DE84487F0

Function 00007FF7F6768DE0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7F6774E4A), ref: 00007FF7F6768E5F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7F6774E4A), ref: 00007FF7F6768EB1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7F6774E4A), ref: 00007FF7F6768ED5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7F6774E4A), ref: 00007FF7F6768F25
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7F6774E4A), ref: 00007FF7F6768F68

Strings

Digest, xrefs: 00007FF7F6768DEB
%sAuthorization: Digest %s, xrefs: 00007FF7F6768F45
%.*s, xrefs: 00007FF7F6768EBE
Proxy-, xrefs: 00007FF7F6768F3B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: b6a1072ca62c58b089c756f09791d4861f3d13de823f70109af0538b333defb4
Instruction ID: 2ae51baa92baa9d5fc7525582914cea712c79be6dc08ea4c69d4aa393fd46a16
Opcode Fuzzy Hash: b6a1072ca62c58b089c756f09791d4861f3d13de823f70109af0538b333defb4
Instruction Fuzzy Hash: 7541A022608B86D2E720AF15E8103ABB7A8FB49B84F840035EEAD47795DF3DD556C370

Function 00007FF7F6752F80 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F6752F9C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752FA4
FormatMessageA.KERNEL32 ref: 00007FF7F6752FDE
strchr.VCRUNTIME140 ref: 00007FF7F6752FF3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F675303C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6753046
GetLastError.KERNEL32 ref: 00007FF7F675304E
SetLastError.KERNEL32 ref: 00007FF7F675305A

Strings

Unknown error %u (0x%08X), xrefs: 00007FF7F675302A

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchr
String ID: Unknown error %u (0x%08X)
API String ID: 1897771742-1058733786
Opcode ID: 58551a6dfcc84a0f0f44b5743901858bdd7a11215c9ae304ce99c475564e9eb4
Instruction ID: 8e306f8483b2952374acc89026d7fd6197b99e492c20d862d7c869c0399d4795
Opcode Fuzzy Hash: 58551a6dfcc84a0f0f44b5743901858bdd7a11215c9ae304ce99c475564e9eb4
Instruction Fuzzy Hash: AB216622A1878186E7116F21AD1422BFA99BF9CB90F894075DA7D037E9DE3DD84187B0

Function 00007FF7F67527A6 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_CANNOT_INSTALL, xrefs: 00007FF7F67527A6
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: 97b1c77c699c43dc9b389d94b9c168d1f79c38719a14beb900fe4c4e939f7505
Instruction ID: cf83129de6f5c0ea75d2c85a443e4771a195d4d69dc7b3273147fc319c98c1f2
Opcode Fuzzy Hash: 97b1c77c699c43dc9b389d94b9c168d1f79c38719a14beb900fe4c4e939f7505
Instruction Fuzzy Hash: DD31232260D6C185E761BF20AD643ABB7A8FB88744F840575DABD02AD9DF3CD544CBB0

Function 00007FF7F67527B2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_CANNOT_PACK, xrefs: 00007FF7F67527B2
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: a99f060a03aed788ed5e06c1aa8b7c80c7450bad84408ad51638c64175808135
Instruction ID: 94b4e81ef2c64a073ee8bacee0e9aa23818c6416b6a07a0e0c1a47d4df82b943
Opcode Fuzzy Hash: a99f060a03aed788ed5e06c1aa8b7c80c7450bad84408ad51638c64175808135
Instruction Fuzzy Hash: 4931412260D6C185E761BB20AD243ABB3A8FB88744F840575DABD02AD9DF3CD544DBB0

Function 00007FF7F67527BE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_CERT_EXPIRED, xrefs: 00007FF7F67527BE
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: de0156c4063bd9a466d38293046c8cbb20a83bbdd5fd275fc8d816d0a695292a
Instruction ID: 72e06ea230db4a0f50930e8dfdaeb07a1f1e56e4421866a3e0fe18bdcfc6cbdd
Opcode Fuzzy Hash: de0156c4063bd9a466d38293046c8cbb20a83bbdd5fd275fc8d816d0a695292a
Instruction Fuzzy Hash: 5831412260D6C185E761BB20AD243ABB3A8FB88744F840575CABD02AD9DF3CD544CBB0

Function 00007FF7F67527CA Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_CERT_UNKNOWN, xrefs: 00007FF7F67527CA
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 298e794ac7706a66fab8b4d1c88976078ee655fcbdcb2b83b484b773f6ff4f63
Instruction ID: 250c893ce3926ec81b475ef17ecc0c6531617eb36550e2f51ace5862d08f6bb6
Opcode Fuzzy Hash: 298e794ac7706a66fab8b4d1c88976078ee655fcbdcb2b83b484b773f6ff4f63
Instruction Fuzzy Hash: AC31412260D6C185E761BB20AD243ABB3A8FB88744F840575DABD02AD9DF3CD544CBB0

Function 00007FF7F6752782 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_BAD_BINDINGS, xrefs: 00007FF7F6752782
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: a0204534bdfcb8b00a98a7e01e510a1d63ffabb6fbdf480f0e4bbfb348c73876
Instruction ID: 3ff98137bb60a53d36fbda48cfb812aee92cfb14c4d5ab684cc42f11b09337bf
Opcode Fuzzy Hash: a0204534bdfcb8b00a98a7e01e510a1d63ffabb6fbdf480f0e4bbfb348c73876
Instruction Fuzzy Hash: 3031412260D6C185E761BF20AD243ABB3A8FB88744F840575CABD02AD9DF3CD544CBB0

Function 00007FF7F675278E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_BAD_PKGID, xrefs: 00007FF7F675278E
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: 0efca67b4cdc14fbe91d37422af2e9fb08fc75ec36ce691b1a4c732ea022d591
Instruction ID: 02475d718ad7d807e2bc65bbc9f4764f025ca25d7f08662ffe29cc6af6acd286
Opcode Fuzzy Hash: 0efca67b4cdc14fbe91d37422af2e9fb08fc75ec36ce691b1a4c732ea022d591
Instruction Fuzzy Hash: 6331232260D6C185E761BF20AD643ABB7A8FB88744F840575DABD02AD9DF3CD544CBB0

Function 00007FF7F67526CE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7F6752729
strchr.VCRUNTIME140 ref: 00007FF7F6752750
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6752BEF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752BFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752C05
GetLastError.KERNEL32 ref: 00007FF7F6752C0E
SetLastError.KERNEL32 ref: 00007FF7F6752C1A

Strings

%s - %s, xrefs: 00007FF7F6752BD9
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF7F67526CE
%s (0x%08X), xrefs: 00007FF7F67526D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: baaace8c9324e1153c16d76581dd1b850064508bf1f345ef6eeb36c0a0138756
Instruction ID: c7f1e91311f73eee5c7a9067cf3d44421d3e37f28593785242661505a62d273a
Opcode Fuzzy Hash: baaace8c9324e1153c16d76581dd1b850064508bf1f345ef6eeb36c0a0138756
Instruction Fuzzy Hash: B231342260D6C185E761BF20ED643ABB798FB88744F840575DAAD02AD9DF3CD544CB70

Function 00007FF7F67880F0 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6788348

Part of subcall function 00007FF7F6766180: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7F6771F95,?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6766195
Part of subcall function 00007FF7F6766180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,FFFFFFFF,00007FF7F6771F95,?,?,00000000,00007FF7F67722F5), ref: 00007FF7F67661AB

memcpy.VCRUNTIME140 ref: 00007FF7F6788168
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67882B9
memcpy.VCRUNTIME140 ref: 00007FF7F6788382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678838E

Strings

Cannot pause RTP, xrefs: 00007FF7F678828C
Got an error writing an RTP packet, xrefs: 00007FF7F678829B
Failed writing RTP data, xrefs: 00007FF7F6788283

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$memcpy$realloc
String ID: Cannot pause RTP$Failed writing RTP data$Got an error writing an RTP packet
API String ID: 657767516-1165944077
Opcode ID: 660aa62fdb57f9ad4f97bb8f1537920e62d72f1c1ab7316212b221423c490b78
Instruction ID: 3afa0df31e4f8ae052738f7062ff7c0e1fb9c189c9326c4ce8aade7fe656f4c5
Opcode Fuzzy Hash: 660aa62fdb57f9ad4f97bb8f1537920e62d72f1c1ab7316212b221423c490b78
Instruction Fuzzy Hash: 98718222B09B8595E754EB25D8143AAE7A8FB49B80F944035EF6D47B94DF3CE860C360

Function 00007FF7F675B2B0 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF7F675AD2E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67619F9), ref: 00007FF7F675B2D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B329
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B333
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B33D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B347
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B351
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B35B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B365
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B36F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B378

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 94b7a02d5bc3b31133621eaaf653b4e2e7eeaf76c314e2bfd27b0698e7b4643e
Instruction ID: 9bf7ecd258714f1500c146af4e88fb0b458cbccfbe67f6b82079244ad04bf1b4
Opcode Fuzzy Hash: 94b7a02d5bc3b31133621eaaf653b4e2e7eeaf76c314e2bfd27b0698e7b4643e
Instruction Fuzzy Hash: C721F036619A52C2E710AF21E86513AA378FB5EF84F440471EEAD13799DE38D845C3B0

Function 00007FF7F6747439 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected digit after '.', xrefs: 00007FF7F67477D7
invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF7F6747987

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: b7f0683384f41ca6ab58209a4010d6c5d75d2bd6ba60dd59bf4ed1c60fdea11b
Instruction ID: ef5e5c90ebf4d275c9451a067ee6a8cf8f5eff084c2d8475c9a5726aefb6ed2f
Opcode Fuzzy Hash: b7f0683384f41ca6ab58209a4010d6c5d75d2bd6ba60dd59bf4ed1c60fdea11b
Instruction Fuzzy Hash: 97B1A16290CA41C5E7259F28D86823DB779F719B58FE44532C66D062D8DF38E885C3B0

Function 00007FF7F6772DF0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6772EBC

Strings

Digest, xrefs: 00007FF7F6772F54
Bearer, xrefs: 00007FF7F6772FD8
Ignoring duplicate digest auth header., xrefs: 00007FF7F6772F6D
Basic, xrefs: 00007FF7F6772FB1
NTLM, xrefs: 00007FF7F6772EEC
Authentication problem. Ignoring this., xrefs: 00007FF7F6772FFD
Negotiate, xrefs: 00007FF7F6772E66

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 8811c21d227fe7b456c0f5a6e030505f98a5b81c9e62d162cdb0ae453dfad27b
Instruction ID: 3e8eab9c496e86074364b28732f378178042ecf9dfeee3163c64838d6d9fb4be
Opcode Fuzzy Hash: 8811c21d227fe7b456c0f5a6e030505f98a5b81c9e62d162cdb0ae453dfad27b
Instruction Fuzzy Hash: C4710821A2C28286FB24AA219D7027BFAD9AF09784FC44034DE7A472D1DF3DE554D7B0

Function 00007FF7F6780FE0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678109F
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67810E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67811A0

Strings

VRFY %s%s%s%s, xrefs: 00007FF7F678116E
%s %s%s, xrefs: 00007FF7F6781069
HELP, xrefs: 00007FF7F67811D5
EXPN, xrefs: 00007FF7F6781027
SMTPUTF8, xrefs: 00007FF7F678104D, 00007FF7F6781155

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1812939018-2300960079
Opcode ID: f3eda4bbea35c3fc35fa090c4d3cd7c91a46c8c7f5d33282ed58acf73afcbf50
Instruction ID: 408dce993a211885e495cd94f90c0899a2725ce6bc460822fe8c68b4d1050d70
Opcode Fuzzy Hash: f3eda4bbea35c3fc35fa090c4d3cd7c91a46c8c7f5d33282ed58acf73afcbf50
Instruction Fuzzy Hash: E951C722E1CB8681EB51DB25EC2077AA7A5BB5AB84FD40231DA6D037D1DF2DD941C3B0

Function 00007FF7F67973DC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6797403
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892
FALSE, xrefs: 00007FF7F67973F8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: e07c45d19973509e67b550ba4295e2b84292b797af6f8f338bbd6149bdbebad7
Instruction ID: de3bb80313574279d1c5377501b880eb2b6a69c4fa2c8bdc80fd9771ea5d3991
Opcode Fuzzy Hash: e07c45d19973509e67b550ba4295e2b84292b797af6f8f338bbd6149bdbebad7
Instruction Fuzzy Hash: 37415355A0978284EB15AB359C641FBA7A8BB0D7C8F884435CE6D177D6EE3CE044C3B0

Function 00007FF7F6759FE0 Relevance: 13.8, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A00D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A037
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A041
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A04B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A055
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A05F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A069
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A073
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A07D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A086
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00007FF7F67619F9,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F675A0A1

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 548a08269f7edc9ae1dc99300c80eb12a085d950e618f5ac623358a1f60b81e7
Instruction ID: 9257a9e9e411de0b07b917506e4bfb4acfc306a86fd5dcc742e029a005e6229d
Opcode Fuzzy Hash: 548a08269f7edc9ae1dc99300c80eb12a085d950e618f5ac623358a1f60b81e7
Instruction Fuzzy Hash: 2B21EC66624A52C2D710AF15E86522AA374FB9EF80F441431EEBE03759DE38D845D770

Function 00007FF7F678F220 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F375
memcpy.VCRUNTIME140 ref: 00007FF7F678F392

Strings

https, xrefs: 00007FF7F678F2B0
file, xrefs: 00007FF7F678F23B
file://%s%s%s, xrefs: 00007FF7F678F26E
%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7F678F562
%ld, xrefs: 00007FF7F678F2DE
%%25%s], xrefs: 00007FF7F678F3A2

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: mallocmemcpy
String ID: %%25%s]$%ld$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 4276657696-1832275178
Opcode ID: 7d32dc7c02c0576a480f03aa2b20523e87f0181136edf8925a4e73fa6a3427c9
Instruction ID: c2b67559cec9340b3c5c136e2b18c5aed8287f0d3f466fea25092df28af8a2b3
Opcode Fuzzy Hash: 7d32dc7c02c0576a480f03aa2b20523e87f0181136edf8925a4e73fa6a3427c9
Instruction Fuzzy Hash: 0AA15471609BC684EB65AF21A9203AAB3A8FB48BC4F944135DD6D43798DF3CD845C7B0

Function 00007FF7F679828C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67982CF
memcpy.VCRUNTIME140 ref: 00007FF7F67982F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67983C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: fbe24e366b728afa5db670c27b8319507fe6065f7f31e2c79264c5bae932625d
Instruction ID: a522e88f4b625f6acb7819a47aecaad9657369bcd67ea14af3194a2bb9d1ca48
Opcode Fuzzy Hash: fbe24e366b728afa5db670c27b8319507fe6065f7f31e2c79264c5bae932625d
Instruction Fuzzy Hash: 2B61C351A0868285EB19AB3588341BEE7E9AF1D794F844935CE7E077D5EE3CE04583B0

Function 00007FF7F6797716 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679774F
memcpy.VCRUNTIME140 ref: 00007FF7F679777A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 742c0360e6210f7455115ce56e8553b7ac11c260097db8010f3a55c0742de8cc
Instruction ID: a96915d1111cd73353341f556f2638da814df72acf2815615094d6157b245726
Opcode Fuzzy Hash: 742c0360e6210f7455115ce56e8553b7ac11c260097db8010f3a55c0742de8cc
Instruction Fuzzy Hash: D061E151A0968285EB18A7358D342BAA7E9EF197D4F884535CA3E0B7D5FE2CE045C3B0

Function 00007FF7F67917C0 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7F6774E28), ref: 00007FF7F6791950
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7F6774E28), ref: 00007FF7F6791987
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7F6774E28), ref: 00007FF7F67919AE

Strings

HTTP, xrefs: 00007FF7F67917D6
NTLM, xrefs: 00007FF7F67917C6
%sAuthorization: NTLM %s, xrefs: 00007FF7F6791968, 00007FF7F6791A14
Proxy-, xrefs: 00007FF7F679195E, 00007FF7F6791A0A

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 28345fe83e5f92978302311b7c25afe45d2fd59016ff0eb21e1732458eff48fc
Instruction ID: 1a2139cc9ca889bb6fcc8129661ca1d97887b6edccf076a3e728dd81b8f393d3
Opcode Fuzzy Hash: 28345fe83e5f92978302311b7c25afe45d2fd59016ff0eb21e1732458eff48fc
Instruction Fuzzy Hash: 9C618F32608B8281EB60DF15E8643ABB3E9FB49B84F804036DA9D47798EF3CD555C761

Function 00007FF7F6788450 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F675B460: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675B4A4

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678856D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67885C5
memcpy.VCRUNTIME140 ref: 00007FF7F67885EA

Strings

Got a blank Session ID, xrefs: 00007FF7F6788517
: %ld, xrefs: 00007FF7F6788491
CSeq:, xrefs: 00007FF7F678846D
Unable to read the CSeq header: [%s], xrefs: 00007FF7F67884C2
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF7F678857E
Session:, xrefs: 00007FF7F67884DE

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 18990fc156d9d11678551ccf624d1351fa5d6f5ee740d5d836fb751b64834d78
Instruction ID: dbead270a8b74643c2332567cfa3fac7a8fe7a54fe8f60de034a2eb421ed8b85
Opcode Fuzzy Hash: 18990fc156d9d11678551ccf624d1351fa5d6f5ee740d5d836fb751b64834d78
Instruction Fuzzy Hash: C441B421A0868285EB10AB25AC602BBE794FF49B84FD44131DA7E873D5DF2CE84183B0

Function 00007FF7F6786EB9 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 268COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7F6786F57

Part of subcall function 00007FF7F6787500: strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F6787536
Part of subcall function 00007FF7F6787500: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F678758B

Strings

Accept-ranges: bytes, xrefs: 00007FF7F6786FEE
failed to resume file:// transfer, xrefs: 00007FF7F67872B6
Can't get the size of file., xrefs: 00007FF7F6787139
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FF7F67870BB
Content-Length: %I64d, xrefs: 00007FF7F6786FB3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _fstat64_openstrchr
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 3410096895-1509146019
Opcode ID: 59da335d30f4d699e7207b292d001fc9ee825fbd86006c68da29940bdb92b76e
Instruction ID: 4727a8136c0fd7f8ad8ae04401258f1a4110e2e21d788978e4d67708af0c096c
Opcode Fuzzy Hash: 59da335d30f4d699e7207b292d001fc9ee825fbd86006c68da29940bdb92b76e
Instruction Fuzzy Hash: A8B17832A0C68285E721EB359D603BBA3A5FB98B84F944031DE5D477D5EE3CE80187B0

Function 00007FF7F679C560 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679C5F8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679C654
strchr.VCRUNTIME140 ref: 00007FF7F679C83C
strchr.VCRUNTIME140 ref: 00007FF7F679C8AA

Strings

0123456789-, xrefs: 00007FF7F679C8A3
APM0123456789:, xrefs: 00007FF7F679C835
<DIR>, xrefs: 00007FF7F679C780

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 1572c55741b108669f971dfd891189aed3ed9b688e2cf8bed39c0b620db78256
Instruction ID: cc977613be79743f039d492cbbe13afc00ef1aa253cb13ea830410193ec484f4
Opcode Fuzzy Hash: 1572c55741b108669f971dfd891189aed3ed9b688e2cf8bed39c0b620db78256
Instruction Fuzzy Hash: 39B14036908B4186EB64AF35D96033AA7F8FB49B48F944135CA6E073D5EE38E451C3B0

Function 00007FF7F678E830 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678E877
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678E8DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678EA0F

Part of subcall function 00007FF7F677C9C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7F6763D4F), ref: 00007FF7F677C9EE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678E90E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678EA4D

Strings

%s?%s, xrefs: 00007FF7F678E869
Failed sending Gopher request, xrefs: 00007FF7F678EA15

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 5c15754a6507ecacf18ab4310b7ffd65b8a6eac73087b67df4945e53af86dda4
Instruction ID: caec07879e0573235ab39c890e1c8c328a37f708c913dba38eeafe6a838340ae
Opcode Fuzzy Hash: 5c15754a6507ecacf18ab4310b7ffd65b8a6eac73087b67df4945e53af86dda4
Instruction Fuzzy Hash: 9F519421A19A8281E751AB35AC201BBA798BB8DFE4F940231DE7D437D5EF3CD44187B0

Function 00007FF7F6749510 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AA1D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674AA4B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7F674AA59
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AA93
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674AAE4

Strings

value, xrefs: 00007FF7F674A989

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 4a4d25d41ed406c1d0a011403156945727fdde6037d227963cedff3a9bb42d56
Instruction ID: c1a863394d959f088f5e1a8f6d5402d27c4c07fd4c4a2b3ef0e7736083050774
Opcode Fuzzy Hash: 4a4d25d41ed406c1d0a011403156945727fdde6037d227963cedff3a9bb42d56
Instruction Fuzzy Hash: 7E61A432A18A8585EB10DB74E8583EEA365EF497A4F504335DABC16AE9DF7CD081C360

Function 00007FF7F679A0F5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A138
memcpy.VCRUNTIME140 ref: 00007FF7F679A15D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A22F
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

TRUE, xrefs: 00007FF7F679A24D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freeisupper$mallocmemcpy
String ID: TRUE
API String ID: 3511497317-3412697401
Opcode ID: 76afa4462d984f8d383d5eb4a1e9a793224edee2424a0de39b241f5a08cbdea3
Instruction ID: aef9ce588ef95c31e76d4f2a5c02abcf960f309a8d0d76eca31b31d98c8a3c87
Opcode Fuzzy Hash: 76afa4462d984f8d383d5eb4a1e9a793224edee2424a0de39b241f5a08cbdea3
Instruction Fuzzy Hash: 8D512811E0E69245FB19E6364D3437ABBD6AB5AB90F844335C6BF02AD5EE3D9041C3B0

Function 00007FF7F6787500 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F6787536
_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F678758B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F67875FC
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F6787609
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0000006C,?,00000000), ref: 00007FF7F678771B

Strings

Can't get the size of %s, xrefs: 00007FF7F6787612
Can't open %s for writing, xrefs: 00007FF7F678759B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: 47806318dad57eb09a6b322e9798bef99cc3e6e357c7198381fcfe81f338dd94
Instruction ID: 6a4673f9516029caebc8c15c011572c6767985c04ec6777a2dbffb034722348c
Opcode Fuzzy Hash: 47806318dad57eb09a6b322e9798bef99cc3e6e357c7198381fcfe81f338dd94
Instruction Fuzzy Hash: BD517561718A4281EB14AB359C602BFA399FB8DFD4F944435DA6E473D5EE3CE84183B0

Function 00007FF7F678F770 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F678F780
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: 644ecf454b5406c55117dfc577d459684ad165775d5b9113ed441861368e03cd
Instruction ID: dd7dee1e80425e79b7800b65735c5f93daca56f84a573b6dfc4ed81313c8eaa2
Opcode Fuzzy Hash: 644ecf454b5406c55117dfc577d459684ad165775d5b9113ed441861368e03cd
Instruction Fuzzy Hash: F551BC2190D2C245FB61AB35583437AAA94BF5AFD0FA80171DABE473C1DE2DE844C3B0

Function 00007FF7F678F746 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F753
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: bb92e0fb6e8724d6a603b74c0048d4e019eb1dcf875e4f0697c5b41cb2e9f126
Instruction ID: 84b601dd1b8a7723dc6e81387bc775c00282b49a45f2f5d91f6b77f90d33efdb
Opcode Fuzzy Hash: bb92e0fb6e8724d6a603b74c0048d4e019eb1dcf875e4f0697c5b41cb2e9f126
Instruction Fuzzy Hash: 2741BB2190D6D245FB61AB35582437AAB99BF5AB90F980171DABE073C1DE2DE844C370

Function 00007FF7F678AFE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7F678B04C
htons.WS2_32 ref: 00007FF7F678B062
send.WS2_32 ref: 00007FF7F678B108
WSAGetLastError.WS2_32 ref: 00007FF7F678B11C
send.WS2_32 ref: 00007FF7F678B15E
WSAGetLastError.WS2_32 ref: 00007FF7F678B168

Strings

Sending data failed (%d), xrefs: 00007FF7F678B122, 00007FF7F678B16E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: 0fa8e56fa81545f9f8688c2b6d7ab52c58c37d91cada740fb0c289274a355cef
Instruction ID: 845de0d5a283f70430fb8599042e893bdec650e9449094039507816e3f5a9247
Opcode Fuzzy Hash: 0fa8e56fa81545f9f8688c2b6d7ab52c58c37d91cada740fb0c289274a355cef
Instruction Fuzzy Hash: A041D032608A8680E7006F35D924AAEB324F759F88FC44632DBA9037D8DF7CE456C361

Function 00007FF7F6797FFE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6798008
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 111713529-2901970132
Opcode ID: 239da363b9946295e359e9748766d2625f1db9500ef6f53e91155123ced98a70
Instruction ID: 900857db0dc051ebdfaf4bcfe1ffad1d12d5085bdc290e91e4c701872341c085
Opcode Fuzzy Hash: 239da363b9946295e359e9748766d2625f1db9500ef6f53e91155123ced98a70
Instruction Fuzzy Hash: B4313F65A0878285EB15AB619C241FAA7A9BF0D788FC44835CE6D173D6EE3CE104C3B0

Function 00007FF7F67974AE Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67974B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: 0fa73a337b14f544b56cbf689623e98a816b00dcf3c2286807af888b4a2c9cbe
Instruction ID: 6bcc08032fd4e9d45febd9534298ea0c66c0a526f4ea66a2e445c3f70f411bac
Opcode Fuzzy Hash: 0fa73a337b14f544b56cbf689623e98a816b00dcf3c2286807af888b4a2c9cbe
Instruction Fuzzy Hash: A9314355A0978284EB14A7759C241FBA7A9AF0D788FC84835CE6D173D6FE3CA40483B0

Function 00007FF7F67980FD Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

GMT, xrefs: 00007FF7F67981BE
Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F6798231
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Expire Date$Public Key Algorithm
API String ID: 1294909896-3805148269
Opcode ID: 3b490722dc74504eb9dd9ef87649719e5d11dc463ea0953fe5ed6b16c9670ad0
Instruction ID: 33b6a1d2e0b684d41f909785d26f7bbc03e3109be68dbd7544193e422e624f05
Opcode Fuzzy Hash: 3b490722dc74504eb9dd9ef87649719e5d11dc463ea0953fe5ed6b16c9670ad0
Instruction Fuzzy Hash: 5371A061A0868284EB14AB359C241FAE7E9FB0A784FC44836DA6D177D5EF3CE145C3B0

Function 00007FF7F679759D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
GMT, xrefs: 00007FF7F679764E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F67976C1
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 388a09dec5b697b908bc13682b02e5d7ea3e4acabdcfc6577ff0b92c602df413
Instruction ID: 18d2b05719e1946ae9fdb33209cb193cb54ec8dc32890476f979836fe14f6353
Opcode Fuzzy Hash: 388a09dec5b697b908bc13682b02e5d7ea3e4acabdcfc6577ff0b92c602df413
Instruction Fuzzy Hash: AF61B061A096D284EB14AB359C241BAEBE8AB097C4FC84436DA6D077D5FF3CE541C3B0

Function 00007FF7F6798895 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67988D8
memcpy.VCRUNTIME140 ref: 00007FF7F67988FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67989D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 88c815334131e338bb9b5bca162bc0b0591a3bf54374b822b0adf169f96e1fa6
Instruction ID: 7a2710a5a015f73420f804fc359faa83b0d37cb9938d1c46453b3e673e9d39b0
Opcode Fuzzy Hash: 88c815334131e338bb9b5bca162bc0b0591a3bf54374b822b0adf169f96e1fa6
Instruction Fuzzy Hash: 7E513611A0868245EB18AA2598243BBE794FB497E4F840A36CA7F077D5FE2CE045C371

Function 00007FF7F6798034 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
GMT, xrefs: 00007FF7F6798096
Expire Date: %s, xrefs: 00007FF7F6798427
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F67980E9
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$Expire Date$GMT$Public Key Algorithm
API String ID: 1294909896-1642401773
Opcode ID: b835cbb95ab126bbad8e794f07ad83e9ba5c3e34d718217ebb3e2543cfac9581
Instruction ID: b9c398e66f72394ee84ad9ddce79a1062f0601781049aaa75c16f18502b1b1c8
Opcode Fuzzy Hash: b835cbb95ab126bbad8e794f07ad83e9ba5c3e34d718217ebb3e2543cfac9581
Instruction Fuzzy Hash: 93516361A0978294EB14AB759C201FAE7A9FB0D784FC84835CA6D172D5EF3CE545C3B0

Function 00007FF7F675F7E0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675F826
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675F852
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F675F87E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: 1b0595316675f82772fc28900d3198f3d8a03ff6b87a63347f3563558c6d9905
Instruction ID: 4b3e7dd23dca27f93fbcfb8c9e733fa58ae884cf5770a8e6812f91364686604b
Opcode Fuzzy Hash: 1b0595316675f82772fc28900d3198f3d8a03ff6b87a63347f3563558c6d9905
Instruction Fuzzy Hash: CC51A426A1AB8181EB55DF16F45012973A8FB4CB84B481175DFAD03B8DDF3CE8A1CB60

Function 00007FF7F67974D7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
GMT, xrefs: 00007FF7F6797536
Signature Algorithm, xrefs: 00007FF7F6797937
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F6797589
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 3c568e79d8b76ca8c0f4947349ea53ad1015d81a9fc9ab77821cedc04fbb5508
Instruction ID: 98f1afdcaf84316cf47755a5d892785618f7d0f7adaf3654060ea6ccc467c360
Opcode Fuzzy Hash: 3c568e79d8b76ca8c0f4947349ea53ad1015d81a9fc9ab77821cedc04fbb5508
Instruction Fuzzy Hash: 9C515161A0978284EB14AB359C601FAE7A9EB097C4FC84435DA6D173D5EF3CE545C3B0

Function 00007FF7F6798294 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67982CF
memcpy.VCRUNTIME140 ref: 00007FF7F67982F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 546c04391f3f1894b024eb3058d86346fbee1fd25c8aed46030c2e58979d9950
Instruction ID: 25c21527c0557c920ecd57a5b356a5f4211aafd0a8bf6ca38e4bb1ed95d2a04b
Opcode Fuzzy Hash: 546c04391f3f1894b024eb3058d86346fbee1fd25c8aed46030c2e58979d9950
Instruction Fuzzy Hash: 2E416065A0878244EB15AB719D241FAE7A9BF1D788FC44935CE2D177D5EE3CE10483B0

Function 00007FF7F67860F6 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678611D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67861D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67861E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6786218
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678628C

Strings

SYST, xrefs: 00007FF7F67861B6
Entry path is '%s', xrefs: 00007FF7F67861EE, 00007FF7F6786225
Failed to figure out path, xrefs: 00007FF7F6786292

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Entry path is '%s'$Failed to figure out path$SYST
API String ID: 2190258309-1780565354
Opcode ID: 868c23e0445c8f829c81cdfaee16e57183642d2d1252c1cd069e64622adada94
Instruction ID: 71ba6e328e5db6485a44072767d78ca750adee9d42c48979ec4ea77edf05f33f
Opcode Fuzzy Hash: 868c23e0445c8f829c81cdfaee16e57183642d2d1252c1cd069e64622adada94
Instruction Fuzzy Hash: 32419661E0868291EB61EB35EC642BBA798BB0DF84F904031CAAD037D6DE3CD44593B0

Function 00007FF7F677D270 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D33C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D34A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D358
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D366
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D374
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D390
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D39E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677D3AC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 055e168fb65f423c57915a892bfce5b182b090623d16bc49fd49c5fdfd9f067a
Instruction ID: 11587e2cb55a2f06aa7ffce9f861ffc051fb6b792b39cf24ade7855b1c993937
Opcode Fuzzy Hash: 055e168fb65f423c57915a892bfce5b182b090623d16bc49fd49c5fdfd9f067a
Instruction Fuzzy Hash: 0C413022918B52C2E761AF25986023A77A8FB5DB84F844635DAAD53398DF38D850C3B0

Function 00007FF7F675A1B0 Relevance: 11.3, APIs: 9, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A22A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A234
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A23E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A248
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A252
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A25C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A266
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A270
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A279

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c643178a85888b15959d4e7ca118a99b6d7baaba478ac413579d56a64d74c09d
Instruction ID: 798f56f36235336e4dc9ff7b21304fc536d29e1938ecf528b270887baf810f79
Opcode Fuzzy Hash: c643178a85888b15959d4e7ca118a99b6d7baaba478ac413579d56a64d74c09d
Instruction Fuzzy Hash: 06311E36618A52C1D720AF12EC1522AB778FB99FC4F440431DEAD43B99DE3DD841D7A0

Function 00007FF7F675A0D0 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A117
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A121
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A12B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A135
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A13F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A149
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A153
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A15D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A166

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1ca458fc3389da7aade84e51b82ba5cd5ed2bd2528ed2cb808cc53f9e49b542e
Instruction ID: 7096cc91a715f09f2c412ec49492b58810e76be265246310e8253ea12d7ae936
Opcode Fuzzy Hash: 1ca458fc3389da7aade84e51b82ba5cd5ed2bd2528ed2cb808cc53f9e49b542e
Instruction Fuzzy Hash: 0521F876618A52C2D720AF25EC2112AB378FB9AB84F440431DEAD43769DF3CD845C7A0

Function 00007FF7F675A2D0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A2E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A2F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A2FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A307
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A311
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A31B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A325
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A32F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675A338

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: aab127bf0e8542732e3c18ba64e321ddd3c5e6f1a73537df46da66dd3b5eae98
Instruction ID: e38eb8921121855267e3cf5f1c2b1698901f8d932b812086a88ed67d66a7f685
Opcode Fuzzy Hash: aab127bf0e8542732e3c18ba64e321ddd3c5e6f1a73537df46da66dd3b5eae98
Instruction Fuzzy Hash: 9A01A966624A12C2DB14AF26EC65139A334FF9EF85B441431DDBE433A9DE2CD844D3B0

Function 00007FF7F6793FE0 Relevance: 10.9, APIs: 5, Strings: 2, Instructions: 424stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7F67933F3), ref: 00007FF7F6794088
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,00007FF7F67933F3), ref: 00007FF7F67940CA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7F67933F3), ref: 00007FF7F679416F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FF7F67933F3), ref: 00007FF7F6794182
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6794667

Strings

Failed to encode DOH packet [%d], xrefs: 00007FF7F67941C1
%s?dns=%s, xrefs: 00007FF7F6794158

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 1438451818-3030351490
Opcode ID: 4fadfb71b7984ed60b0423e7eae2986a5b3e6e9891e7e44db6b0c4a082480bef
Instruction ID: 54c4c9c3203a3c44569b0eb1b056f9b7b617dce8b0da45ba4bf663b6a1ca88dd
Opcode Fuzzy Hash: 4fadfb71b7984ed60b0423e7eae2986a5b3e6e9891e7e44db6b0c4a082480bef
Instruction Fuzzy Hash: FF02937171878245FB11AA769C643BBA7DDAB59788F814031DE2C477CEEE68E841C3B0

Function 00007FF7F6794860 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F675C540: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C576
Part of subcall function 00007FF7F675C540: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C586
Part of subcall function 00007FF7F675C540: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C594
Part of subcall function 00007FF7F675C540: memset.VCRUNTIME140 ref: 00007FF7F675C5CF

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6794929
memcpy.VCRUNTIME140 ref: 00007FF7F6794944
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679495E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: 9adbed3489a0455967ee38d16e91ff20980ce936b9dff803bb5791a7768888f6
Instruction ID: 1a371f7b053f48b2298ea7a403808a1b39d2919a08c82d81cbf82f21c961033c
Opcode Fuzzy Hash: 9adbed3489a0455967ee38d16e91ff20980ce936b9dff803bb5791a7768888f6
Instruction Fuzzy Hash: 2C914021B0C74281EB64AA275D6437B92E8AF49BC4F844134DE6D477C9FF2CE85183B4

Function 00007FF7F6778240 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F675B26A,?,?,?,?,?,?,?,00007FF7F675B037), ref: 00007FF7F6778251
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7F67783F3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7F6778410

Strings

TRUE, xrefs: 00007FF7F677837C
0123456789ABCDEF, xrefs: 00007FF7F6778402, 00007FF7F6778409
0123456789abcdef, xrefs: 00007FF7F67783E2, 00007FF7F67783EC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 7c5d4e7d2faa273dc8e58ced809aa81b5d23591f7467f2b6c40110dc8b8441fb
Instruction ID: 4513d2ac513befc0f99a3fa5197a52f3c36c2c86046c1ee85837b7639b250333
Opcode Fuzzy Hash: 7c5d4e7d2faa273dc8e58ced809aa81b5d23591f7467f2b6c40110dc8b8441fb
Instruction Fuzzy Hash: 3A510922F2C78541EF11AB15E86017FEB98AB5A788FD44131DA6E067D5DE3CD581C3B0

Function 00007FF7F6799F6A Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

GMT, xrefs: 00007FF7F679A01E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F679A091
TRUE, xrefs: 00007FF7F679A24D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 573759493-910067264
Opcode ID: 9ea57fa784b95d5cecdc159aef28458afd098b0769c5b2b03456adca71fa3106
Instruction ID: a646b2ec03362a7cdf63f1e131b00f6d0edea44c5be7723af78f03d0314c0cde
Opcode Fuzzy Hash: 9ea57fa784b95d5cecdc159aef28458afd098b0769c5b2b03456adca71fa3106
Instruction Fuzzy Hash: 82610321A0D6D244FB11AB359D2427BFBE9AB0A784FD84031D6AD02AD5EF3DD445C7B0

Function 00007FF7F6745E10 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745EA1
memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745EE5
memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745EFD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745F82

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745FB4
memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745FCF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F6745FEC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 105eb5b8ecb37e2dada83aefac9818a8211f75c97886bab9d9afdb0a84635369
Instruction ID: bd9bebc8ecf12358c1c5ab82512c88f8943102a271905efbefb3331650b6037a
Opcode Fuzzy Hash: 105eb5b8ecb37e2dada83aefac9818a8211f75c97886bab9d9afdb0a84635369
Instruction Fuzzy Hash: A351D822619B81C1FB04EF25D96816AA369FB08BD4F940A31DE3D077D1CF78E195C3A1

Function 00007FF7F6783D40 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7F6783E03

Strings

, xrefs: 00007FF7F6783DA7
Data conn was not available immediately, xrefs: 00007FF7F6783EF7
Getting file with size: %I64d, xrefs: 00007FF7F6783EB5
RETR response: %03d, xrefs: 00007FF7F6783D98
bytes, xrefs: 00007FF7F6783DF9
Maxdownload = %I64d, xrefs: 00007FF7F6783E9C, 00007FF7F6783F3B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: f36673910abb49c915d81611450cd3aef25059b3077479c1ad091aa4937d379d
Instruction ID: be83a8668437cfbddaaa042c371b8fa49cde51134e8b39ce7242bf531f8791cd
Opcode Fuzzy Hash: f36673910abb49c915d81611450cd3aef25059b3077479c1ad091aa4937d379d
Instruction Fuzzy Hash: B751DD22A0974641EB24A779AC6427AE398FB4DB74FD80231D97C026D1DF7CDC8687B0

Function 00007FF7F679870B Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

GMT, xrefs: 00007FF7F67987BE
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F679882F
Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: 55d78412daaa31d674ec054b636355c7addbf0a6c2a3f49e325662ff4e4aa6d3
Instruction ID: 17077364332c0cc0a47677e7559bc71bc944e4a0985416a6945537aaea7d8f29
Opcode Fuzzy Hash: 55d78412daaa31d674ec054b636355c7addbf0a6c2a3f49e325662ff4e4aa6d3
Instruction Fuzzy Hash: 3351B462B0C6C285EB119B65A8242BBE7E9FB49790F944832DA9D03795EF3CD145C3B0

Function 00007FF7F6768D60 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792A84
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792AAA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6792AB8

Strings

Digest, xrefs: 00007FF7F6768D88
stale, xrefs: 00007FF7F6792A0F
true, xrefs: 00007FF7F6792A24

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: cd561cf00eb158123dea8fd1aef4a8a90218ffcbb6a09d60f9fec1baa2a441d2
Instruction ID: cbdd780d98b252e9399c1b359afca56d2912f25eef23c78c31b6983ec6c70f4c
Opcode Fuzzy Hash: cd561cf00eb158123dea8fd1aef4a8a90218ffcbb6a09d60f9fec1baa2a441d2
Instruction Fuzzy Hash: 25517722518A4681FB20AB25ED603BAA3E8FF4D784F944131DABD476C5EF2CD515C7B0

Function 00007FF7F678C8F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF7F678C950
memcpy.VCRUNTIME140 ref: 00007FF7F678C976
memchr.VCRUNTIME140 ref: 00007FF7F678CA73

Strings

TFTP error: %s, xrefs: 00007FF7F678CA90
Received too short packet, xrefs: 00007FF7F678C9A2
Internal error: Unexpected packet, xrefs: 00007FF7F678CA18

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: 3a54981905c914cdaef3556359282fe403773f15e8db7d6cbb4857878a6436a4
Instruction ID: 5a5243ae7df36b4e7f885791512edf81ac5802cfb7f1031b4800867748e188a8
Opcode Fuzzy Hash: 3a54981905c914cdaef3556359282fe403773f15e8db7d6cbb4857878a6436a4
Instruction Fuzzy Hash: 6A51C771A08582C5EB54AB35DD203BBA7A4FB48B88F944132DA6D477C5DE3CE845CBB0

Function 00007FF7F67423B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6746E10: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7F674240B), ref: 00007FF7F6746E8E
Part of subcall function 00007FF7F6746E10: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7F674240B), ref: 00007FF7F6746E9C
Part of subcall function 00007FF7F6746E10: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7F674240B), ref: 00007FF7F6746EB2

Part of subcall function 00007FF7F6743BF0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7F6741DCB), ref: 00007FF7F6743C36

Part of subcall function 00007FF7F6745E10: memcpy.VCRUNTIME140(?,?,?,00007FF7F6741DFA), ref: 00007FF7F6745EA1

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67424A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67424E8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742536
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742584

Strings

, column , xrefs: 00007FF7F6742439
at line , xrefs: 00007FF7F67423FC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: ac706bb0521000e4c115238f0d9df125bc0f969b470b4f5ee90fe16b4f1feced
Instruction ID: 4f29d168d859ea43bdf1985f32d3a66d1282dd561c52646a8cd362efdc9fadfd
Opcode Fuzzy Hash: ac706bb0521000e4c115238f0d9df125bc0f969b470b4f5ee90fe16b4f1feced
Instruction Fuzzy Hash: E551C462B08A81C5FB00EB74D9643AE6325EB487A8F405235DE7C13BD9DE38D495D3A0

Function 00007FF7F6791470 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF7F6774E06), ref: 00007FF7F67915CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF7F6774E06), ref: 00007FF7F67915E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67915F5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF7F67915AE
Negotiate, xrefs: 00007FF7F6791476, 00007FF7F6791552
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF7F6791521
Proxy-, xrefs: 00007FF7F679159D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 3f6686c5872a1f6a81ecd9e0f058412ef29e7e2cd2025b5abae98a3b82803512
Instruction ID: 5d578aeb2c4a87a3f6e3d07edceb7ffd2327f384bfe67bd1a63505e7a43bc663
Opcode Fuzzy Hash: 3f6686c5872a1f6a81ecd9e0f058412ef29e7e2cd2025b5abae98a3b82803512
Instruction Fuzzy Hash: 0951C532A0864296FB11EB35D8602BAA7D8FB49794F844031DA6D432D1FF3DE461C7B0

Function 00007FF7F678F7C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 1fb06e9a3e7450c4a3794c0b93c4f63385b47844a9cf2e3dc595b16c47b35eb1
Instruction ID: 1e81dc7e5dbec2c1a4f129fecba05ecf5101640b68f501bded30f533dfb725aa
Opcode Fuzzy Hash: 1fb06e9a3e7450c4a3794c0b93c4f63385b47844a9cf2e3dc595b16c47b35eb1
Instruction Fuzzy Hash: 7941DA2190D6D245FB62AB35583037AAB98BF5ABD4F980171DAAE473C1DE2DE844C370

Function 00007FF7F678F7B7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: dfaed6e386e33724cb2e223900adcbd9f7fef9935f9687bffa3bbf8d2aa51031
Instruction ID: 57ac5a446dc5c610757f63e61b6605732f699a29a45c6960e8a004053033de82
Opcode Fuzzy Hash: dfaed6e386e33724cb2e223900adcbd9f7fef9935f9687bffa3bbf8d2aa51031
Instruction Fuzzy Hash: D541DC2190D2D245FB62AB35583437AAB95BF5ABD4FA80171D9BE073C1DE2DE844C370

Function 00007FF7F678F71C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: a5c0cff52b00059ef7d8c77f212d0b1658b3423eb890fb7911eff90761143d53
Instruction ID: 9920c5acc03da87f16034a9cae2f494d9a553dd90f831efb7237de6d556c3b77
Opcode Fuzzy Hash: a5c0cff52b00059ef7d8c77f212d0b1658b3423eb890fb7911eff90761143d53
Instruction Fuzzy Hash: F341BA2190D6D245FB62AB35583437AAB99BF5ABD0FA80171D9BD073C1DE2DE844C3B0

Function 00007FF7F678F72A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 2e3edc563f2aee38bc4da222f14dc07a5d5f3b87b8ef437c646bcd55731b9087
Instruction ID: 1c0d6605a52734c07023f3b0c89cdb76561352f26a953420737bbf1d648425d4
Opcode Fuzzy Hash: 2e3edc563f2aee38bc4da222f14dc07a5d5f3b87b8ef437c646bcd55731b9087
Instruction Fuzzy Hash: E441BA2190D6D245FB62AB35583437AAB99BF5ABD0FA80171D9BD073C1DE2DE844C3B0

Function 00007FF7F678F738 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 3c17b8edd8f51791b30496a62c6b8e61968bdc908898effc3d30ade1595102bd
Instruction ID: 5d490ab973fac1c5746bd90d6eb8d06d4cf35028807b46d5ffb2ab68f1bb7a2d
Opcode Fuzzy Hash: 3c17b8edd8f51791b30496a62c6b8e61968bdc908898effc3d30ade1595102bd
Instruction Fuzzy Hash: 7441BA2190D6D245FB62AB35583437AAB99BF5ABD0FA80171D9BD073C1DE2DE844C3B0

Function 00007FF7F678F762 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: b67b34d9d2b74a6abba1901238562642ff15dceaa1a23bc772bb3e51d676fca3
Instruction ID: 3ebe46b8ffa4331ae53e23bedf8bd2c40d5601baa725cf063c3eb72e964ed5d7
Opcode Fuzzy Hash: b67b34d9d2b74a6abba1901238562642ff15dceaa1a23bc772bb3e51d676fca3
Instruction Fuzzy Hash: D241BC2190D6D245FB61AB35583437AAB95BF5ABD0FA80171D9BD073C1DE2DA844C370

Function 00007FF7F678F7ED Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F82D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F87E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F93A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA2A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678FA3B

Strings

%%%02x, xrefs: 00007FF7F678F8E3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: eebc2a546fc8e6feac9b87d948e5f37beee0bb11b8e0f088ce828c99f435c154
Instruction ID: abfae14243b6bbec44c7e3c77b9ad88052630adb5c1814345dc13e5333017e63
Opcode Fuzzy Hash: eebc2a546fc8e6feac9b87d948e5f37beee0bb11b8e0f088ce828c99f435c154
Instruction Fuzzy Hash: EA41CA2190D6D245FB62AB35583437AAB99BF5ABD0F980171DABD073C1DE2DE844C3B0

Function 00007FF7F67748D0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7F67749B6
strchr.VCRUNTIME140 ref: 00007FF7F67749C9
strchr.VCRUNTIME140 ref: 00007FF7F67749DB

Strings

Expect: 100-continue, xrefs: 00007FF7F6774A38
Expect:, xrefs: 00007FF7F677495E
Expect, xrefs: 00007FF7F6774937
100-continue, xrefs: 00007FF7F67749F6

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 7e7249d2413e93b8756c8e5a769afa0f3ec6f63a671b70d6ce7e4fc1b7ebd840
Instruction ID: e109d72d19269ac580b3ed6cf18b3427dd88ab90450a9f21c79f3f56f1b29672
Opcode Fuzzy Hash: 7e7249d2413e93b8756c8e5a769afa0f3ec6f63a671b70d6ce7e4fc1b7ebd840
Instruction Fuzzy Hash: 1D41F921B2C78281EB54AB1BAD200BAE3949F4D788FC85034DA7D477DADD1DE4418BB4

Function 00007FF7F678D440 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7F678D458
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7F678D5C1

Strings

gfff, xrefs: 00007FF7F678D4CC
gfff, xrefs: 00007FF7F678D538
Connection time-out, xrefs: 00007FF7F678D47B
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF7F678D59C

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 293506947766e32d74f725f200bba93e5a6cab1f91c5436f01adaa20fbc03ab6
Instruction ID: 4cf1f7b1f936a683f90ed4485ee5a51ef6d4b8dd3ef477075fb5805e48386d0c
Opcode Fuzzy Hash: 293506947766e32d74f725f200bba93e5a6cab1f91c5436f01adaa20fbc03ab6
Instruction Fuzzy Hash: 25412B7272861586DB24DF3AE41056977A4F78CF88FA05132DE1C877D4DE39E941CB90

Function 00007FF7F6797F50 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
%s%lx, xrefs: 00007FF7F6797FAD
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: d2c81df787f58d74bd1c2b5c7b52d4f0f54536a8e8ffd5d60f426d4f5dc7a506
Instruction ID: 2779989e05ab7ffdcec4fcd4b5df1b99ab3cbcdd12b3a513fd6cce183f66f50d
Opcode Fuzzy Hash: d2c81df787f58d74bd1c2b5c7b52d4f0f54536a8e8ffd5d60f426d4f5dc7a506
Instruction Fuzzy Hash: 38415461A0968284EB15AB759C241FAA7A9AF0D788FC44835CE6D176D6FF2CE10483B0

Function 00007FF7F679864E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

GMT, xrefs: 00007FF7F67986A4
Signature: %s, xrefs: 00007FF7F6798A27
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F67986E4
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 950803be5321596d8ae6dcd6400d6715bd22c82becce96dbb6edd16642afa6e7
Instruction ID: fedbf1fe15c47015ca4882aeb2f31903d7a7872df22fc34c44957fcec0458764
Opcode Fuzzy Hash: 950803be5321596d8ae6dcd6400d6715bd22c82becce96dbb6edd16642afa6e7
Instruction Fuzzy Hash: C5417722A1878285EB10AF25E8601ABE3A8FB49784FC84432DA5D177D5EF3CD545C7B0

Function 00007FF7F6797411 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
%s%lx, xrefs: 00007FF7F6797466
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: f392083efe6b65ded1fc2e6bc662f49a9fc365949f050ff65cdf9f05b9f96eba
Instruction ID: c345670be395a83389de4ef633dfba8cd01ed3ff9f5a2ed7b27313e1406fad36
Opcode Fuzzy Hash: f392083efe6b65ded1fc2e6bc662f49a9fc365949f050ff65cdf9f05b9f96eba
Instruction Fuzzy Hash: 34417755A0968284EF14A7359C241BBABA9AF0D7C4FC84831DE6E177D6FE3DE04483B0

Function 00007FF7F6780750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678078D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67807FE

Strings

., xrefs: 00007FF7F67807F7

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 027f7fe9b366bf7d7183bdacec28f6c9f86bb076554f293a86ea0004c285c0c6
Instruction ID: 7d2651039f25a4f658058b10d16b2ea8f01d8dc970798cf93c3d19501fcbc662
Opcode Fuzzy Hash: 027f7fe9b366bf7d7183bdacec28f6c9f86bb076554f293a86ea0004c285c0c6
Instruction Fuzzy Hash: 45416422A08B4681F750EB259C2037AA3A8FB4DF80F954031DA6D476D5DF3CE89187F0

Function 00007FF7F679771E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679774F
memcpy.VCRUNTIME140 ref: 00007FF7F679777A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 25f84c5534454b8c43c74e32c76f92ce0ee4c5d2a495e4f678ebbaf9449bc15d
Instruction ID: 37d0e5c94d28dcb7133828645608ba105d2ac77e65bf180a75a4dd85ef53a5ad
Opcode Fuzzy Hash: 25f84c5534454b8c43c74e32c76f92ce0ee4c5d2a495e4f678ebbaf9449bc15d
Instruction Fuzzy Hash: 4F417255A0978284EB15AB359C241FAA7A9BF097C8FC84435CE2D177D5FE3CA504C3B0

Function 00007FF7F679A0FD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A138
memcpy.VCRUNTIME140 ref: 00007FF7F679A15D
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

TRUE, xrefs: 00007FF7F679A24D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$freemallocmemcpy
String ID: TRUE
API String ID: 2172629687-3412697401
Opcode ID: 81732ace61d0e8073f3c1e9c35bbff8b0fbca31934598ee0c7dac7d395ac8eea
Instruction ID: 8ea69456f675d4381b2f7107f1ceb7036552b8a52edc76f33b42b7596541571f
Opcode Fuzzy Hash: 81732ace61d0e8073f3c1e9c35bbff8b0fbca31934598ee0c7dac7d395ac8eea
Instruction Fuzzy Hash: 7531FA11E0E69245FB12EB364D24376FBD96B5AB90F844631C97E02AD5EE3E9441C370

Function 00007FF7F6790D70 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F677C880: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8A8
Part of subcall function 00007FF7F677C880: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8CE
Part of subcall function 00007FF7F677C880: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8EF
Part of subcall function 00007FF7F677C880: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C900

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6790E0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6790E58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6790E61

Strings

HOME, xrefs: 00007FF7F6790DA9
%s%s.netrc, xrefs: 00007FF7F6790DCF
%s%s_netrc, xrefs: 00007FF7F6790E24

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 9e24961a21cdaee02f2969bed35d094b8ed2ff04c1a69ee7d1d5efb70e16ef92
Instruction ID: f4990f512866627471525b5ef27ce4a83f93f6d6120468707045332f73a76470
Opcode Fuzzy Hash: 9e24961a21cdaee02f2969bed35d094b8ed2ff04c1a69ee7d1d5efb70e16ef92
Instruction Fuzzy Hash: 1A314121A19B5281EB24BB26BC20167E3A8BF4DB90F844535EDAC477D5FE3CE40593B0

Function 00007FF7F679889D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67988D8
memcpy.VCRUNTIME140 ref: 00007FF7F67988FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: 41a64bd3ee70ac3280c524507bdb8a6bfecaf95fafe27d1a23f5f35e8675915e
Instruction ID: cf3558bb7df98dcfbb348ec7c27fd0c1fc914f685955ca8471c3895d49bc4c81
Opcode Fuzzy Hash: 41a64bd3ee70ac3280c524507bdb8a6bfecaf95fafe27d1a23f5f35e8675915e
Instruction Fuzzy Hash: FC318561A0978245EB55AB2698242BBD394FF49BD4F840932DD6D177D5EE3CE0018370

Function 00007FF7F677F276 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F675B460: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F675B4A4

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677F2B4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F677F2C6

Strings

Select failed, xrefs: 00007FF7F677F358
Mailbox UIDVALIDITY has changed, xrefs: 00007FF7F677F2FE
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF7F677F298

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 4f8b19885a3942946affcb2a731a69568565c9aeb0bd8ea935e111cb0f4ff412
Instruction ID: 7c7c0413196706886a7c49a4d49b89f3fbdf3f87f94c1c5b1ea4da100d9f9ea5
Opcode Fuzzy Hash: 4f8b19885a3942946affcb2a731a69568565c9aeb0bd8ea935e111cb0f4ff412
Instruction Fuzzy Hash: 05311062A18A8281EB64BB20DE601BFA368FF4D794F944431CA6D476D5DF2CE85183F1

Function 00007FF7F6798625 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6798628
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: ca1245fe2eff767ec2f233e59202265185292fa145f8adc7ec0566ffc5c026f4
Instruction ID: 189cc680018f856220a423c0a73793cb0c7afc46320a9ec0b3afa8892b7e0c11
Opcode Fuzzy Hash: ca1245fe2eff767ec2f233e59202265185292fa145f8adc7ec0566ffc5c026f4
Instruction Fuzzy Hash: 06214562A1868285EB54AB25E8642BBE3A8FF4D7C4F840432DE6D17795EF3CD105C770

Function 00007FF7F6765F80 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F6765FB5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F6765FE1
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F6765FE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F676600B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00007FF7F67632FC), ref: 00007FF7F6766022

Strings

Invalid zoneid: %s; %s, xrefs: 00007FF7F6765FF4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_errnostrerrorstrtoul
String ID: Invalid zoneid: %s; %s
API String ID: 439826447-2159854051
Opcode ID: 1e5153ef112f2720b21915057dfbc39a98e88746b31ffda249c79a4b110ed5cd
Instruction ID: f71fe7ff45712558980960d33e3b96d4fc7fbe0c909dad30beec3c6416c40dc5
Opcode Fuzzy Hash: 1e5153ef112f2720b21915057dfbc39a98e88746b31ffda249c79a4b110ed5cd
Instruction Fuzzy Hash: 5D118171A19642C2EB10AB25EC6057BA364FF8AB44FD40031DA7D436E4EE2DE844DBB0

Function 00007FF7F6765EB0 Relevance: 10.0, APIs: 8, Instructions: 36COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EC4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EDA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765EEE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F02
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F16
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F2A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F3E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F6765F52

Part of subcall function 00007FF7F678EE50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6765F6B,?,?,00000000,00007FF7F67619B3,?,?,00000000,00007FF7F6761F35), ref: 00007FF7F678EE65

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 7eb113df98b6ab4a04c26d3616b0b5b8789459c08ce18511ff8b14322545e604
Instruction ID: 55ecd92d3a4421a5a14411e576838a43ac5115b1ce409bf1bbfd958e5d9eb8c6
Opcode Fuzzy Hash: 7eb113df98b6ab4a04c26d3616b0b5b8789459c08ce18511ff8b14322545e604
Instruction Fuzzy Hash: 4D11B636518F81C1D7109F25EDA51E973B8FBDAF8AB580031EE6A4F6999F348055C270

Function 00007FF7F675B0F0 Relevance: 10.0, APIs: 8, Instructions: 23COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B0FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B107
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B111
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B11B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B125
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B12F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B139
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675B143

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e45aeea8ff3dcbb3fd8da7c6b960110f74b281d7bdb83cb583dbac18daa8ca81
Instruction ID: 784bccb688d40c6ebe9541ac91079d66144839fd346eec9f3c70a76ab6044760
Opcode Fuzzy Hash: e45aeea8ff3dcbb3fd8da7c6b960110f74b281d7bdb83cb583dbac18daa8ca81
Instruction Fuzzy Hash: A3F05966A24912C2D724AF2AEC661396334FBAEF45B441431DD7E423A9DE2CD845D3B0

Function 00007FF7F6797D1C Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797D5F
memcpy.VCRUNTIME140 ref: 00007FF7F6797D85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797E58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797EC9

Strings

Start Date, xrefs: 00007FF7F6797E9D
Start Date: %s, xrefs: 00007FF7F6797EB7

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: c3347e06e0772bf1e423b4f3f997015e39df33b2c3b1c317c076bd70ed71b90e
Instruction ID: 3b7bf1c20bf075a096502805758d6b82321fdeaad01af2af6f93faa0ed04fda8
Opcode Fuzzy Hash: c3347e06e0772bf1e423b4f3f997015e39df33b2c3b1c317c076bd70ed71b90e
Instruction Fuzzy Hash: 3C412751A0928245EF1C673548352BAA7D6EB1EBD4F888635CA3F077D5FE2CA44583B0

Function 00007FF7F674C640 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F674C72A
memcpy.VCRUNTIME140 ref: 00007FF7F674C739
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674C76D
memcpy.VCRUNTIME140 ref: 00007FF7F674C774
memcpy.VCRUNTIME140 ref: 00007FF7F674C783
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F674C7A8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: a20e593d4bd82ef9cc10abe2e2397c5f0dd4fde0d56d9362464a2f7d70bc2716
Instruction ID: e9b04d4a3c2959920ef159964b61b465fbe4a49efc216bdf7715f480d59ffb35
Opcode Fuzzy Hash: a20e593d4bd82ef9cc10abe2e2397c5f0dd4fde0d56d9362464a2f7d70bc2716
Instruction Fuzzy Hash: 4831B22171D641C6EF14BB2699281AAE269AB48BE0F944732DE7D07BD5DF3CE041C370

Function 00007FF7F6769140 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF7F6769225
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769234
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769246
VerSetConditionMask.KERNEL32 ref: 00007FF7F6769258
VerSetConditionMask.KERNEL32 ref: 00007FF7F676926E
VerifyVersionInfoA.KERNEL32 ref: 00007FF7F6769281

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 886a942f540bc7cf8f29631a9320e31e516c52bfc616a14f4d3cfc983c6169fc
Instruction ID: 82281fd14e8123af03ba0c1f43569ab58844870cf016af29bd90d3254f4d1458
Opcode Fuzzy Hash: 886a942f540bc7cf8f29631a9320e31e516c52bfc616a14f4d3cfc983c6169fc
Instruction Fuzzy Hash: 87412B22E1C682C6F3309B11E8247BBF364EBD9300F545235E9E903B95DE3EE4819B60

Function 00007FF7F679824F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 7c92a4bbe7371fb4b1d8e617a56d88ad3c7bf77f1d7e34ffe023260c47be8e9d
Instruction ID: 80b0668a960957dc39cc359c7e89a5ef9c05dc1fa3f324e88fb07fdd8e1c3a4d
Opcode Fuzzy Hash: 7c92a4bbe7371fb4b1d8e617a56d88ad3c7bf77f1d7e34ffe023260c47be8e9d
Instruction Fuzzy Hash: AB417365A087C285EB14AB619C241FAA7A9BF0D788F884935CE6D177D6EF3CE104C370

Function 00007FF7F67976DF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 7b7e3b5bfc8c0bbd38473bdcac9e04d71a842dd77c58079ce5dae42441d08063
Instruction ID: cff325b16755f3dbf4b8b47212c1f3a7d6beedcb9b5ff14275d6f544de98966d
Opcode Fuzzy Hash: 7b7e3b5bfc8c0bbd38473bdcac9e04d71a842dd77c58079ce5dae42441d08063
Instruction Fuzzy Hash: 6D419665A0978284EB14AB319C241FAA7A9BF0D7C8F884835DE6D177D5EE3CE104C3B0

Function 00007FF7F679E190 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E239
memcpy.VCRUNTIME140 ref: 00007FF7F679E255
memcpy.VCRUNTIME140 ref: 00007FF7F679E26C
memcpy.VCRUNTIME140 ref: 00007FF7F679E287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679E2BA

Strings

PLAIN, xrefs: 00007FF7F679E19B

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$freemalloc
String ID: PLAIN
API String ID: 3313557100-4000620671
Opcode ID: b2f10b0df633edde4c663c154711e900b01d618fb6a07a779d575b7840397b43
Instruction ID: 109735813f4c9cfb62c8d394662f25230b58ce82e9d89742a4b7508594f6f416
Opcode Fuzzy Hash: b2f10b0df633edde4c663c154711e900b01d618fb6a07a779d575b7840397b43
Instruction Fuzzy Hash: 7A31C766A08B8682EB10DF25E96026BA794FF49BD8F844631DEBD077D5EE3CD045C360

Function 00007FF7F6797FC5 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 64455ddd5a978b85e33b616fc1962a5c0a1841916232d696f0edef40e74da327
Instruction ID: 15b4b3497d88404bc5f81b8d7d72a260cb1ad8ab9dad7c27c0d71e723ba8577d
Opcode Fuzzy Hash: 64455ddd5a978b85e33b616fc1962a5c0a1841916232d696f0edef40e74da327
Instruction Fuzzy Hash: 38312461A0978245EB15AB759C241FAA7A9BF0D788FC44835DE6D172D6FF3CE10483B0

Function 00007FF7F6780271 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67802F6
memcpy.VCRUNTIME140 ref: 00007FF7F6780311
strchr.VCRUNTIME140 ref: 00007FF7F678032D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678033E

Strings

Got unexpected pop3-server response, xrefs: 00007FF7F6780291
CAPA, xrefs: 00007FF7F6780354

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: 7b13aeeb5f174c84a05b40aad520cf0a66e54b04a4a91b3024b38faf5081b1cc
Instruction ID: 78a25cc358be5e210268a27499b18f6269a7553623605ddef22cd6fe49e67495
Opcode Fuzzy Hash: 7b13aeeb5f174c84a05b40aad520cf0a66e54b04a4a91b3024b38faf5081b1cc
Instruction Fuzzy Hash: D431E762B0938282EB09A7309D6067BA698BB09B54F940535CA3D437E1CF3CFC5583B1

Function 00007FF7F6798016 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6799140: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679918C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 35b22113d5f68d879cf3847396f763c90cde38f4a5f83b542e2eefac487958b7
Instruction ID: 3557599207647aace8dc0964d64d9d0bf80bb2650796ba909da4e8d749a35b4b
Opcode Fuzzy Hash: 35b22113d5f68d879cf3847396f763c90cde38f4a5f83b542e2eefac487958b7
Instruction Fuzzy Hash: 05312365A0978245EB15AB719C241FAA7A9BF0D788FC44835CE6D172D6FF3CE10483B0

Function 00007FF7F6797FE3 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F679AC50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679AC85

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798439
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798502

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Expire Date, xrefs: 00007FF7F679840D
Public Key Algorithm: %s, xrefs: 00007FF7F67984D2
Expire Date: %s, xrefs: 00007FF7F6798427
Public Key Algorithm, xrefs: 00007FF7F67984B8

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3061335427-2901970132
Opcode ID: 0ce4234f479c702b72b5579015f8e0b31a955954a5808c6e2cbe134b7e04fb63
Instruction ID: b06292e7c65674efd18f948aa42c196c880c37c06d73767f33097b052b7e01d9
Opcode Fuzzy Hash: 0ce4234f479c702b72b5579015f8e0b31a955954a5808c6e2cbe134b7e04fb63
Instruction Fuzzy Hash: 04313461A0978245EB15AB719C241FAA7A9BF0D788FC44835DE6D172D6FF3CE10483B0

Function 00007FF7F6798580 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

Signature: %s, xrefs: 00007FF7F6798A27
%s%lx, xrefs: 00007FF7F67985DD
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 9264e6448cedd647a91235911ff1229aaed000e140e40ead4778aa69a6d9dffe
Instruction ID: b9c17c55181b67ffb4a77077f918aa531d9f9c33719e971b9955582aa636b710
Opcode Fuzzy Hash: 9264e6448cedd647a91235911ff1229aaed000e140e40ead4778aa69a6d9dffe
Instruction Fuzzy Hash: F5319862B0868285EB10AB2598642BBE399FB4D784FD40831DE6D477D5EE2DD045C7B0

Function 00007FF7F6788610 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6788621
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678868D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678869F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: e8613d0294d1cc7f92a55901f0896a61e06b1b620139e0056f4eaf019247f7ed
Instruction ID: fd58182c00bca84387ad622b935430bf74436c49ec1cad474734ad8d3bd35a65
Opcode Fuzzy Hash: e8613d0294d1cc7f92a55901f0896a61e06b1b620139e0056f4eaf019247f7ed
Instruction Fuzzy Hash: 0231B622A1878681EB519B24D8203BAF3B4FB4AB88FA80030DE6C077D5DF3DD4558770

Function 00007FF7F6797481 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: ea154de60150d50552c2718d6fc22c5b5b235f255668f2ffea73f60108924b44
Instruction ID: cb947446aec2eef3c23b1b989ea26e100ffa72d7b51a253ef0c5649f6fc7c1d9
Opcode Fuzzy Hash: ea154de60150d50552c2718d6fc22c5b5b235f255668f2ffea73f60108924b44
Instruction Fuzzy Hash: 91314555A0968284EB14A7759C241FBA7A9AF0D7C8FC84835DE6D1B3D6FE3CE44083B0

Function 00007FF7F67974BF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6799140: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679918C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: bd3d540a2484f9cd3a53e73c16194a4881832abcfbe8509155d6b2d58ebfcfa6
Instruction ID: c7d881550b8724ffe289cec2fdd7266057b995cb3610539b5f619585bb1b75b2
Opcode Fuzzy Hash: bd3d540a2484f9cd3a53e73c16194a4881832abcfbe8509155d6b2d58ebfcfa6
Instruction Fuzzy Hash: 78313355A0978284EB14AB759C241FBA7A9AF0D7C8F884835DE6D173D6FE3CE54083B0

Function 00007FF7F6797499 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F679AC50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679AC85

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67978BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797963

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Serial Number: %s, xrefs: 00007FF7F67978AC
Signature Algorithm: %s, xrefs: 00007FF7F6797951
Signature Algorithm, xrefs: 00007FF7F6797937
Serial Number, xrefs: 00007FF7F6797892

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: db235a4450c5f349b9ab72eb30da38325840abdeb67f20acb983d19fc2a4c14d
Instruction ID: 1c2bad33bad079639a975282a4d6abc5063b2aabb81b3f398e287a455664917b
Opcode Fuzzy Hash: db235a4450c5f349b9ab72eb30da38325840abdeb67f20acb983d19fc2a4c14d
Instruction Fuzzy Hash: 9F313355A0978284EB14AB759C241FBA7A9AF0D7C8F884835DE6D173D6FE3CE54083B0

Function 00007FF7F67862A3 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67862BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678633B

Strings

SITE NAMEFMT 1, xrefs: 00007FF7F678631C
OS/400, xrefs: 00007FF7F6786309

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: ad2d57b8bdb64e64066a1e9082085b36c03f6f800f1ceea49132c5796a990990
Instruction ID: d92adc79f168411a34093fb3581d14cf30726d442f0b6bfe60dc9a70ad916b64
Opcode Fuzzy Hash: ad2d57b8bdb64e64066a1e9082085b36c03f6f800f1ceea49132c5796a990990
Instruction Fuzzy Hash: 5131C721A0C68381E771AB359D603BBA358BB5EB84F904071CAAD536D5DE3CD946D370

Function 00007FF7F6742650 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6744350: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381

Part of subcall function 00007FF7F6743C70: memcpy.VCRUNTIME140 ref: 00007FF7F6743CC3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742722
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6742770
__std_exception_copy.VCRUNTIME140 ref: 00007FF7F67427C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674280D

Strings

out_of_range, xrefs: 00007FF7F6742696

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 416aaa0d375e5eec63550c4ab23ce1862656c62d6f6218db7ac47a387bde8a41
Instruction ID: ae40b3b87fb6dafb84da302b479e9324286b87b32abb675b257c429bafb8bbfe
Opcode Fuzzy Hash: 416aaa0d375e5eec63550c4ab23ce1862656c62d6f6218db7ac47a387bde8a41
Instruction Fuzzy Hash: 73516032B18B41D9EB00EF74D9543AD6369EB59798F804235DA7C03AD9DF38E1A5C360

Function 00007FF7F678FEC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678FF38
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678FF6A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678FFDA

Part of subcall function 00007FF7F6778240: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F675B26A,?,?,?,?,?,?,?,00007FF7F675B037), ref: 00007FF7F6778251

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6790055

Strings

0123456789abcdefABCDEF:., xrefs: 00007FF7F678FF2E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _errno_strdupstrcspnstrncmpstrspn
String ID: 0123456789abcdefABCDEF:.
API String ID: 2191890455-446397347
Opcode ID: 76ee79804532aefb5b9b615f8364d287c592931fb6a858183854be42adcf5243
Instruction ID: 23a1163b93bcc345c1e3136efd428775deb79f604a26e9b91d9137c641d736d0
Opcode Fuzzy Hash: 76ee79804532aefb5b9b615f8364d287c592931fb6a858183854be42adcf5243
Instruction Fuzzy Hash: 9841D322A1CACA45EB21AB249C2037BA799EB1EB44FC80135DA6D076C5DF2CE455C7B1

Function 00007FF7F6799EA8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

GMT, xrefs: 00007FF7F6799F04
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F6799F56

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 573759493-632690687
Opcode ID: 5748dd9c5ea64109dffa579bb85d4611a3a368ad641f5f36c4c6bd507780b0bd
Instruction ID: b18489c1f9938ab3da9153c9cabfbb66cb225888794fbfc4adb16eaa689adc64
Opcode Fuzzy Hash: 5748dd9c5ea64109dffa579bb85d4611a3a368ad641f5f36c4c6bd507780b0bd
Instruction Fuzzy Hash: 97410622A0D6C285FB11DB35886427AFBD9AB4D780FD84131C6AE02AD6EF3DD541C3B0

Function 00007FF7F676F890 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676F8FA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676F96B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7F676F9CB

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF7F676F9F2
:%u, xrefs: 00007FF7F676F90E, 00007FF7F676F974

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: a1bcfb6b737e128f22dc2304d54d207902b239ab6957f751d3e806f713f45f87
Instruction ID: 7913de9619fefbf23c010fcea24feb3a439b020b60561ff072c8e51161f5b7c0
Opcode Fuzzy Hash: a1bcfb6b737e128f22dc2304d54d207902b239ab6957f751d3e806f713f45f87
Instruction Fuzzy Hash: 5641F5226186C6C1EB11EB11E8603BAA769EB4DB88F844231DE6D077D5DF3DE005C770

Function 00007FF7F6744350 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744381
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F6744446
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F674449A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F67444A1

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7F6744352

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 80e07f2ec084bafb4c9b2edb4020a5aa9b86da915471fa139b76f77608c9046b
Instruction ID: 931603555d9987cd2b98f4bfff2462d61906abcf0c0395fb0dd0c314139387cb
Opcode Fuzzy Hash: 80e07f2ec084bafb4c9b2edb4020a5aa9b86da915471fa139b76f77608c9046b
Instruction Fuzzy Hash: 6131EA2270968584EF15FE2699282799259DB09FF4F940630CE3D17BDDDE7CE48293B0

Function 00007FF7F6787350 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F677C9C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7F6763D4F), ref: 00007FF7F677C9EE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F678740F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678745B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6787472
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678748B

Strings

Couldn't open file %s, xrefs: 00007FF7F6787439

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 7856573c67e4ecf729b0dc835e39a869844de092acf3b00592fb5aa2bffd79d6
Instruction ID: 683f2da5e57e92612c49e30062eb3f768828ebc49668d189754a834b9696c2d0
Opcode Fuzzy Hash: 7856573c67e4ecf729b0dc835e39a869844de092acf3b00592fb5aa2bffd79d6
Instruction Fuzzy Hash: 6741D222608AC581EB109F35E85022FEBA5FB89BD4FA84031DAAE476D4CF7CD8418771

Function 00007FF7F67666C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F676673E

Part of subcall function 00007FF7F6752E40: GetLastError.KERNEL32 ref: 00007FF7F6752E62
Part of subcall function 00007FF7F6752E40: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6752E6A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676675C
recv.WS2_32 ref: 00007FF7F6766787
WSAGetLastError.WS2_32 ref: 00007FF7F6766799

Strings

Recv failure: %s, xrefs: 00007FF7F67667C5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: 9f37ef25d2cbde7e44d61f655dfd075aa7a26731cbe2d316d942a178f3c2f71e
Instruction ID: 485776fe38da9cec976b68772fef999c22ade362ed586f0930c78c01f586f132
Opcode Fuzzy Hash: 9f37ef25d2cbde7e44d61f655dfd075aa7a26731cbe2d316d942a178f3c2f71e
Instruction Fuzzy Hash: E231AE76A05B4181EB10AF25ED602ABA3A8BB48FD8F904135DE2D077D8DE3CD455D7A0

Function 00007FF7F676D150 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676D245
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676D2A4

Strings

Connection died, tried %d times before giving up, xrefs: 00007FF7F676D208
REFUSED_STREAM, retrying a fresh connect, xrefs: 00007FF7F676D1DB
Connection died, retrying a fresh connect, xrefs: 00007FF7F676D22F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: Connection died, retrying a fresh connect$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1865132094-195851662
Opcode ID: b2f75524ccea4e637de733992f4f779450420ae890607c224c1569b4bb52aa83
Instruction ID: b78dfa045cd30fbf2ddd4ad2c5a57bb982031725011c27e547fbd8ea76d217f7
Opcode Fuzzy Hash: b2f75524ccea4e637de733992f4f779450420ae890607c224c1569b4bb52aa83
Instruction Fuzzy Hash: CA41E631B1CA82C1E754DB25E8603AAB794EB48B88F884131DB6D073D5CF7ED490CBA0

Function 00007FF7F6799D99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6799DC0
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

FALSE, xrefs: 00007FF7F6799DB5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: de3b3f800822c5a1ee2a18dac8cb532862dd517388c01c2709d3af70ce711eaf
Instruction ID: b313d7a68c49e54f18190e4ade1e2755cdf0d113c30b8443cd0c46d4c4449f19
Opcode Fuzzy Hash: de3b3f800822c5a1ee2a18dac8cb532862dd517388c01c2709d3af70ce711eaf
Instruction Fuzzy Hash: 32313822E0E69245FB13EB359D2437ABBD85B5A764F980631C9BA016D1EE3DD082C370

Function 00007FF7F6781710 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678174B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6781791
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67817F6

Strings

RCPT TO:<%s>, xrefs: 00007FF7F67817DB
RCPT TO:<%s@%s>, xrefs: 00007FF7F67817CD

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: e8bf0f1166062040c79a1d659e28989542820538a677ba05d44a4a9e570ddb35
Instruction ID: 58963fc784a27419663c6a27aad3a89cfabfe9180c413f47fea449b5b264d7cd
Opcode Fuzzy Hash: e8bf0f1166062040c79a1d659e28989542820538a677ba05d44a4a9e570ddb35
Instruction Fuzzy Hash: 6B31CA62A1CB8681EB01DB25E8502BAE3A4FB99F90F984335DA6D037D5DF7CD501C760

Function 00007FF7F6799640 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679966D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6799B36

Strings

TRUE, xrefs: 00007FF7F679965B
%s: %s, xrefs: 00007FF7F6799B21
FALSE, xrefs: 00007FF7F6799662

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 3825d031a93768815eb6b5328640b0091a31a05f0c4b0cbf60904bbfdb54b7ed
Instruction ID: f83bccc08f13f5ce36b0d90856be1b3ab7a804c2c3e582911948578b29368e0d
Opcode Fuzzy Hash: 3825d031a93768815eb6b5328640b0091a31a05f0c4b0cbf60904bbfdb54b7ed
Instruction Fuzzy Hash: 46018251A08782C1FB60AB16AC203A7A3A4AB09B80FC84031CE6D033D6EF2CE145C3B1

Function 00007FF7F678237B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6782430

Strings

control connection looks dead, xrefs: 00007FF7F6782622
Remembering we are in dir "%s", xrefs: 00007FF7F67824C8
ABOR, xrefs: 00007FF7F678252B
Failure sending ABOR command: %s, xrefs: 00007FF7F6782551

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: be9a38051f2161b3db7cc7e844ed7f2beca6a4246db6e062d6f1a9b834a90101
Instruction ID: e5b5e9dc40e6b96a79a573c7f3a3e982b02c7f74b4b35c5398dfd861b22281d6
Opcode Fuzzy Hash: be9a38051f2161b3db7cc7e844ed7f2beca6a4246db6e062d6f1a9b834a90101
Instruction Fuzzy Hash: BE51C561A0C78285E764F63099703BBA258BB49B64FD00235DA7D076D6DF7DE88183F1

Function 00007FF7F679A675 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A6B8
memcpy.VCRUNTIME140 ref: 00007FF7F679A6DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

TRUE, xrefs: 00007FF7F679A809

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: c025a0c3dc1ec3e80a8e52a6cec06fdbfe740c0ae21a7d2b85079ddef5b95d9f
Instruction ID: abbf9b008c177072ac2ad05b650d2b7d6d326e82926bc3294bd4075db254f28c
Opcode Fuzzy Hash: c025a0c3dc1ec3e80a8e52a6cec06fdbfe740c0ae21a7d2b85079ddef5b95d9f
Instruction Fuzzy Hash: 44418C61B1A69241FB0596398D35376B7E6EB197E0F844635CA7E433C9ED6CD081C3B0

Function 00007FF7F679DF20 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7F679DEE0), ref: 00007FF7F679DF8F

Part of subcall function 00007FF7F6778240: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F675B26A,?,?,?,?,?,?,?,00007FF7F675B037), ref: 00007FF7F6778251

Part of subcall function 00007FF7F6778240: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7F67783F3
Part of subcall function 00007FF7F6778240: strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7F6778410

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7F679DEE0), ref: 00007FF7F679DFFE
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7F679DEE0), ref: 00007FF7F679E018
strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,00000000,00007FF7F679DEE0), ref: 00007FF7F679E04E

Strings

xn--, xrefs: 00007FF7F679E035

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$_errno
String ID: xn--
API String ID: 2644425738-2826155999
Opcode ID: 3a6b1145198a3fd0865864d78e7b62c04439682efdea46383549bedd37ad973c
Instruction ID: c6130accb277aa88e94fc71b6c82d3d4895dbce52632be4940757616fe0b79fe
Opcode Fuzzy Hash: 3a6b1145198a3fd0865864d78e7b62c04439682efdea46383549bedd37ad973c
Instruction Fuzzy Hash: 6341B051B1C68245FB54B6358D243BBD2CAAF49BC0F988134DE6E877C2EE2DE44183B0

Function 00007FF7F676C010 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F676C0B8
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676C138
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676C1E2

Strings

allocate connect buffer!, xrefs: 00007FF7F676C15F
CONNECT phase completed!, xrefs: 00007FF7F676C223

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: callocfreememset
String ID: CONNECT phase completed!$allocate connect buffer!
API String ID: 3505321882-591125384
Opcode ID: 5583faf6e005cd107dec4d3bac618da173c31701fa176c289d6e4ea17e0dfae9
Instruction ID: c7510df08bd70968351481d758ce30392ce89b4149124bef236289dfb7e594fe
Opcode Fuzzy Hash: 5583faf6e005cd107dec4d3bac618da173c31701fa176c289d6e4ea17e0dfae9
Instruction Fuzzy Hash: D5518761B08682C2E719AB15DD643BAB3A8FB49784F844035CB6C072D5DF7AE565C3B0

Function 00007FF7F677ED90 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F67780E0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6778101

memcpy.VCRUNTIME140 ref: 00007FF7F677EF01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677EF0F

Strings

Found %I64d bytes to download, xrefs: 00007FF7F677EE62
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF7F677EECD
Failed to parse FETCH response., xrefs: 00007FF7F677EDEE

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: ea9be0aaf75f8c8767959a99ab3c0081047d4b67f84ae8826110748a631f1350
Instruction ID: d30df3d79731f99f9e5c7d92a912bcbc32b0fe38b8bee86eb98df324ab5786ad
Opcode Fuzzy Hash: ea9be0aaf75f8c8767959a99ab3c0081047d4b67f84ae8826110748a631f1350
Instruction Fuzzy Hash: 5B51A262A1C7C682EB54AB25D8202BBE368FB49784FD44032DA6D03AD5DF7CE45187B0

Function 00007FF7F679885E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 7e941dfaf5f8a2d93b432d2b7afcc53c8c33386750d809cd1a2bcc3477fb2b98
Instruction ID: 206410ae72db56319dc8d188cce09e92029811428a3ba16dfa94392700aad2ad
Opcode Fuzzy Hash: 7e941dfaf5f8a2d93b432d2b7afcc53c8c33386750d809cd1a2bcc3477fb2b98
Instruction Fuzzy Hash: 4C21A262B08AC285EB109B25E8542FBA3A4FB49BD4F884532DE6D577D5EF3CD101C760

Function 00007FF7F67828D0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678299B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67829B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67829C8

Strings

QUIT, xrefs: 00007FF7F67828FF
Failure sending QUIT command: %s, xrefs: 00007FF7F6782923

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 807ef8fa226970ae5b9040265797cb9f53c43fdafe48f57b89e976fbdb420d33
Instruction ID: f69d1f45aa192dff7093c512c2c2e6231069dd674de79a823157ab09ac7ca274
Opcode Fuzzy Hash: 807ef8fa226970ae5b9040265797cb9f53c43fdafe48f57b89e976fbdb420d33
Instruction Fuzzy Hash: EB317231A1878281EB50EF3599603BAB3A8FB4AF84F944131DA6D07695DF2CD451C3F0

Function 00007FF7F67794D0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F67658B0), ref: 00007FF7F6779505
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F67658B0), ref: 00007FF7F677951A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F67658B0), ref: 00007FF7F677952F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F67658B0), ref: 00007FF7F677955C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F67658B0), ref: 00007FF7F6779565
memcpy.VCRUNTIME140(?,?,?,00007FF7F67658B0), ref: 00007FF7F6779599

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 551880f0cf651d9d3cd7b3d72f1750254fa78b1a94682acab546ab4d6fd1212c
Instruction ID: fff50949f98d96933bd38e556cd4b7a77f53130c3bea68a7f04d9158c3b71513
Opcode Fuzzy Hash: 551880f0cf651d9d3cd7b3d72f1750254fa78b1a94682acab546ab4d6fd1212c
Instruction Fuzzy Hash: 9021E76191978386E7109F15A82023AB7A4FB4DB94F844234DABD177D5DF3CD4408360

Function 00007FF7F6788740 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6788771
strchr.VCRUNTIME140 ref: 00007FF7F678879D
strchr.VCRUNTIME140 ref: 00007FF7F67887B4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F67887D3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: ac77d55da153c51ce4b0da4844e3ee0dc72817ed75bc1a3428b20dbaeaf331c7
Instruction ID: bcda80ecd7c8ef0ad8fe2621e2460cfdfb5ae6a7316cc7a74b120132665be0a4
Opcode Fuzzy Hash: ac77d55da153c51ce4b0da4844e3ee0dc72817ed75bc1a3428b20dbaeaf331c7
Instruction Fuzzy Hash: 4B219262B15B8681EB81DB25D8603A9A3E4FB89F84F480134DE2D4B789EF39D491C770

Function 00007FF7F6797D24 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797D5F
memcpy.VCRUNTIME140 ref: 00007FF7F6797D85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6797EC9

Strings

Start Date, xrefs: 00007FF7F6797E9D
Start Date: %s, xrefs: 00007FF7F6797EB7

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 3cac47918bbe22a3064b11e21b76c3d374301543d4bb7f4bdd617f3bd592a610
Instruction ID: 8e2868d5a310eae24897a1e0475bf5aa5a19abfaa33410b7e369c5a0e11a4613
Opcode Fuzzy Hash: 3cac47918bbe22a3064b11e21b76c3d374301543d4bb7f4bdd617f3bd592a610
Instruction Fuzzy Hash: C421E051A0868280EF14AB218D242F6E3DAAF1DBD4FC88931C93D077E5EE2DA44483B0

Function 00007FF7F67985F8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 0524c1bf4175a93633869f3fc57a9e9334e9eb6c4924e45b541d7c896293409d
Instruction ID: b0b38924736b13eacb6afb08cde3f7fb7c57971c766f3671d7a78ee5a1e2f9b5
Opcode Fuzzy Hash: 0524c1bf4175a93633869f3fc57a9e9334e9eb6c4924e45b541d7c896293409d
Instruction Fuzzy Hash: D2216762A0968285EB54AB25E8642BBE3A8FF4D7C4F840831DE6D17795EE3CD041C7B0

Function 00007FF7F6798636 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6799140: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679918C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 0e76b6a316340a42a1bc527b4a0993da5b2c0cb114230e1b1a20d8241241b9a3
Instruction ID: 8ed978801b3cfaf086711aa5dc1f95dfb4ad06ad3054346754bdececf235207d
Opcode Fuzzy Hash: 0e76b6a316340a42a1bc527b4a0993da5b2c0cb114230e1b1a20d8241241b9a3
Instruction Fuzzy Hash: 76214462A0868285EB50AB25E8642EBA3A8FF497C4F840432DE5D17795EE3CD001C770

Function 00007FF7F6798610 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F679AC50: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679AC85

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6798A8C

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

Signature: %s, xrefs: 00007FF7F6798A27
Signature, xrefs: 00007FF7F6798A0F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 7e4034373774d43b519a8af8c2c682e0bc05bde0d65ec1908a57987c2b653275
Instruction ID: b21912066a245731e9ff51c0d3e7ac967e1bc60bd77aba276b96a9b766409174
Opcode Fuzzy Hash: 7e4034373774d43b519a8af8c2c682e0bc05bde0d65ec1908a57987c2b653275
Instruction Fuzzy Hash: 63215662A0868285EB50AB25E8642FBE3A8FF497C4F840432DE5D17795EF3CD001C770

Function 00007FF7F675B540 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7F675B9E3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7F675B9F7
CloseHandle.KERNEL32 ref: 00007FF7F675BA04
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7F675BA26
closesocket.WS2_32 ref: 00007FF7F675BA44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7F675BA5D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 059db627849e2e226bb10930d3277cc3b65913901b4ea62fb5c050b9fbc6cc93
Instruction ID: 87e3e16e93a3e7281b4fbc0e7faa4efbc0837efaffa8e2c4992c25b75d91faf9
Opcode Fuzzy Hash: 059db627849e2e226bb10930d3277cc3b65913901b4ea62fb5c050b9fbc6cc93
Instruction Fuzzy Hash: 0711F136608B41C6E710AF12E56023AB374FB4DB90F544131DFAD03B95DF39E8659760

Function 00007FF7F6753580 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7F6752EB9), ref: 00007FF7F675381F

Strings

No data record of requested type, xrefs: 00007FF7F6753803
Host not found, xrefs: 00007FF7F67537E8
Unrecoverable error in call to nameserver, xrefs: 00007FF7F675380C
Host not found, try again, xrefs: 00007FF7F6753815

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 1ff2dce18e257e774129ac5e1c4637ee97025658beddbabc7998c3cc9fc065be
Instruction ID: e9fa82b19170653ddc7a6a76d503ca376a2288d6dab12029ebb062e81cbe31d3
Opcode Fuzzy Hash: 1ff2dce18e257e774129ac5e1c4637ee97025658beddbabc7998c3cc9fc065be
Instruction Fuzzy Hash: C6113D51E1C18290EB1D6B14ED7417A9698EF0C750FC84070C62E467F9ED6CFC8083B1

Function 00007FF7F67760D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00007FF7F6776422

Strings

%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 00007FF7F677616B
%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 00007FF7F67763B5
** Resuming transfer from byte position %I64d, xrefs: 00007FF7F6776158

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 497872470-664487449
Opcode ID: c95acca9036dcc247727338940155616288281e00d77431897b59486f692ae5b
Instruction ID: c57340b4af0430a2a04e70f480e36addaa659cfd15dcd048dfd737295ac7b396
Opcode Fuzzy Hash: c95acca9036dcc247727338940155616288281e00d77431897b59486f692ae5b
Instruction Fuzzy Hash: 4591B22161AB8685DA60EB15E9587ABA368FB88BC4F811031DE6D47B99EF3CD001D750

Function 00007FF7F67830F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 120networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F679AE40: memcpy.VCRUNTIME140 ref: 00007FF7F679AEE8
Part of subcall function 00007FF7F679AE40: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679AEF9

WSAGetLastError.WS2_32 ref: 00007FF7F678325A

Strings

FTP response timeout, xrefs: 00007FF7F67832A7
We got a 421 - timeout!, xrefs: 00007FF7F678327E
FTP response aborted due to select/poll error: %d, xrefs: 00007FF7F6783268

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 1248052217-2064316097
Opcode ID: fa6a4d64733e03c5ed3c8d8a01dfbba4641c5a4f74dbedc3fe6745e7767d25cd
Instruction ID: 6875674cd279a62bbdb05315857120dad01437011f790d9636d1aa65d8d958aa
Opcode Fuzzy Hash: fa6a4d64733e03c5ed3c8d8a01dfbba4641c5a4f74dbedc3fe6745e7767d25cd
Instruction Fuzzy Hash: 4F41A921A0864285F760EE799C103BBA398BB4DF94F984131DE6D873D5EE3CD84587B0

Function 00007FF7F679A335 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A35B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

TRUE, xrefs: 00007FF7F679A809
FALSE, xrefs: 00007FF7F679A350

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: f1a68c5537dbf8c23db2369df14daea5e9d1e5d646dd923bf12f28056a1744cf
Instruction ID: daf3dcc086124ed1595b41dc9999deaab141082d22c1d622d8f186996496d6a1
Opcode Fuzzy Hash: f1a68c5537dbf8c23db2369df14daea5e9d1e5d646dd923bf12f28056a1744cf
Instruction Fuzzy Hash: AA411A55B0A35684FF159A359C2027AA7E9AB0A795F884632CE6E073C5FE2DE0418370

Function 00007FF7F678C380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7F678C3C1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7F678C400
WSAGetLastError.WS2_32 ref: 00007FF7F678C458

Strings

TFTP response timeout, xrefs: 00007FF7F678C41A

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: bad9c33546a407fec38eb90579f1c035f618f46276d5925fabfde9c3533044e3
Instruction ID: c6d43a7e25236498245d4a176703d290f054bf44cf3c9cc880ec7e5e2a253218
Opcode Fuzzy Hash: bad9c33546a407fec38eb90579f1c035f618f46276d5925fabfde9c3533044e3
Instruction Fuzzy Hash: 0E41932261864185E760AF35EC246BAA764FB8CBA4F944231DE3D477D9DF3CD84187B0

Function 00007FF7F6799DCE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

%s%lx, xrefs: 00007FF7F6799E38

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: 388810033930dfc79d928e8b47dceac9b35a50cafe639a047c11366d6d893bc1
Instruction ID: b7e057ac99b6ca629926ed41a4569f4c71f3f2bd905ff63332c73adcb31087ed
Opcode Fuzzy Hash: 388810033930dfc79d928e8b47dceac9b35a50cafe639a047c11366d6d893bc1
Instruction Fuzzy Hash: A5312611E0E1D249FB12EB358C7437ABBD99B5E741F984531C5AE02AD2EE2ED041C3B0

Function 00007FF7F679A0AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A273
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A287
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A2EE

Strings

TRUE, xrefs: 00007FF7F679A24D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: isupper$free
String ID: TRUE
API String ID: 573759493-3412697401
Opcode ID: a6fba0571c3b23f939b7e82bf09c7321e34b42d1c1305e4c2d75dcd762ed15e1
Instruction ID: 6b96004682ea7faaf31efe336400a298997b7482b07adf2417fa5b8613e6226d
Opcode Fuzzy Hash: a6fba0571c3b23f939b7e82bf09c7321e34b42d1c1305e4c2d75dcd762ed15e1
Instruction Fuzzy Hash: CE312B21A0D59245F701DB35992437ABFD5A70AB94F884231C6BE42AD5DF3DD141C370

Function 00007FF7F6766430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766555
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7F6766570

Strings

..., xrefs: 00007FF7F67664D8
..., xrefs: 00007FF7F67664C2

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: 8108603736209bb098f9a9e31943748ac7ad89f18f806ab5dd93ef5962823fb4
Instruction ID: aff8d3901558a6fc5c6a6e13e253adc7ef0da96f5cb5a98f22a16c4a97d69ae7
Opcode Fuzzy Hash: 8108603736209bb098f9a9e31943748ac7ad89f18f806ab5dd93ef5962823fb4
Instruction Fuzzy Hash: 2B31C321A08A8181EB60EB11D8247FBA7A5FB88B94FC44131CA6D037D5CF3ED555C7E1

Function 00007FF7F6782ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF7F6782F22
accept.WS2_32 ref: 00007FF7F6782F41

Part of subcall function 00007FF7F67755D0: ioctlsocket.WS2_32 ref: 00007FF7F67755E9

Strings

Error accept()ing server connect, xrefs: 00007FF7F6782F5E
Connection accepted from server, xrefs: 00007FF7F6782F6F

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-2331703088
Opcode ID: e6968442e24d414e7df2a505c6a3c38eb1f75961d075d8d18ba77aea0e8e6f0d
Instruction ID: c4dcf596a2e377c6e7ed2409fd1138049a0bd0dfec7f8e507f24c640fed431a4
Opcode Fuzzy Hash: e6968442e24d414e7df2a505c6a3c38eb1f75961d075d8d18ba77aea0e8e6f0d
Instruction Fuzzy Hash: B731C22160C68181EB54EB21A9243ABB3A8FB4CBA4FD40231DA7D077D5DF7DE505CBA0

Function 00007FF7F677E820 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF7F677E8A7
%s%s, xrefs: 00007FF7F677E853

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 24136d207ae102c5ea7ef9a2db057a650322fa4e370001de2a68ccbc906af9fe
Instruction ID: 64bc0094032dc3159e757bec90789044583da95d17434214281dfac0f154b03c
Opcode Fuzzy Hash: 24136d207ae102c5ea7ef9a2db057a650322fa4e370001de2a68ccbc906af9fe
Instruction Fuzzy Hash: 55116021E1874281EB15AF59E8601BAA364BB4CBC4F845531DE2D077A5DF2CE58583B0

Function 00007FF7F6754DD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6754CE2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6754CFE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6754D1B

Strings

:, xrefs: 00007FF7F6754CD6

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: 701d1b398b1993d91f495c10ed7512d9c4404652cc60f658269a2a9ff914048b
Instruction ID: 7851180d65aa8ef96e4ee65a613dd7f745f1e89883bb2ce4216327896c8fc72f
Opcode Fuzzy Hash: 701d1b398b1993d91f495c10ed7512d9c4404652cc60f658269a2a9ff914048b
Instruction Fuzzy Hash: 7C115432A09B8685EB619F15E9103A6B3A4AB89750F944131CFBD437DCEF3CD8558770

Function 00007FF7F678ADD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7F678AE0D
WSAGetLastError.WS2_32 ref: 00007FF7F678AE17

Strings

Sending data failed (%d), xrefs: 00007FF7F678AE1D
SENT, xrefs: 00007FF7F678AE32

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 98a7d7a251e3052cc762b497f2e48137b1bd5726523e44b18bfb68837d2e112f
Instruction ID: becdf3cc09dc3c2eae66e327bc33ed90cfa97b22b3fa638508e10deceb796f52
Opcode Fuzzy Hash: 98a7d7a251e3052cc762b497f2e48137b1bd5726523e44b18bfb68837d2e112f
Instruction Fuzzy Hash: E201D222708A92C1DB109B2AE85045ABB24FB88FC4B994171DB6D43B65DE39D541C7E0

Function 00007FF7F6771EE0 Relevance: 6.3, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6771F18
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6771F21
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6771F9A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6771FAB
memcpy.VCRUNTIME140(?,?,00000000,00007FF7F67722F5), ref: 00007FF7F6771FD4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 9a784d6129e5b36e527808a1feb78dde24a39c20fac065423d1946ba5f9cea45
Instruction ID: fcf5fd613ef7f9e5948c693f4e41fe499dee44308ccf2c8a4e4ffcedb572bc00
Opcode Fuzzy Hash: 9a784d6129e5b36e527808a1feb78dde24a39c20fac065423d1946ba5f9cea45
Instruction Fuzzy Hash: CD31602161AB4581EB10AF11E82036AA2A8AB19BD4F880631EE7D477D9DF3CD441C7A0

Function 00007FF7F676B0F0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676B210
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676B256
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676B2B8

Strings

chunked, xrefs: 00007FF7F676B16E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: calloc$free
String ID: chunked
API String ID: 171065143-1066005980
Opcode ID: 2e14a48d677b6cb63ff9c65bcbc64d1f64e2529bf2d7316cee8101d75cf86319
Instruction ID: a65ad526e7d5f0f55b12afb49e4c186f20bc5f29a8436bbcd80979034fdc773d
Opcode Fuzzy Hash: 2e14a48d677b6cb63ff9c65bcbc64d1f64e2529bf2d7316cee8101d75cf86319
Instruction Fuzzy Hash: 2351C621A0869295EB55AB119D6037BA3D9AB0FFC4F884030DE7C437D5EF2DE46583B0

Function 00007FF7F679A4EF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

GMT, xrefs: 00007FF7F679A59E
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F679A611
TRUE, xrefs: 00007FF7F679A809

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 175b8fed516aa4291b1f46da496cdeccca5547fd3abd262188f1c2dcfda0c20d
Instruction ID: ecf6b24c203a789e8f38f32cb59f7cb3cb2c9cef19b808cdd7b09c67bee9c1fe
Opcode Fuzzy Hash: 175b8fed516aa4291b1f46da496cdeccca5547fd3abd262188f1c2dcfda0c20d
Instruction Fuzzy Hash: AC51C661B0969644EB119B35AD2417AF7E9AB09784FD48032DA6D077D4EF3CD581C3B0

Function 00007FF7F6799800 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6799B36

Strings

GMT, xrefs: 00007FF7F67998BE
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7F679992A
%s: %s, xrefs: 00007FF7F6799B21

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: 2d567fc7870b19634a2cbb62e17730c428280785e8b13154c206ba112d2b15db
Instruction ID: 327a56b812ff879a04eadf5d3c8a824bca9cbfc3b4480797f04626be38578d79
Opcode Fuzzy Hash: 2d567fc7870b19634a2cbb62e17730c428280785e8b13154c206ba112d2b15db
Instruction Fuzzy Hash: 9441C861A0C6D185FB649B2598246BAE7D8EB09790FC84035CA6D037D6EF3CE446C370

Function 00007FF7F674D5C0 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F674D1D8), ref: 00007FF7F674D69E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F674D1D8), ref: 00007FF7F674D6CC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F674D1D8), ref: 00007FF7F674D735

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F674D742

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: e313eb31bb9c36e5e7182acaf55df2307521fd66a11ad611a39392af3f5df12e
Instruction ID: f34a9ca7b19e8e39b68a326ea88892a2a996e29254a26eb17fcc89db61a2fbd4
Opcode Fuzzy Hash: e313eb31bb9c36e5e7182acaf55df2307521fd66a11ad611a39392af3f5df12e
Instruction Fuzzy Hash: D441A26270D685C5EB15AF25D92827AB369BB48BE4F944735CBBD037C4EF2CE0518360

Function 00007FF7F674F060 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F674F16F

Part of subcall function 00007FF7F679FB48: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7F674442E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7F6741B89), ref: 00007FF7F679FB62

memcpy.VCRUNTIME140 ref: 00007FF7F674F15C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F674F1DD
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F674F1EA

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 1e9ebfaffefdbeffb0c650a7ee0079e5ade564a83bb1e0c2e599b6bd42ae2091
Instruction ID: a468c43073da007126d0c7a9adcc0ef6a2f2b3fb1a046d42cd4fc16ad8abb898
Opcode Fuzzy Hash: 1e9ebfaffefdbeffb0c650a7ee0079e5ade564a83bb1e0c2e599b6bd42ae2091
Instruction Fuzzy Hash: 6141B562719AC5C1EE04EB25D9682AEA364AB48BE0F944635CA7D077D4DF3CE091C360

Function 00007FF7F67507C0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F67508A0
memcpy.VCRUNTIME140 ref: 00007FF7F67508CD
memcpy.VCRUNTIME140 ref: 00007FF7F67508DC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F675090E

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: f57466c40c565452301723b37a3341091d7968150f5e4cfc42a57b952f741096
Instruction ID: bb0a63eab7ccac3bf94023bd3cc2b9ff436d9eec80f6f4f00d868bbbe4619d3b
Opcode Fuzzy Hash: f57466c40c565452301723b37a3341091d7968150f5e4cfc42a57b952f741096
Instruction Fuzzy Hash: B231C621A19B4181EB10AB12A95466BA298BB08BE0F944635DEBD07BD5DE3CF49183A1

Function 00007FF7F679B170 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF7F677D31B), ref: 00007FF7F679B1CE

Strings

%s, xrefs: 00007FF7F679B1A4

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 352856b1eae17858e1b077f2ee5fd32b90ad45b0c77a443594dcac492bc27cdb
Instruction ID: 28b56445cf80b5fb75e1a9007b468523f7029c5e0cf252d5dec72a6d95379c2d
Opcode Fuzzy Hash: 352856b1eae17858e1b077f2ee5fd32b90ad45b0c77a443594dcac492bc27cdb
Instruction Fuzzy Hash: 60416332618B8582D750DB15B8501ABB7A8FB99B90F540135DFAE03BA5EF3CE491C360

Function 00007FF7F679B5B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF7F677EB60,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF7F679B603
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679B68C

Strings

%s, xrefs: 00007FF7F679B5D5

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: ab711b374cce4f61b9c1c04fbc7c9437e1ddaaeae5eb021ca5eae824c80ea905
Instruction ID: 62ace78b5c91ca0ff5aa8cdd43c2b3adf299764182bbedd4332f783feb245925
Opcode Fuzzy Hash: ab711b374cce4f61b9c1c04fbc7c9437e1ddaaeae5eb021ca5eae824c80ea905
Instruction Fuzzy Hash: CB417422618B8582E710EB25B85016BB3E4FB89B90F544135DFAD07BA5EF3CE091C760

Function 00007FF7F6744D90 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F6744E6F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F6744EAC
memcpy.VCRUNTIME140 ref: 00007FF7F6744EB6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7F6744EE3

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: e520eb792d9bd2cddaf205114843ce8f76967c4b6129fc21578506071090eed2
Instruction ID: b1c3c62289d4f81f7ce98dd29533263f692b4cd9420c4fef1acf414a3e97266d
Opcode Fuzzy Hash: e520eb792d9bd2cddaf205114843ce8f76967c4b6129fc21578506071090eed2
Instruction Fuzzy Hash: 9831F72170D79195EF14EB26995826AE359EB08BE0F940730DE7D07BDDCE7CE0519360

Function 00007FF7F679A435 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

GMT, xrefs: 00007FF7F679A489
TRUE, xrefs: 00007FF7F679A809
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F679A4DB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 6c645be8e5b1f5d6d945d0e325e0d0960cc81af97aaf99509a56fb7c7365217d
Instruction ID: 951140c30c088372b4ef67679005e4c9a197ec07d681234b6a8dc66d9d0e0454
Opcode Fuzzy Hash: 6c645be8e5b1f5d6d945d0e325e0d0960cc81af97aaf99509a56fb7c7365217d
Instruction Fuzzy Hash: 1E31EA22A09B8684EB10DB75D9141AAB7E9F749790FC44031CA6D037D5EF3CD151C3B0

Function 00007FF7F6799745 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6799B36

Strings

GMT, xrefs: 00007FF7F6799799
%s: %s, xrefs: 00007FF7F6799B21
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7F67997E9

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: f3e28e3f91499ebf32120d26d22ad79634019ec5771c8a1804892b3f14b7e7f3
Instruction ID: b33aab683f2e2138f2281d5240db66c1eb2d476c73bfe058ca05f08e715cf40b
Opcode Fuzzy Hash: f3e28e3f91499ebf32120d26d22ad79634019ec5771c8a1804892b3f14b7e7f3
Instruction Fuzzy Hash: 31318461A08BC294F7609F65D8606EAA3A8FB4D781FD84032CA6D072D6EF7DD545C3B0

Function 00007FF7F679A67D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A6B8
memcpy.VCRUNTIME140 ref: 00007FF7F679A6DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

TRUE, xrefs: 00007FF7F679A809

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: acf237168278095a5ad18c07f63b861f156cdde06034463f095727a3b20c5360
Instruction ID: 80f60c93c3004f676aef6f3d938857342ab4a16f1d0c3fff62aabafdfafbeba1
Opcode Fuzzy Hash: acf237168278095a5ad18c07f63b861f156cdde06034463f095727a3b20c5360
Instruction Fuzzy Hash: 42210565B0A74640FF019B269D20376A3AAAB19BE4F944532CD3D037C8EE3CE08183B0

Function 00007FF7F6782DF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6782E0D
strstr.VCRUNTIME140 ref: 00007FF7F6782E4C
strstr.VCRUNTIME140 ref: 00007FF7F6782E64

Strings

;type=, xrefs: 00007FF7F6782E3F, 00007FF7F6782E5D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 83f9003945630041e6858e660da5d42b8c1988889c996b83a9ca53f0be40fe01
Instruction ID: 99c987e73bc6b83a73dcc818f9379c3b3ec7f0650b5b3f3ebaa774cbe6e099e2
Opcode Fuzzy Hash: 83f9003945630041e6858e660da5d42b8c1988889c996b83a9ca53f0be40fe01
Instruction Fuzzy Hash: 8821F73150868281E7149B35E9543AAB7A4FB58B84F884131DBBD077C5DF3CE49183B0

Function 00007FF7F677C880 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8A8
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8CE
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C8EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F6760DF9,?,?,?,?,00007FF7F676019B), ref: 00007FF7F677C900

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 5919ed26601e5a1983441ff13bfa5010129d55b5ebbfabf283f15f6243ff0c7b
Instruction ID: ac9439b761adf7868ccf1c2f36c2219a82ce9c24e71cfaeae1ee6ae88170670b
Opcode Fuzzy Hash: 5919ed26601e5a1983441ff13bfa5010129d55b5ebbfabf283f15f6243ff0c7b
Instruction Fuzzy Hash: 41118A21B1D74285E760AB16695023BE1A9FF5DBC4F580035DEAD43BD5DE3CD44087B4

Function 00007FF7F67722A0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67722FA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F677231A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6772323

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF7F67722B0

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 940235ba96ecd116c11ce8e31b952d266a1eb65064ca4e9b5e6f911fc8cbd765
Instruction ID: 3740555f810f11c094bafc3bf56e3a108bee66018cf465926026ec8b16e588ce
Opcode Fuzzy Hash: 940235ba96ecd116c11ce8e31b952d266a1eb65064ca4e9b5e6f911fc8cbd765
Instruction Fuzzy Hash: 1701C462B1464182FB15AB55BD603AAA294AF59BE0F444230DEB9077D5DF3C9885C3B0

Function 00007FF7F677D820 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7F677D203), ref: 00007FF7F677D8F2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7F677D203), ref: 00007FF7F677D943

Strings

(){ %*], xrefs: 00007FF7F677D83D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: bdd1c43b3494f96c2aad5221c01ac2cadb3a7930ebfd7d110b4e8fbb3137c04d
Instruction ID: eb1bc6e9b8b7fbe0c1caf4674e11ddbc198239d81b4061430a353ea62b38bad1
Opcode Fuzzy Hash: bdd1c43b3494f96c2aad5221c01ac2cadb3a7930ebfd7d110b4e8fbb3137c04d
Instruction Fuzzy Hash: F931481191C68684FB616B255870377ABC5DFAE754FC84330DAAE032C6CE1DA40586B1

Function 00007FF7F678F09F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F678F195
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678F1F7

Strings

%ld, xrefs: 00007FF7F678F0CC

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: %ld
API String ID: 1865132094-1112595699
Opcode ID: 8466dd995ef6cc7ee2963ef660399adda1b82d207d892cd0f1e4e7a24164cfab
Instruction ID: b45b05cc280de2c047add9c2db787cb99358125c83fa6ee14240edd9d3c7d536
Opcode Fuzzy Hash: 8466dd995ef6cc7ee2963ef660399adda1b82d207d892cd0f1e4e7a24164cfab
Instruction Fuzzy Hash: 94319372E09AC281FB65EB64D87437BA299BF48B94F954031C96D036C5EE2CE844C7B0

Function 00007FF7F676AFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F676B039
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F676B0D2

Strings

identity, xrefs: 00007FF7F676AFF4, 00007FF7F676B063, 00007FF7F676B0CB

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupmalloc
String ID: identity
API String ID: 3515966317-1788209604
Opcode ID: 595691c1025c69a5a6e6f5a3209642cedb3fc84d5119c0a71d3fa7417d96b739
Instruction ID: ba3b35e7df7fef52e4b669af3162e233e8ff3c58b0f404e976eb244a834958fa
Opcode Fuzzy Hash: 595691c1025c69a5a6e6f5a3209642cedb3fc84d5119c0a71d3fa7417d96b739
Instruction Fuzzy Hash: B831A121E19A46C1EB419B15D960367ABA4EF5AFA4F884231CE3D037D5EF2DD45183B0

Function 00007FF7F6769630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6769650
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67696AB

Strings

, xrefs: 00007FF7F6769663

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: a2ff660f8911486f5e09a836224ee4278f170a739adc915ed60c233465fbcead
Instruction ID: bfb591ab8b0a11d7fc8c3c9429be0bde3f04468b58643d8f44919d725f72fedd
Opcode Fuzzy Hash: a2ff660f8911486f5e09a836224ee4278f170a739adc915ed60c233465fbcead
Instruction Fuzzy Hash: 6E11B172609B82C1DB449F16E51026AB3A4FB08FD4F844135EE6E07799EF39D490C3A0

Function 00007FF7F6765E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6765E45
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F6765E6C

Strings

%I64d-, xrefs: 00007FF7F6765E57

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: fd25e5e2079d766e7d45def979497dd31f2c776d6472fa23e50be1d168c7e315
Instruction ID: cf6e6bdc8d4508f92834f1f2c04566628dbe1fdd669ac791cd0c09a17111c51d
Opcode Fuzzy Hash: fd25e5e2079d766e7d45def979497dd31f2c776d6472fa23e50be1d168c7e315
Instruction Fuzzy Hash: C211E572A06682C1FF149B64CC653F663A5FF6CB48F5C0035C92C4E2A6DF2E54969370

Function 00007FF7F679A408 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679A40F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F679A7FF

Strings

TRUE, xrefs: 00007FF7F679A809

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: be029bd6a1667cbe2f6cba47e9e4bccf039cfda38148d3da651511633063af34
Instruction ID: f24454dbe7806006d83a8c3fa0cc250b07a19d7d95816b64110e5a4f98127a72
Opcode Fuzzy Hash: be029bd6a1667cbe2f6cba47e9e4bccf039cfda38148d3da651511633063af34
Instruction Fuzzy Hash: 4B019B66A0A65644FB02DB35DD2127A67A9B709BD4F844431CE2D073D9EE7CD081C370

Function 00007FF7F6799718 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F679971F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6799B36

Part of subcall function 00007FF7F6760B80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6760BD2

Strings

%s: %s, xrefs: 00007FF7F6799B21

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: e8e740b37246a4764d6c3ce1eb164d90d97fc3f94e3ec7d35f47fa24bbdef41c
Instruction ID: 3c41f237ee1433b5c237330771d22cdc304fc5753425f002686161f072580ac1
Opcode Fuzzy Hash: e8e740b37246a4764d6c3ce1eb164d90d97fc3f94e3ec7d35f47fa24bbdef41c
Instruction Fuzzy Hash: 4FF03151A0D682C1FB65AB16AC217E792A4AB4DBC4FC84431CE6D077D6AE2CD1468770

Function 00007FF7F675C540 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F6756097
Part of subcall function 00007FF7F6756070: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F6760670,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7F67524A1), ref: 00007FF7F67560A3

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C576
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C586
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F675C594
memset.VCRUNTIME140 ref: 00007FF7F675C5CF

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: eaa7c906f893e631f80e24afcd7594a9ff7dc79e7c09c795ab08258e7351f13f
Instruction ID: eada3882cad839b493a8d93e93bc7f198f4594b53071b6e4ca3177f85c1526e9
Opcode Fuzzy Hash: eaa7c906f893e631f80e24afcd7594a9ff7dc79e7c09c795ab08258e7351f13f
Instruction Fuzzy Hash: 09212A32E14B9193E304DB22DA503A9A364F7AA744F509226EBAD03A65DF74F1F1C350

Function 00007FF7F679B750 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F677D5D3), ref: 00007FF7F679E6E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F677D5D3), ref: 00007FF7F679E705
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F677D5D3), ref: 00007FF7F679E71F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F677D5D3), ref: 00007FF7F679E72D

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4dc756646f465d19538aa0d0ebc42b3fd6a2a7856d82e2757587a04e2cbd417f
Instruction ID: f7c00daa27425be24fc30b7433d625a6a99647ed87e956ed7950bc718c51bd47
Opcode Fuzzy Hash: 4dc756646f465d19538aa0d0ebc42b3fd6a2a7856d82e2757587a04e2cbd417f
Instruction Fuzzy Hash: 9D112136A08A45C1EB54AF25D9A033DA3E8FF99F84F544431CA6D027A9DE3CD450C3B1

Function 00007FF7F6783540 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F6783578
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F678359E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67835BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F67835CE

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c78045512bd42d14feec1b2225692ea8de54b7c52051612741a62dcf1c59137d
Instruction ID: 957812c387b748c386d7cb26501867a356b4e1d9ce0e7706a661831f116de0a1
Opcode Fuzzy Hash: c78045512bd42d14feec1b2225692ea8de54b7c52051612741a62dcf1c59137d
Instruction Fuzzy Hash: 11116A36614B41C6D7409F69E990369B3A8F788F84F584035DFAE47368CF38E8A5C3A0

Function 00007FF7F6795180 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F679127E), ref: 00007FF7F67951A6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F679127E), ref: 00007FF7F67951C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F679127E), ref: 00007FF7F67951E2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7F679127E), ref: 00007FF7F67951F0

Memory Dump Source

Source File: 00000000.00000002.3331429867.00007FF7F6741000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F6740000, based on PE: true

Associated: 00000000.00000002.3331397773.00007FF7F6740000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331494522.00007FF7F67A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331546005.00007FF7F67B9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3331580865.00007FF7F67BF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f6740000_AimPrivStoreAtt117.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a9be8488605f3ddb21fcd3ebe878c33e1fc0cdb249d0500abf06e90a83e44b1c
Instruction ID: ea58315c383665933c7991f124df9d9d9e484e1f896b55bb2ce9864394e7f90d
Opcode Fuzzy Hash: a9be8488605f3ddb21fcd3ebe878c33e1fc0cdb249d0500abf06e90a83e44b1c
Instruction Fuzzy Hash: 1E11A836614B45C2EB14AF2AE9A112DB3B8FF99F847500426DE6D437A9DF38D850C3A0

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AimPrivStoreAtt117.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
AimPrivStoreAtt117.exe

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre